PENNY AROMATHERAPY

Purchase Now

Privacy Policy

Effective Date: October 23, 2026

‌PENNY PRICE AROMATHERAPY LTD‌ (hereafter referred to as “we”, “us”, or “our”), the operator of the e-commerce website www.pennyaromatherapy.com, is committed to protecting the personal data and privacy rights of all our customers and website visitors. This Privacy Policy outlines how we collect, process, store, and manage your personal information in full compliance with applicable data protection regulations, including the UK Data Protection Act 2018, EU General Data Protection Regulation (GDPR), and the UK 2024 Digital Markets, Competition and Consumers Act. This policy applies to all interactions you have with our website, including browsing product pages, placing orders, creating user accounts, contacting our customer support team, and participating in our brand community activities.

1. General Definitions

For the purposes of this Privacy Policy:

  • ‌Personal Data‌ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • ‌Data Subject‌ refers to any individual whose personal data we collect and process through our website.
  • ‌Processing‌ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

2. Information We Collect

We only collect information that is necessary for the specific, explicitly stated purposes of operating our aromatherapy e-commerce store, and we never collect unnecessary personal data without your explicit consent. The categories of information we may collect include:

2.1 Information You Provide Directly to Us

  • ‌Account and Order Information‌: When you create a user account, place an order, or complete a checkout process, we collect your full name, billing and delivery address, contact phone number, email address, and order details of the essential oil diffusers, reed diffuser sets, and other fragrance products you purchase.
  • ‌VAT Related Information‌: For customers placing orders that require customs clearance for cross-border deliveries within the European Economic Area, we may collect your VAT number when explicitly required for purposes. When we collect your VAT number, we will sign a Data Processing Agreement (DPA) with you explicitly stating that this data will be used exclusively for customs declaration, and will not be stored for longer than 3 years.
  • ‌Customer Support Correspondence‌: When you contact us via email at vellum@pennyaromatherapy.com, phone at +44 1455 244104, or the contact form on our website, we may record your communication content, feedback about our products, and resolution records for after-sales issues.
  • ‌Marketing Preference Information‌: When you sign up for our newsletter, participate in promotional activities, or join our loyalty program, we collect your consent records for receiving marketing communications, your preferred fragrance product categories, and your feedback on new product launches.

2.2 Information We Collect Automatically

  • ‌Website Usage Data‌: When you browse www.pennyaromatherapy.com, our system automatically records your IP address, browser type, device information, page browsing duration, click paths, and access time, to help us optimize website performance and improve user browsing experience.
  • ‌Cookie Data‌: We use Cookiebot free version to automatically generate EU standard Cookie pop-ups on our website, which clearly classify Cookies into “Necessary Cookies” and “Marketing Cookies”. We provide you with full control over your consent preferences, including the function to withdraw your consent at any time, to fully meet the requirements of the EU ePrivacy Directive. Necessary Cookies are required for the normal operation of the checkout process and shopping cart function, and marketing Cookies are only deployed after your explicit separate consent.
  • ‌Payment Related Information‌: For payment processing, we do not store your complete bank card number or payment account password on our own servers. We use the built-in data desensitization functions of industry-recognized payment service providers PayPal and Stripe to process sensitive payment information, which fully meets the dual compliance requirements of PCI-DSS and GDPR, ensuring that your financial data is protected at all times.

3. Purposes of Processing Your Personal Data

We process your personal data only on lawful bases including performance of a contract, compliance with legal obligations, legitimate interests pursued by us or a third party, and your explicit consent, for the following specific purposes:

