Privacy policy

Updated: 2026-07-08

1. Controller

[UAB „AromaSet“], company code [įmonės kodas: 000000000], VAT [PVM mokėtojo kodas: LT000000000000], registered office [registracijos adresas], Vilnius, Lietuva, e-mail support@aromaset.lt. This policy follows the GDPR (EU) 2016/679 and the Lithuanian Law on Legal Protection of Personal Data.

2. What we process and why

Order data (name, e-mail, phone, delivery address, purchase history) — to conclude and perform the contract (Art. 6(1)(b) GDPR); kept 10 years (accounting law).
Payment data — processed by Stripe Payments Europe Ltd. as an independent controller; we never see card details.
E-mail for the promo code — based on consent (Art. 6(1)(a)); until withdrawn.
Analytics (Google Analytics) — only with cookie-banner consent; pseudonymised, kept up to 26 months.

3. Recipients

Delivery companies (DPD, Omniva, Venipak, LP Express), Stripe, e-mail and hosting providers, Google (analytics, consent only). Transfers outside the EEA occur only with appropriate safeguards (SCCs).

4. Your rights

Access, rectification, erasure, restriction, portability, objection and withdrawal of consent at any time: support@aromaset.lt.

5. Complaints

State Data Protection Inspectorate (VDAI), L. Sapiegos g. 17, 10312 Vilnius, vdai.lrv.lt.

6. Security

TLS encryption, access control and data minimisation. Cookie use is described in the Cookie policy.