At a glance

Aromastaples Ltd uses Personal Information to run aromastaples.co.uk, manage orders, consultations, bespoke and made-to-order services, payments, delivery, customer support, marketing preferences, Website security and legal records. We do not sell Personal Information.

1. Who this Privacy Policy applies to

This Privacy Policy explains how Aromastaples Ltd, trading as Aromastaples, collects, uses, stores, shares and protects Personal Information when you visit our Website, create a Customer Account, place an Order, book a Consultation, commission a bespoke or made-to-order garment, submit Measurements, contact us, subscribe to marketing, use social media to communicate with us, or otherwise interact with Aromastaples.

This Privacy Policy applies whether or not you make a purchase. It should be read together with our Cookie Policy and our Terms & Conditions / Terms of Sale.

2. Who we are and how to contact us

Aromastaples Ltd is the controller of Personal Information processed for the purposes described in this Privacy Policy. This means we decide how and why that information is used.

Business detail	Information
Legal company	Aromastaples Ltd
Trading name	Aromastaples
Company number	14914098
Registered office	20 Wenlock Road, London N1 7GU, United Kingdom
Website	aromastaples.co.uk
Privacy contact	hello@aromastaples.co.uk

 

The registered office is provided for company identification and legal correspondence. Customer and privacy enquiries should normally be sent by email. The registered office is not a returns address, studio, consultation location or fitting location unless Aromastaples expressly confirms otherwise in writing.

3. Personal Information we collect

The Personal Information we collect depends on how you interact with Aromastaples. We aim to collect only what is reasonably necessary for the relevant purpose.

Category	Examples
Identity and contact information	Name, email address, telephone number, billing address, delivery address, company details where relevant, order number and customer reference information.
Customer Account information	Login details, encrypted password, saved addresses, order history, preferences, wishlists and account activity where those features are enabled.
Order and transaction information	Products ordered, consultation bookings, invoices, refunds, exchanges, cancellations, payment status, delivery choices, order notes and customer service records.
Payment and checkout information	Billing details, payment confirmation, transaction references, fraud-prevention information, refund status and payment-dispute information. We do not store your full card number, card security code or full payment authentication credentials.
Bespoke, made-to-order and consultation information	Measurements, garment measurements, fitting notes, design preferences, fabric choices, colour choices, event dates, inspiration images, reference photographs, quotations and approvals.
Website, device and technical information	IP address, browser, device type, operating system, pages viewed, session data, cookie identifiers, security logs and diagnostic information.
Marketing information	Newsletter sign-up, marketing preferences, consent records, unsubscribe records and interactions with marketing communications.
Customer content and social media information	Messages, comments, photographs, videos, reviews, testimonials, tags, usernames and content you choose to send or publish.
Children’s information	Information provided by a parent, legal guardian or authorised adult for children’s clothing, sizing, bespoke garments, consultations, delivery, customer support or record keeping.

 

4. How we collect Personal Information

We collect Personal Information in three main ways:

• directly from you when you place an Order, create a Customer Account, book a Consultation, submit Measurements, upload images, contact us, request support, leave a review or subscribe to marketing;
• automatically through the Website, including through cookies, logs and similar technologies where enabled and lawful; and
• from limited third parties where necessary, such as WooCommerce, Stripe or other payment providers, delivery providers, fraud-prevention services, social media platforms, professional advisers or public authorities.

5. Why we use Personal Information and lawful bases

We use Personal Information only where there is a lawful basis under UK data protection law. The main lawful bases we rely on are contract, legal obligation, legitimate interests and consent.

Purpose	Main lawful basis
Responding to enquiries, quotations and consultation requests	Pre-contractual steps or legitimate interests.
Creating and managing Customer Accounts	Contract and legitimate interests.
Processing Orders and providing Products or Services	Contract.
Bespoke, made-to-order, bridal, occasionwear, children’s clothing, Measurements and fittings	Contract, pre-contractual steps, legitimate interests and, where required, consent.
Taking payment, issuing refunds and handling payment disputes	Contract, legal obligation and legitimate interests.
Delivery, customs and international shipping	Contract, legal obligation and legitimate interests.
Customer support, complaints, aftercare, alterations and dispute handling	Contract, legitimate interests and legal obligation where applicable.
Fraud prevention, Website security and business protection	Legitimate interests and legal obligation where applicable.
Accounting, tax, legal and regulatory records	Legal obligation and legitimate interests.
Marketing emails, newsletters and promotions	Usually consent. In limited cases, legitimate interests may apply where marketing law allows the soft opt-in and all legal conditions are met.
Non-essential cookies, analytics and marketing technologies	Consent where required by PECR and data protection law.

 

We do not intentionally collect Special Category Personal Information unless it is necessary for a requested Service and an appropriate lawful basis applies. Measurements are collected for garment, fitting and tailoring purposes, not to infer health information.