  1. ‌Order Fulfilment and Service Delivery‌: To process your placed orders, arrange product delivery, send order status and logistics updates, and provide after-sales support for all aromatherapy products you purchased, including reed diffusers, car diffusers, essential oil blends and related accessories.
  2. ‌Legal Compliance‌: To fulfil our legal obligations under applicable tax regulations, consumer protection laws, and data protection rules. For cross-border orders to EU member states, we will use the pre-provided compliance templates of Shopify and Amazon European stations to complete GDPR cross-border data transmission authorization, to automatically realize compliant docking with EU e-commerce regulatory requirements, without requiring you to go through complex independent SCCs filing processes.
  3. ‌Product and Service Optimization‌: To analyze website operation data, understand user browsing habits, optimize our product display structure, improve checkout process efficiency, and develop new aromatherapy products that better match the usage habits of our customers who love quiet, high-quality home fragrance experiences.
  4. ‌Personalized Customer Service‌: To respond to your consultation requests, handle your return and refund applications, and provide you with targeted usage guidance for your essential oil diffuser products based on your purchase history.
  5. ‌Legitimate Marketing Activities‌: After obtaining your separate explicit consent, we will send you our new product launch notifications, exclusive discount information (including the 15% off discount for first-time orders announced on our homepage), and seasonal fragrance activity reminders through email. You can unsubscribe from marketing emails at any time by clicking the unsubscribe link at the bottom of each marketing email, or sending a notification to our contact email vellum@pennyaromatherapy.com.

4. Sharing and Disclosure of Your Personal Data

We will never sell, rent, or trade your personal data to unrelated third parties for commercial purposes without your explicit written consent. We may share your necessary information only with the following types of trusted third parties, and all shared data will be strictly limited to the minimum scope required to achieve the specified purposes:

  • ‌Logistics and Delivery Partners‌: We will share your name, delivery address and contact phone number with the courier service providers we cooperate with, only for the purpose of completing the product delivery you ordered.
  • ‌Payment Service Providers‌: We share necessary payment information with PayPal, Stripe and other certified payment institutions, to complete order settlement and ensure the security of transaction processes.
  • ‌Regulatory Authorities‌: When required by law, court order, or governmental regulatory mandatory requirements, we may disclose your relevant personal data to the corresponding authorized agencies in accordance with legal procedures.
  • ‌Data Processors We Authorize‌: For third-party service providers that help us operate the website, maintain data security, and conduct compliance audits, we will sign strict data processing agreements with them, clearly stipulating that they can only process your personal data in accordance with our instructions, and cannot independently use or disclose your information.

5. Data Storage and Security Protection

We take a series of strict technical and organizational security measures to protect your personal data from unauthorized access, use, disclosure, modification or destruction:

  • All sensitive personal data such as your ID information and bank card data are processed through the built-in desensitization functions of professional payment tools, and we do not store complete sensitive data locally, which fully meets the dual compliance standards of PCI-DSS and GDPR.
  • For the VAT number information we collect for customs declaration, we will strictly follow the storage period requirement of no more than 3 years, and automatically delete the relevant data after the storage period expires.
  • We use industry-standard data encryption technology to transmit and store your data, regularly conduct security risk assessments for our website system, and timely update security patches to prevent data leakage risks.
  • Our team has formulated strict internal data access authority management rules, and only authorized employees who need to contact your data to complete their work can access your personal information, and all access behaviors will be recorded and audited.
  • For customers located in the European Union, we complete the required cross-border data transmission compliance settings through the official authorized compliance templates of mainstream e-commerce platforms, ensuring that your personal data transmitted across borders is fully protected in accordance with GDPR requirements.

6. Your Rights as a Data Subject

In accordance with applicable data protection regulations including GDPR and UK Data Protection Act 2018, you have the following comprehensive rights related to your personal data processing. You can submit an application to us at any time through the contact channels specified in this Privacy Policy, and we will respond to your request within no more than 30 days in most cases:

