Privacy policy

This Privacy Policy describes how we collect, use and disclose your personal information when you access the Services, use them, make a purchase or any other transaction, or communicate with us by any other means. In the event of any conflict between our Terms of Service and this Privacy Policy, this Privacy Policy prevails with respect to the collection, processing and disclosure of your personal information.

Please read this Privacy Policy carefully. By accessing and using our Services, you acknowledge that you have read this Privacy Policy and that you understand how your information is collected, used and disclosed, as described in this Privacy Policy.

1. Who is responsible for your data, and what does this page cover?

This store, Olfazeta by Chogan (olfaparfum.fr), is operated by:

• Aroma Logistics Co, registered under number SIREN 102 212 289 — activity 47.91B, distance selling via specialised catalogue
• Registered office: 231 rue Saint-Honoré, 75001 Paris, France
• E-mail: help@olfazeta.fr

Aroma Logistics Co is the data controller of your personal data within the meaning of the General Data Protection Regulation (GDPR) and of the loi n° 78-17 du 6 janvier 1978, known as the "Informatique et Libertés" law (the French Data Protection Act). It is to us, and to no one else, that you should address your requests.

Aroma Logistics Co is the trade name under which this business is carried on as a sole proprietorship. The full identification of the operator appears in our legal notice; the SIREN number indicated above is its own. There is therefore only one data controller, designated in both documents.

1.1 We do not have a data protection officer

No data protection officer (DPO) has been appointed, and Article 37 of the GDPR does not require one in our situation: we are not a public body, our core activity does not consist of regular and systematic large-scale monitoring of individuals, and we do not process sensitive data on a large scale.

Your requests are therefore handled directly by us, at help@olfazeta.fr.

1.2 What this page covers, and what it does not

This policy applies to all personal data that we process when you browse our site, create an account, place an order, write to us, use the chat, sign up for our e-mails or track a parcel. In the event of any conflict between our terms and conditions of sale and this policy, this policy prevails for everything concerning your personal data.

It does not apply to sites that do not belong to us and to which we may link. As soon as you reach them, their own rules apply, and we have no control over what they do with your data. The link to our Instagram account, at the bottom of the page, is a plain link: no Instagram script is loaded on our site, and nothing is transmitted to that network until you click on it.

2. What data do we process, and where does it come from?

We process the following categories of data:

• Identity and contact details: surname, first name, delivery address, billing address, e-mail address, telephone number if you give it to us.
• Customer account, if you create one: login credentials, saved addresses, preferences, wishlist.
• Orders and transactions: items ordered, amounts, date, delivery method, returns, exchanges, refunds, purchase history.
• Payment: payment method used, confirmation or refusal of the transaction, last four digits of the card. We never receive or store your full card number: it is processed directly by the payment provider.
• Exchanges with us: content of your e-mails, your messages in the chat, the forms you fill in.
• Browsing and device: IP address, browser and device type, language, pages viewed, products viewed, cart contents — within the limits of section 7.
• Delivery: tracking number, status and transport stages of the parcel.
• Commercial communication: subscription or unsubscription to our e-mails, date and proof of your choice.

This data reaches us from you, when you order, create an account, write to us or sign up for our e-mails; from your browser, automatically, under the conditions described in section 7; and from our service providers when they act on our behalf, in particular the platform that hosts the store, the payment provider and the carrier that transmits to us the transport stages of your parcel.

We do not request or knowingly collect sensitive data within the meaning of Article 9 of the GDPR (health, opinions, origin, sexual orientation, religion). Please do not send us any in your messages.

2.1 Minors

Our products and our store are intended for adults. We do not seek to collect data from minors and we do not target our services at them.

In France, a minor may consent alone to the processing of their data in the context of an online service from the age of 15. Below the age of 15, consent must be given jointly by the minor and by the holder of parental authority. This is the rule laid down by article 45 of the French "Informatique et Libertés" law. In the other Member States of the European Union, this age is set by national legislation at between 13 and 16 years (Article 8 of the GDPR).

If you are a holder of parental authority and you find that a minor has sent us their data without your agreement, write to us at help@olfazeta.fr: we will delete it.

