Privacy Policy
Privacy policy
This policy explains what we do with your personal data. It is written to comply with the General Data Protection Regulation (EU) 2016/679 and the Data Protection Act 2018.
Who is the controller
DEX EMPIRE LIMITED, trading as The Scents, Oldtown Demesne, Naas, Co. Kildare, Ireland. Data protection queries go to info@thescents.co.za.
What we collect, why, and on what basis
| Data | Purpose | Lawful basis (Article 6) |
|---|---|---|
| Name, delivery and billing address, email, telephone | To take, fulfil and deliver your order | 6(1)(b) performance of a contract |
| Order and payment history | Returns, cancellations, statutory guarantees, accounting | 6(1)(b) contract and 6(1)(c) legal obligation |
| Wholesale account details, including business registration and VAT number | To assess and operate a wholesale account | 6(1)(b) contract and 6(1)(f) legitimate interests |
| Email address, if you ask for offers | Marketing you asked for | 6(1)(a) consent, withdrawable at any time |
| IP address, browser, pages viewed | Keeping the site working and secure | 6(1)(f) legitimate interests in site security |
What we never do
We do not sell your personal data. We do not rent it, trade it, or pass it to anyone for their own marketing. We do not carry out profiling or automated decision-making that produces legal effects for you.
Payment details
We never see or store your card number. Card payments are handled entirely by our payment provider on their own systems. We receive only confirmation of success or failure, and the last digits of the card for reconciliation.
Recipients
Only those who need the data to complete your order: our carrier, our payment provider, and our accountants and auditors where law requires records. Each acts as a processor under a written contract and may use the data only on our instructions.
Transfers outside the EEA
The Scents operates storefronts in South Africa and Nigeria as well as Ireland, and some service providers are outside the EEA. Where personal data is transferred out of the EEA we rely on the safeguards in Chapter V of the GDPR, in practice the European Commission’s Standard Contractual Clauses, together with an assessment of the destination country. You can ask us for a copy of the safeguards used.
How long we keep it
Order records are kept for six years from the end of the tax year they fall in, because Revenue and company law require it and because statutory guarantee claims can run that long. Marketing consents are kept until withdrawn. Wholesale account records are kept while the account is open and for six years after it closes. Web and security logs are kept for 12 months.
Your rights
You have the right of access (Article 15), rectification (16), erasure (17), restriction (18), data portability (20) and objection (21), and the right to withdraw consent at any time without affecting processing already carried out. Write to info@thescents.co.za. We respond within one month and there is no charge.
If you are not satisfied, you may lodge a complaint with the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963 (dataprotection.ie).
Cookies
We use cookies that are strictly necessary for the site to function: keeping you signed in, remembering your cart, and holding your currency and market choice. Under the ePrivacy Regulations these do not require consent. We do not set advertising or cross-site tracking cookies. The site also stores, in your own browser rather than on our servers, whether you have dismissed the market suggestion bar or the welcome message.
Security
The site is served over HTTPS. Access to customer records is limited to staff who need it, and the platform is kept patched and monitored. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours and tell you where the risk is high, as Articles 33 and 34 require.