  1. ‌Right of Access‌: You have the right to obtain a copy of all your personal data we hold, and to obtain information about the specific processing purposes, data categories, recipient categories, storage period and other related details of the processing activities.
  2. ‌Right to Rectification‌: If you find that the personal data we hold about you is inaccurate or incomplete, you have the right to request us to correct or supplement the relevant information immediately.
  3. ‌Right to Erasure‌: Under specific circumstances, such as when your personal data is no longer necessary for the original collected purpose, or you withdraw your consent to the processing and there is no other legal basis for us to continue processing the data, you have the right to request us to delete your personal data completely.
  4. ‌Right to Restriction of Processing‌: You have the right to request us to restrict the processing of your personal data when you dispute the accuracy of the data, the processing is illegal but you refuse to delete the data, or we no longer need the data for processing purposes but you require the data to be used for the establishment, exercise or defense of legal claims.
  5. ‌Right to Data Portability‌: You have the right to obtain the personal data you provided to us in a structured, commonly used and machine-readable format, and you have the right to transmit such data to another data controller without hindrance from us, where the processing is based on your consent or on a contract.
  6. ‌Right to Object‌: You have the right to object to the processing of your personal data which is based on our legitimate interests at any time. We will stop the processing of your relevant data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defense of legal claims. You also have the absolute right to object to us processing your personal data for direct marketing purposes at any time.
  7. ‌Right to Withdraw Consent‌: For processing activities that are based entirely on your explicit consent, you have the right to withdraw your given consent at any time. The withdrawal of consent will not affect the legitimacy of processing activities that we have carried out based on your consent before the withdrawal.
  8. ‌Right to Lodge a Complaint‌: If you believe that our processing of your personal data violates applicable data protection regulations, you have the right to lodge a complaint with the competent data protection supervisory authority in your resident country or region.

7. EU 14-Day Withdrawal Rights and Data Processing Specifications

Although the products sold on our website are mainly physical home fragrance products, we fully comply with the relevant regulations of the EU 14-day withdrawal right for remote contracts:

  • For digital content products that may be involved in individual promotional activities, we strictly follow the regulatory requirements. Before the delivery of digital content is started, we will set a non-pre-checked checkbox on the checkout page, requiring you to explicitly confirm that you agree to start the performance before the expiration of the 14-day withdrawal period, and confirm that you know that you will lose the withdrawal right after the performance starts. We will fully record your check time, the corresponding text version at that time and the associated order number, and store them as order-related logs to meet the subsequent proof requirements.
  • For orders with mixed shopping carts that contain both physical products and digital content, we will process the two types of goods separately, set separate consent confirmation items, calculate the 14-day withdrawal period separately, and process the refund separately, to ensure that the rights and interests of consumers are fully protected.
  • All the withdrawal right related terms are independently displayed in a separate section in our Terms of Service, which is easy to view, and will not be mixed in the general return and exchange policy.

8. Children’s Privacy Protection

Our e-commerce website and the aromatherapy products we sell are designed for use by adults over the age of 18. We do not knowingly collect personal data from children under the age of 16. If we find that we have accidentally collected personal information of a child under 16 without the explicit consent of parents or guardians, we will immediately take measures to delete the relevant data completely from our storage system. If you believe that we have collected personal data of a child, please contact us immediately through our official contact channels.

9. Updates to This Privacy Policy

We may update this Privacy Policy from time to time in response to adjustments in regulatory requirements, optimization of our business processes, and new functional additions to our website. When we make substantive changes to this policy, we will prominently display the updated content on the homepage of www.pennyaromatherapy.com, and mark the latest effective date at the top of the policy. For changes that will have a significant impact on your rights and interests, we will also send you a separate notification through the email address you reserved in your account. We recommend that you check this Privacy Policy regularly to stay informed of the latest provisions.

10. Contact Information

If you have any questions, comments, or application requirements related to this Privacy Policy, personal data processing activities, or data subject rights, you can contact us through the following official channels:

  • ‌Company Name‌: PENNY PRICE AROMATHERAPY LTD
  • ‌Registered Address‌: Unit D3 Radius Court, Maple Drive, Hinckley, Leicestershire, LE10 3BE, United Kingdom
  • ‌Contact Email‌: vellum@pennyaromatherapy.com
  • ‌Contact Phone‌: +44 1455 244104