3. Why do we process it, and on what legal basis?

The GDPR requires that each purpose rest on a specific legal basis (Articles 6 and 13). Here are ours, without exception.

What we do	With what data	Legal basis (Article 6 of the GDPR)
Running the store: browsing, cart, display in your language and currency, product suggestions based on what you have viewed or purchased	Browsing, cart, language, currency, products viewed, purchase history	Legitimate interest (6(1)(f)): running the store you have asked to visit and saving you time in an extensive catalogue. You may object to this (section 9)
Creating and managing your customer account, processing your order, collecting payment, shipping, keeping you informed of tracking, handling returns, exchanges and refunds	Identity, credentials, addresses, order, payment, delivery	Performance of the contract (6(1)(b))
Preventing and detecting payment fraud and abusive use	Order data, IP address, device, risk indicators	Legitimate interest (6(1)(f)): protecting our customers, our payment methods and our business
Responding to your messages and providing you with customer service, by e-mail and by chat alike	Content of the exchange, order reference	Performance of the contract (6(1)(b)) if your request concerns an order; otherwise legitimate interest (6(1)(f)): replying to whoever writes to us
Issuing and keeping invoices, keeping the accounts, keeping proof of your choices regarding cookies and e-mails	Identity, billing address, amounts, date and direction of your choice	Legal obligation (6(1)(c)) — article L. 123-22 du code de commerce (French Commercial Code) for accounting, Article 7(1) of the GDPR, which requires us to be able to demonstrate your consent
Sending you our commercial e-mails and reminding you of a cart left at the payment stage	E-mail address, first name, purchase history, cart contents	Consent (6(1)(a)) if you are not yet a customer. If you are, legitimate interest (6(1)(f)): offering you products similar to those you have purchased, within the strict framework of article L. 34-5 du code des postes et des communications électroniques (French Postal and Electronic Communications Code) (section 3.1)
Measuring the site's audience, understanding how it is used, showing you our advertisements and measuring their effectiveness	Browsing identifiers and advertising identifiers, pages viewed, purchase events	Consent (6(1)(a)) — article 82 of the French "Informatique et Libertés" law
Establishing, exercising or defending a legal claim, handling a complaint	Order file, exchanges, proof of delivery	Legitimate interest (6(1)(f)): asserting our rights and responding to yours

Where we rely on our legitimate interest, you may object: see section 9. Where we rely on your consent, you may withdraw it at any time, as easily as you gave it.

3.1 Our commercial e-mails: your agreement first

If you have never bought from us, we send you commercial e-mails only if you have expressly authorised us to do so, via a non-pre-ticked checkbox or a voluntary sign-up. This is what article L. 34-5 du code des postes et des communications électroniques (French Postal and Electronic Communications Code) requires for direct marketing addressed to private individuals.

If you have already placed an order with us, the same article allows us to write to you about products similar to those you have purchased, without new prior agreement. The CNIL specifies that this exception presupposes an actual purchase: merely creating an account is not enough. It is moreover subject to safeguards: the possibility of refusing all direct marketing is offered to you at the time your address is collected, in an express, unambiguous, simple and free-of-charge manner.

Cart reminders follow the same rules: if you leave your e-mail address at the payment stage without completing your order, the reminder rests on your agreement if you are not yet a customer, and on our legitimate interest if you are.

Every commercial e-mail and every reminder contains an unsubscribe link, free of charge and immediate; you can also write to us at help@olfazeta.fr. Unsubscribing does not affect the e-mails related to your orders — confirmation, invoice, shipment, return, customer service reply. These are not commercial messages: they are part of the performance of the sale and will continue to reach you.

4. What must you provide to us, and what happens if you refuse?

Not all data is equal: some of it is a condition of the sale, other data changes nothing about your order if you refuse it.

• Required in order to place an order: name, delivery address, e-mail address, billing address and payment data. Without them, the order cannot be placed: we can neither conclude nor perform the sale, nor deliver to you, nor issue the invoice the law requires us to keep, nor collect payment.
• Optional: the telephone number, except where the chosen delivery method requires it. Refusing it has no consequence for the sale; some delivery methods may be unavailable, and the carrier will not be able to reach you in the event of a difficulty.
• Optional: the customer account. You can order without creating one. Without an account, you simply will not find your orders and saved addresses again from one time to the next.
• Optional: signing up for our e-mails. You will not receive our offers, but you will always receive the e-mails related to your orders.
• Optional: audience measurement and advertising cookies. Refusing them has no consequence: the site works exactly the same way, only audience measurement and advertising personalisation are disabled.