6. Where providing information is necessary

Some Personal Information is needed so that Aromastaples can process Orders, provide Consultations, produce bespoke or made-to-order garments, arrange delivery, process payments, respond to complaints, comply with legal duties, prevent fraud or protect legal rights. If you do not provide information that is reasonably needed for those purposes, we may be unable to provide the relevant Product or Service, complete delivery, process a refund, verify a request or respond properly to your enquiry.

7. Orders, consultations, Measurements and bespoke services

Because Aromastaples offers ready-to-wear, made-to-order, bespoke, bridal, occasionwear, children’s clothing, alterations and consultation Services, we may need detailed information to provide the Product or Service you request.

This may include Measurements, garment measurements, design preferences, consultation notes, event dates, fittings, fabric choices, colour choices, sketches, inspiration images, customer approvals and communications about your project.

Please provide accurate and up-to-date information. If you provide Measurements, images or fitting information for another person, you confirm that you have authority to do so. If the information relates to a child, it must be provided by a parent, legal guardian or authorised adult.

8. Payments, WooCommerce and Stripe

Our Website uses WooCommerce to support product browsing, basket, checkout, Customer Account and order management functions. Payments are processed through Stripe or another authorised payment provider where enabled.

Aromastaples does not receive or store your full card number, card security code or full payment authentication credentials. Complete payment details are processed by Stripe or another authorised payment provider through their own secure payment systems and under their own privacy and regulatory responsibilities.

We receive limited information needed to confirm payment, process Orders, issue refunds, handle payment disputes, prevent fraud, reconcile accounts and keep appropriate business records.

We will not ask you to send full card details by ordinary email, social media message, messaging app or standard contact form.

9. Marketing communications

We may send newsletters, product launches, collection updates, restock notices, promotions, event updates or similar marketing communications where permitted by law.

We usually rely on consent for marketing emails and newsletters. In limited cases, we may rely on the products and services soft opt-in for existing customers or people who have discussed buying from us, but only where the legal conditions are met. This includes obtaining your contact details directly from you, marketing our own similar Products or Services, giving you a clear opportunity to opt out when your details are collected, and giving you an opt-out in every marketing message.

You can unsubscribe or object to direct marketing at any time using the unsubscribe link in the message or by contacting us. Where you object to direct marketing, we will stop using your Personal Information for that purpose.

Essential service messages are not marketing. These may include Order confirmations, payment updates, Consultation reminders, delivery updates, product safety notices, refund communications and customer-support messages.

10. Cookies, analytics and similar technologies

Our Website may use cookies and similar technologies for essential Website operation, basket and checkout functionality, account login, security, preferences, analytics, performance, marketing, advertising, embedded content and social media features.

Essential cookies may be used where necessary to provide the Website or a service requested by you. Non-essential cookies, analytics cookies, marketing cookies, advertising cookies and similar technologies will only be used where consent is required and obtained.

You should be able to manage non-essential cookie preferences through our cookie banner or preference tool where available. You can also control cookies through your browser settings. For full details, please read the Aromastaples Cookie Policy.

11. Customer content, reviews, images and social media

If you send, upload, tag, share or provide photographs, videos, reviews, testimonials, comments, fitting images, before-and-after images, social media posts or other content, we may process Personal Information contained in that content for the purpose for which it was provided.

We will not treat a Product purchase, public tag, message, review or Consultation as automatic permission to use your image, a child’s image or private customer content for marketing. Where marketing, portfolio, Website, social media or advertising use requires permission, we will seek appropriate permission.

Social media platforms process Personal Information under their own terms and privacy notices. Avoid sending sensitive information through social media unless necessary. Where a matter involves private information, Measurements, children’s information, payments, complaints or legal issues, we may ask you to continue by email.

12. Children’s privacy

Aromastaples sells Products intended for children, but the Website, checkout, Consultations and Orders are intended for adults. Children’s Products must be ordered by a parent, legal guardian or authorised adult.

Where you provide Personal Information relating to a child, you confirm that you have authority to provide it. We use children’s Personal Information only where reasonably needed to provide the relevant Product or Service, manage delivery, keep records, comply with legal obligations, prevent fraud, handle complaints or protect rights.

We do not knowingly collect Personal Information directly from children for marketing purposes. We will not treat purchase of a children’s Product as permission to use a child’s image, name, video or likeness for marketing.

13. Sharing Personal Information

We do not sell Personal Information. We share Personal Information only where lawful, necessary and proportionate for the purposes described in this Privacy Policy.

Recipient category	Why information may be shared
WooCommerce, Website, hosting and technical providers	To run, maintain, secure and support the Website, checkout, Customer Accounts and order management.
Stripe and other authorised payment providers	To process payments, confirm transactions, issue refunds, prevent fraud and handle payment disputes.
Couriers, logistics providers and customs authorities	To deliver Orders, manage tracking, handle international shipping and comply with customs or export requirements.
Email, marketing and communication providers	To send service messages and, where lawful, marketing communications.
Analytics, cookie, advertising and performance providers	To understand Website use, improve performance and support marketing where consent is required and obtained.
Fraud-prevention, IT security and professional advisers	To protect customers and Aromastaples, prevent fraud, obtain advice and defend legal rights.
Regulators, courts, tax authorities, law enforcement or public authorities	Where required or permitted by law, legal process or regulatory obligation.
Business transfer recipients and advisers	Where reasonably necessary for a merger, restructuring, investment, sale of business assets or similar corporate event, subject to appropriate safeguards.

