Privacy policy

Last updated: September 8, 2026

Through this Policy, we inform you about how we collect, use, transfer, and protect your personal data. We process this data in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“General Data Protection Regulation”, hereinafter “GDPR”), as well as the relevant national legislation on the protection of personal data.

1. WHO ARE WE?

CASHMERE AROMA GLOBAL S.R.L., with its registered office in Bucharest, Sector 2, Str. Tomovici Stelian no. 6, Office no. 1, registered with the Trade Register under no. J20266046681009, Tax ID (CUI) 55309683 (hereinafter the “Company” or “We”), acting as personal data controller, operates the online store cashmerearoma.com (hereinafter the “website”).

Our contact details:

Registered office address: Bucharest, Sector 2, Str. Tomovici Stelian no. 6, Office no. 1
Email address: contact@cashmerearoma.com

2. HOW DO WE PROCESS YOUR PERSONAL DATA?

The Company, as Controller, processes the personal data of individual customers, representatives of corporate customers, newsletter subscribers, and other individuals who interact with the Company through the website.

Personal data is:

processed lawfully, fairly, and transparently in relation to the data subject;
collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes;
adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed;
accurate and kept up to date;
kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed;
processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures.

3. WHAT TYPES OF PERSONAL DATA DO WE PROCESS AND FOR WHAT PURPOSE?

For the purpose of placing, processing, and delivering orders made on the website, we process the following types of personal data: first name, last name, delivery and billing address, country, email address, phone number, order details, and, where applicable, the billing details of the legal entity.

Orders may be paid online by bank card, through the payment processor Shopify Payments, as well as through the payment services Google Pay, Apple Pay, and Shop Pay. Payment data (bank card details, or the details associated with the electronic wallet used) is processed exclusively by the payment processor and by the payment service provider you choose, on their secure pages.

The Company does not store and does not have access to your card details. On your bank statement, the transaction will appear under the name "Cashmere Aroma Global."

For the purpose of completing and submitting the contact form on the website, we process the following types of personal data: first name, last name, email address, country, and, where applicable, any other data provided at the data subject's own initiative within the message.

For the purpose of managing return requests submitted through the dedicated form on the website, we process: first name, last name, order number, email address, and phone number.

For the purpose of managing contract withdrawal statements submitted through the online withdrawal function (Article 11¹ of Emergency Ordinance no. 34/2014), we process: name, order identification details, and the email address to which the acknowledgment of receipt is sent.

We do not use your personal data to send you marketing communications, such as newsletters, unless you give your express consent for such communications by ticking a consent box to that effect. For this purpose, we process only your email address and we ensure that you have a simple option to unsubscribe at any time, i.e., to withdraw your consent to receive these types of communications.

For website visitors, we may collect data through cookies or other similar technologies, such as: IP address, internet browser, location, web pages accessed on our website, time spent on the website, internet network, and device used. For more details, please see our Cookie Policy.

We do not collect CVs and we do not carry out recruitment processes through the website, nor do we publish photos or video materials of identifiable individuals on the website.

4. WHAT ARE THE LEGAL GROUNDS FOR PROCESSING PERSONAL DATA?

Your personal data is processed for the purpose of:

concluding and performing the distance sales contract – processing orders, delivering products, managing return requests (Article 6(1)(b) GDPR);
complying with our legal obligations – issuing and archiving financial-accounting documents, resolving contract withdrawal statements in accordance with Emergency Ordinance no. 34/2014, resolving complaints (Article 6(1)(c) GDPR);
based on consent requested and/or given in advance – sending marketing communications (newsletter), placing non-essential cookies (Article 6(1)(a) GDPR);
for the purpose of the Company's legitimate interests – responding to messages sent through the contact form, ensuring website security, exercising the Company's legitimate rights and interests in contentious or non-contentious proceedings (Article 6(1)(f) GDPR).

5. FOR HOW LONG DO WE PROCESS YOUR PERSONAL DATA?

Personal data is stored for processing for as long as necessary to achieve the processing purposes set out in this Policy, or for as long as required by law.

For example:

data related to orders and financial-accounting documents – for the statutory archiving periods set out in Accounting Law no. 82/1991;
data related to contract withdrawal statements submitted through the online withdrawal function – 3 years from the date the statement is received;
data processed for sending the newsletter (email address) – until consent is withdrawn (unsubscribe), but no longer than 3 years from the subscriber's last interaction with our communications, subscriber lists being reviewed and updated periodically;
data submitted through the contact form – for as long as necessary to resolve the request, and subsequently for a maximum period of 1 year.

6. TO WHOM DO WE DISCLOSE PERSONAL DATA?

We will not disclose or transfer any of the personal data collected from or about you to any third party, except to:

Public authorities and institutions – where there is a legal obligation to do so or for the purpose of a legitimate interest (defending the Company's rights in contentious or non-contentious proceedings, etc.);
The Company's contractual partners or collaborators who provide services necessary for the operation of the online store, namely: Shopify International Limited (the online store's hosting platform and the Shopify Payments payment processor), the email service provider — GoDaddy, the shipment management platform Innoship and the courier companies selected through it for the delivery of your order — Packeta, DPD, GLS, or FedEx —, which may in turn work with local delivery subcontractors depending on the destination country (we transmit to them only the data necessary for delivery: first name, last name, delivery address, phone number, email address), the website development and maintenance agency Dan ȚInc, Hlavní 57, Popice 69127, Reg. No. 09378723, Tax ID CZ9403031682, and the accounting services provider;
Any third party – if you have given your express and specific consent, for that particular situation and that particular data.

Certain Company providers (e.g., Shopify Inc. – the parent company of the platform, headquartered in Canada, and GoDaddy – headquartered in the U.S.A.) may process personal data outside the European Economic Area. Also, for orders delivered to Switzerland or the United Kingdom, the data necessary for delivery is transmitted to couriers and local subcontractors in these countries, both of which benefit from adequacy decisions issued by the European Commission. Where personal data processed by the Company is transferred, directly or through its contractual partners/collaborators, outside the European Economic Area, we ensure that such transfers take place in compliance with the GDPR (in particular Articles 44–46 GDPR), based on an adequacy decision of the European Commission (such as the one concerning Canada, or the EU–U.S. Data Privacy Framework) or based on appropriate safeguards (standard contractual clauses adopted by the Commission), and subject to the existence of enforceable rights and effective remedies for data subjects.

7. WHAT PROTECTIVE MEASURES AND SAFEGUARDS DO WE TAKE?

The Company implements appropriate technical and organizational measures to ensure a high level of security and protection of personal data (website secured with an SSL certificate, software component updates, complex passwords, restricted access to the database).

We use security methods and technologies, together with internal work policies and procedures, including control and audit, to protect the personal data collected in accordance with the applicable legal provisions relevant to the protection of personal data.

8. WHAT ARE YOUR RIGHTS AS A DATA SUBJECT?

Any data subject may exercise the following rights, as provided by the General Data Protection Regulation:

Right of access;
Right to rectification;
Right to erasure;
Right to restriction of processing;
Right to data portability;
Right to object to processing;
Right not to be subject to a decision based solely on automated processing, including profiling;
Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
Right to lodge a complaint with the National Supervisory Authority for Personal Data Processing and with the courts of law.

To exercise these rights or for any questions regarding the processing of your personal data, please contact us at: contact@cashmerearoma.com