5. To whom do we transmit your data?

We do not sell your personal data and we do not rent it to anyone. We transmit it only to those who need it so that your order can exist, arrive and be paid for — and, for audience measurement and advertising, within the limits of your choice.

Your data is communicated to the following categories of recipients:

• Hosting of the store and order processing. Our store runs on the Shopify platform — contracting entity for Europe: Shopify International Limited, Dublin, Ireland. It hosts the site and the checkout, processes orders and payments, provides the content delivery network and the fonts, and offers the Shop Pay accelerated checkout. It receives all the data necessary for the operation of the store and the performance of your order.
• Payment. The payment providers engaged by the checkout collect the transaction and verify it. They receive your payment data, the amount and the elements necessary for fraud prevention.
• Transport and delivery. The carriers that transport your parcel from Italy receive your name, delivery address, e-mail, telephone number if you have provided it, and the parcel number.
• Conversational assistance. The site's chat window is provided by a specialised provider, whose replies are produced by a language model. It receives the content of your conversation, your IP address, your browser, the pages viewed during the exchange and the contents of your cart. If you are logged in to your customer account, the store also transmits to it your name, e-mail address, telephone number, number of orders, total spent and the direction of your choice regarding our e-mails. You can at any time send us your request by e-mail rather than through the chat.
• Audience measurement and advertising. Once the tools described in section 7 are deployed, Google will receive, only if you have consented to it, browsing identifiers and purchase events. Our product catalogue will moreover be transmitted to it for the delivery of our advertisements, without any visitor data.
• Advice and legal obligations. Our accountant, the tax authorities and, where applicable, an officer of the court receive strictly what the obligation or the proceedings require.

Our service providers act only on our instructions and are not authorised to use your data for their own purposes: the use of a processor is governed by Article 28 of the GDPR. Public authorities and officers of the court, for their part, do not act on our behalf; they receive what a legal obligation or proceedings entitle them to obtain, and nothing more.

The up-to-date list of our processors is communicated to you on simple request, at help@olfazeta.fr: this is the way to know, at the date of your request, the exact identity of the providers falling within the categories above.

Shopify also processes certain data for its own platform purposes: their use is described in the Shopify consumer privacy policy, and you can exercise your rights with Shopify via its privacy portal.

Finally, in the event of a sale, merger or reorganisation of our business, your data could be transmitted to the acquirer, who would then be bound by the same obligations as those described here. You would be informed of this.

6. How long do we keep it?

We do not keep your data indefinitely. Where a period is set by law, we apply it; otherwise, we adopt the CNIL's reference periods.

Data	Period	Starting point and basis
Orders, invoices and accounting records	10 years	Close of the financial year concerned — article L. 123-22 du code de commerce (French Commercial Code)
Customer account and history of the commercial relationship	The entire duration of the relationship, then 3 years	Last contact or last order — the CNIL's reference period for inactive customers
Data of people who signed up for our e-mails without having purchased	3 years	Last contact from you: open, click, message — the CNIL's reference period for prospects
Exchanges with customer service and chat conversations, proof of your consents, address placed on the objection list after unsubscription	3 years	Last exchange, withdrawal of consent or unsubscription — Article 7(1) of the GDPR for proof of consent. The objection list has a single purpose: to stop writing to you
Audience measurement and advertising trackers placed with your agreement	13 months lifetime, audience data kept for 25 months at most	Placement of the tracker, without automatic renewal on each visit — CNIL recommendation
Technical logs and anti-fraud indicators	12 months	Recording of the event
Elements of an ongoing or foreseeable dispute	Until the avenues of appeal are exhausted, up to a limit of 5 years	Day on which we became aware of the facts — article 2224 du code civil (French Civil Code)

At the end of these periods, the data is deleted or anonymised. Records that the law requires us to keep for longer, such as invoices, are archived with restricted access and are no longer used for anything else.