 

Where a third party acts as our processor, we seek to use appropriate contractual and security safeguards. Some providers, such as payment providers, social media platforms or delivery providers, may also act as independent controllers under their own privacy notices.

14. International transfers

Personal Information may be transferred, accessed or processed outside the United Kingdom where needed for international delivery, customs, payment processing, Website hosting, analytics, security, email services, social media, customer support or other business operations.

Where UK international transfer rules apply, we will seek to use appropriate safeguards or lawful transfer mechanisms. These may include UK adequacy arrangements, a recognised data bridge, the UK International Data Transfer Agreement, the UK Addendum to Standard Contractual Clauses, UK Binding Corporate Rules, or another lawful safeguard or exception where applicable.

Independent third-party providers, such as payment providers or social media platforms, may also make their own international transfers under their own privacy notices and legal obligations.

15. How long we keep Personal Information

We keep Personal Information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide Products and Services, keep business records, comply with legal duties, resolve disputes, prevent fraud and protect legal rights.

Type of information	Typical retention approach
Order, payment, refund, accounting and tax records	Usually kept for up to 6 years where needed for accounting, tax, contract, dispute or legal record purposes.
Customer Account information	Kept while the account remains active, then for a reasonable period after closure or inactivity where needed for records, fraud prevention, support or legal purposes.
Consultation, Measurement, bespoke, fitting and design records	Kept while needed to provide the Service, support aftercare, manage related Orders, handle disputes, protect legal rights or maintain business records.
Customer support, complaints and dispute records	Kept for as long as needed to resolve the matter and for a reasonable period afterwards for legal, quality-control and business-record purposes.
Marketing records	Kept while you are subscribed. If you unsubscribe or object, we may keep a suppression record so we do not send further marketing.
Cookie consent and analytics records	Kept according to the cookie tool, analytics settings and Cookie Policy.
Security logs and fraud-prevention records	Kept for a limited period appropriate to security, fraud-prevention, investigation and legal protection needs.

 

Backups or residual copies may take longer to remove from secure systems, but we will not use them for ordinary business purposes once deletion or restriction is required.

16. Security

We use appropriate technical and organisational measures to protect Personal Information, taking account of the nature of the information, the Website, our service providers and our business operations. Measures may include access controls, secure payment providers, password protection, data minimisation, business record controls, security monitoring and limiting access to people who need it.

No Website, email system, payment system or internet transmission can be guaranteed to be completely secure. You should use strong passwords, keep account details confidential, avoid sending unnecessary sensitive information, and contact us if you believe your account, payment details or communication with Aromastaples has been compromised.

17. Your data protection rights

Depending on the circumstances, you may have rights under UK data protection law. These may include:

• the right to be informed about how your Personal Information is used;
• the right of access to your Personal Information;
• the right to correct inaccurate or incomplete information;
• the right to ask for deletion in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to data portability in certain circumstances;
• the right to object to certain processing;
• the right to withdraw consent where processing is based on consent;
• rights relating to automated decision-making where applicable; and
• the right to complain to the Information Commissioner’s Office.

Your right to object You have the right to object to direct marketing at any time. You may also object to certain processing based on legitimate interests. Where you object to direct marketing, we will stop using your Personal Information for that purpose.

 

Not every right applies in every situation. We may need to verify your identity before responding to certain requests. We may also ask for more information if we need it to understand your request.

18. Automated technologies and artificial intelligence

We may use technology tools, including automated systems, to support Website administration, security, fraud prevention, customer support, analytics, operational efficiency and business improvement.

We do not use solely automated decision-making that produces legal or similarly significant effects concerning you unless permitted by law and appropriate safeguards are in place.

19. Privacy requests and complaints

To make a privacy request, ask a question or raise a complaint about Personal Information, contact: hello@aromastaples.co.uk

You should provide enough information to identify you and understand your request. If you are acting for someone else, we may ask for proof of authority.

You also have the right to complain to the UK Information Commissioner’s Office. You can find information at www.ico.org.uk or contact the ICO using the details published on its website. We encourage you to contact Aromastaples first so we can try to resolve your concern.

20. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our Website, Products, Services, payment tools, delivery partners, cookies, marketing tools, legal requirements, security practices or business operations.

Where we make material changes, we may take reasonable steps to bring them to your attention, such as updating the “last updated” date, publishing the updated policy on the Website, adding a Website notice or seeking consent where required by law.

21. Contact us

For privacy questions, rights requests, cookie questions, marketing preferences, complaints or customer support involving Personal Information, contact Aromastaples using:

• Email: hello@aromastaples.co.uk
• Registered office: Aromastaples Ltd, 20 Wenlock Road, London N1 7GU, United Kingdom
• Website: aromastaples.co.uk

The registered office is provided for company identification and legal correspondence. Customer enquiries should normally be sent by email.