7. How do we use cookies and trackers?

When you arrive on the site, and as long as you have chosen nothing, only two cookies are placed: one remembers the market and display language, the other the currency of your cart. Without them, the site cannot show you the right prices or the right language.

Other strictly necessary cookies appear only afterwards, because what you do makes them necessary: the one that retains the contents of your cart, those that secure your session and the payment, the one that remembers your answer to the banner once you have given it. Both kinds are exempt from consent under article 82 of the French "Informatique et Libertés" law, which exempts trackers strictly necessary for the provision of the service you request.

No audience measurement cookie and no advertising cookie is placed before your agreement.

7.1 The banner: accepting, refusing, changing your mind

When you arrive, a banner allows you to accept or to refuse audience measurement and advertising cookies. Refusing is as easy as accepting.

Your refusal is actually applied, not merely recorded: as long as you have not accepted, the tools concerned remain disabled and receive no identifier concerning you.

You can go back on your choice at any time:

• by deleting our site's cookies from your browser settings, which makes the banner reappear on your next visit;
• by writing to us at help@olfazeta.fr.

Your choice, whatever it is, is remembered so that the question is not put to you again on every page. When that memory expires, the question is put to you again.

7.2 The measurement and advertising tools we are going to put in place

We are preparing to deploy the following tools. They will be triggered only after your agreement:

• Google Analytics 4 — measuring the site's audience: number of visits, pages viewed, purchase journeys, devices used. Objective: understanding what works and what gets stuck.
• Google Ads, including conversion tracking and remarketing — knowing which advertisements lead to a purchase, and showing you our products on other sites after your visit.

The choice you express on the banner is transmitted automatically to these tools, which adapt their behaviour accordingly: without your agreement, they place no measurement or advertising cookie and receive no identifier concerning you. Their lifetime and that of the corresponding data appear in section 6.

We are also going to transmit to Google Merchant Center a feed of our catalogue: product names, descriptions, prices, images, availability. This feed serves to make our items appear in Google's shopping results. It contains no visitor data: it is neither a tracker nor a measurement tool, it places nothing on your device and transmits nothing concerning you.

8. Do we make automated decisions about you?

We make no decision producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing, within the meaning of Article 22 of the GDPR.

Three processing operations nevertheless deserve to be described, because they involve a degree of automation.

• Product recommendations. The site may suggest items to you based on what you have viewed or purchased. These suggestions are computed automatically and have no consequence for the prices charged, the conditions of sale or your rights: you are free to ignore them. They rest on our legitimate interest (Article 6(1)(f) of the GDPR), and you may object to them at any time by writing to us at help@olfazeta.fr.
• Payment fraud detection. The platform automatically analyses each order and assigns it a risk indicator, based on elements such as the consistency between the billing address and the delivery address, the IP address or the behaviour of the payment method. This indicator triggers no decision on its own: any blocking or cancellation of an order is decided by a person, after review of the file. If your order is cancelled on this ground, you can ask us for explanations, put forward your point of view and request a re-examination at help@olfazeta.fr.
• Targeted advertising. Once the tools described in section 7 are deployed, and only if you have consented to it, your interactions with the site may serve to show you more relevant advertisements. This is profiling for advertising purposes. It produces no legal effect concerning you, and you can put an end to it at any time by withdrawing your consent (section 7.1).

9. What are your rights, and how do you exercise them?

You have the following rights over your personal data:

• Access (Article 15 of the GDPR): knowing whether we process data concerning you, which data, and obtaining a copy of it.
• Rectification (Article 16): having inaccurate data corrected or incomplete data completed.
• Erasure (Article 17): having your data deleted, except where the law requires us to keep it — invoices, in particular.
• Restriction (Article 18): having the use of your data frozen, for example while we verify a challenge you have raised.
• Portability (Article 20): receiving in a machine-readable format the data you have provided to us, and having it transmitted to another organisation.
• Objection (Article 21): objecting to processing based on our legitimate interest. For direct marketing, this right is absolute: it is enough to ask.
• Withdrawal of consent (Article 7(3)): withdrawing at any time an agreement you have given, as easily as you gave it. Withdrawal does not call into question what was lawfully done before.
• Post-mortem directives (article 85 of the French "Informatique et Libertés" law): setting directives on the retention, erasure and communication of your data after your death.

9.1 How to exercise them

Write to us at help@olfazeta.fr, indicating the right you wish to exercise and, if possible, the e-mail address or the order number that will enable us to find you.

• We reply within one month. This period may be extended by two months if your request is complex or if there are many of them; in that case, we inform you within the first month, explaining the reason (Article 12(3) of the GDPR).
• It is free. We charge nothing, except for a manifestly unfounded or repetitive request, within the limits of Article 12(5) of the GDPR.
• Identity verification. We will ask you for proof of identity only if we have reasonable doubts about who is writing to us (Article 12(6) of the GDPR).
• Representative. You may act through a person of your choice; we will ask them to prove their authority.

For the data that Shopify processes for its own purposes, you can also go through the Shopify privacy portal.

9.2 Lodging a complaint with the CNIL

If you believe we are not respecting your rights, write to us first: it is often the quickest way. But it is not a required step. You may at any time apply to the French supervisory authority, the Commission nationale de l'informatique et des libertés (CNIL):

• CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
• www.cnil.fr

This right is provided for by Article 77 of the GDPR. If you reside in another country of the European Economic Area, you may apply to the data protection authority of your country. The complete list is published by the European Data Protection Board: EDPB members.

10. How is your data protected and transferred?

10.1 The security measures we apply

• Encryption of exchanges. The entire site, cart and checkout is served over HTTPS: the data you enter travels encrypted between your browser and the store.
• Isolated and certified payment. Payment is processed by the Shopify checkout, certified PCI DSS Level 1, the highest level of the standard applicable to payment card data. We never see your full card number and we store it nowhere.
• Passwords. Customer account passwords are managed by the platform and are never stored in plain text. We have no access to them and will never ask you for them.
• Restricted access. The store's administration is accessible only to those who need it, by means of named accounts.
  Selected providers. Our service providers are bound by contract as to the security and confidentiality of the data they process for us.

We never need your payment data by e-mail or by chat: do not send it to us through these channels, and be wary of any message that asks you for it in our name.

In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you, in accordance with Article 34 of the GDPR, and we will inform the CNIL under the conditions of Article 33.

10.2 Transfers outside the European Union

Some of our service providers process data outside the European Economic Area, mainly in the United States. These transfers are not left to chance: each of them rests on at least one of the mechanisms provided for by Chapter V of the GDPR, depending on the recipient concerned.

• The standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914, adopted on the basis of Article 46(2)(c) of the GDPR), which contractually require the recipient to ensure a level of protection equivalent to that of European law. This is the mechanism we favour, because it does not depend on the fate of an adequacy decision.
• An adequacy decision of the European Commission (Article 45 of the GDPR), which recognises that a country, or the framework to which the recipient adheres, offers an adequate level of protection. Several of our providers rely on this, most often in addition to the standard contractual clauses.
• For the United Kingdom and Switzerland, the equivalent mechanisms recognised by the authorities of those countries.

You can obtain a copy of the safeguards put in place, as provided for by Article 13(1)(f) of the GDPR. Write to us at help@olfazeta.fr specifying the category of providers concerned: we will tell you the applicable mechanism and send you the corresponding clauses, redacted only of the confidential commercial information that our contracts prohibit us from disclosing.

11. Contacting us and entry into force

For any question about this policy, about the use we make of your data or to exercise your rights:

• E-mail: help@olfazeta.fr
• Post: Aroma Logistics Co, 231 rue Saint-Honoré, 75001 Paris, France

The controller of your personal data is Aroma Logistics Co, trade name of a sole proprietorship registered under number SIREN 102 212 289, whose registered office is located at 231 rue Saint-Honoré, 75001 Paris, France. Its full identification appears in our legal notice.

We will update this policy as our practices, our tools or the regulations evolve — in particular at the time of deployment of the tools described in section 7. The version in force is always the one published on this page, with its date of last update. If we were to use your data for a new purpose not provided for by this policy, we would inform you beforehand, by a visible means: a banner on the site or an e-mail. This is what Article 13(3) of the GDPR requires. Where processing rests on your consent, a new consent will be requested from you.

Last updated: 23 August 2026.