Privacy Policy – Aromatic Buds Malta

Last updated: 17 October 2026

At Aromatic Buds, we value your privacy and are committed to protecting the personal information you share with us.

This Privacy Policy explains how Aromatic Buds collects, uses, stores, protects and shares personal data when you visit www.aromaticbuds.com, browse our products, place an order, contact our team or use our online services.

As a Malta-based e-commerce business, we aim to handle personal information responsibly and transparently, in accordance with the EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, the Malta Data Protection Act (Chapter 586) and other applicable privacy and electronic communications legislation.

Our commitment is straightforward: to collect only the personal information we reasonably need, use it for legitimate and clearly explained purposes, and respect your rights over your information.

1. Who We Are – Data Controller

Aromatic Buds operates the website https://www.aromaticbuds.com, an online retail platform serving customers in Malta.

For the purposes of applicable data protection legislation, the business operating Aromatic Buds acts as the Data Controller for personal information processed in connection with its own website, customer relationships and business operations.

Business details:

• Trading name: Aromatic Buds

• Legal business name / Data Controller: Aromatic Buds

• Business location: Malta

• Registered business address: E-Commerce

• Website: https://www.aromaticbuds.com

• Privacy enquiries: info@aromaticbuds.com

The Data Controller determines why and how personal information is processed.

If you have any questions about this Privacy Policy, your personal information or your rights under GDPR, you may contact us using the details above.

2. Personal Information We Collect

Depending on how you interact with Aromatic Buds, we may collect the following categories of personal information.

2.1 Information You Provide Directly

When placing an order, contacting customer support or otherwise interacting with our website, you may provide:

• Full name

• Email address

• Telephone or mobile number

• Billing address, where applicable

• Delivery address and delivery instructions

• Products ordered, quantities and order preferences

• Customer service messages, enquiries and correspondence

• Information provided when requesting a return, refund or cancellation

• Other information you voluntarily provide when communicating with us

We request only information that is reasonably necessary to provide our services or fulfil an appropriate business purpose.

2.2 Order and Transaction Information

When you place an order through Aromatic Buds, we may process information including:

• Order number and date

• Products purchased and quantities

• Purchase value and applicable charges

• Selected delivery arrangements

• Order confirmation and fulfilment status

• Payment method and payment status

• Delivery confirmation

• Related customer service and refund records

Cash on Delivery (COD) may be available for purchases placed through our website.

For cash-on-delivery transactions, we do not need customers to provide their credit or debit card details through our website.

Where other payment methods are made available, the applicable payment provider may process additional information according to its own privacy notice.

2.3 Information Collected Automatically

When you access our website, certain technical information may be collected through website infrastructure, server logs, cookies and other technologies.

Depending on the services enabled, this may include:

• Internet Protocol (IP) address

• Browser type and version

• Device type and operating system

• Pages visited and browsing interactions

• Date and time of website access

• Referring websites or search engines

• Technical errors and website performance information

• Cookie identifiers and consent preferences

• Approximate geographic location derived from technical information

This information helps us operate and secure our website, understand its performance and improve the browsing experience.

Where information can identify or be associated with an individual, we treat it as personal data under applicable law.

3. How and Why We Use Your Information

Aromatic Buds processes personal information only where we have an appropriate legal basis under Article 6 of the GDPR.

We do not rely on consent where another lawful basis is more appropriate, such as processing information necessary to fulfil an order or comply with a legal obligation.

4. Order Processing and Deliveries in Malta

Aromatic Buds uses customer information to manage purchases and coordinate delivery services.

When you place an order, we may use your name, telephone number, delivery address, order reference and delivery instructions to prepare and deliver your purchase.

Where necessary, relevant delivery information may be shared with our appointed courier or delivery service providers.

The information shared is limited to what is reasonably necessary to:

• Identify the correct delivery destination

• Contact the recipient when necessary

• Coordinate collection and delivery

• Resolve delivery difficulties

• Confirm successful delivery

• Handle delivery-related enquiries or disputes

Courier and delivery partners may process personal information under their own applicable privacy obligations and, where relevant, contractual data protection arrangements.

We do not share customer information with delivery partners for unrelated marketing purposes merely because they are delivering an order.

5. Customer Communication and WhatsApp

Customers may contact Aromatic Buds through our website, email, telephone, WhatsApp or other available communication channels.

When you communicate with us, we may process your contact information, messages and relevant order details to respond to enquiries, provide support and manage customer relationships.

Where customers choose to communicate through WhatsApp, certain information may also be processed by WhatsApp and its service providers in accordance with their own privacy terms.

We may retain relevant communications where reasonably necessary for customer support, dispute resolution, fraud prevention or record-keeping obligations.

We do not treat a customer service enquiry or the submission of an order as automatic consent to receive promotional messages.

Marketing messages, where offered, are handled separately in accordance with applicable consent and electronic marketing requirements.

6. Age Verification and Responsible Access

Certain product categories offered through Aromatic Buds may be subject to minimum-age requirements or additional legal restrictions.

To support responsible access and applicable legal obligations, we may implement age-confirmation or age-verification procedures.

Depending on the circumstances and relevant legal requirements, these procedures may involve:

• Asking visitors to confirm that they satisfy the applicable age requirement

• Requesting age confirmation during ordering

• Verifying age or identity when legally required

• Requesting proof of age at the point of delivery

• Restricting or refusing transactions where the required verification cannot be completed

Where identity verification is necessary, we aim to use the least intrusive method reasonably available.

We do not routinely require or retain copies of identity documents solely because a visitor accesses our website.

If additional identity information must be processed, we will limit its collection, access and retention to what is necessary for the applicable purpose.

An age-confirmation preference stored on a visitor's device does not automatically establish the person's identity or replace any legally required age verification.

7. Cookies

Like most websites, our Site uses a variety of cookies to collect information about visitors to the Site. You can read more about how we use cookies and how to consent or object to their use in our Cookies Policy.

8. Website Analytics and Search Performance

Aromatic Buds may use website performance and analytics services to understand how visitors discover and interact with our website.

These services may include tools provided by Google or other technology partners, where configured.

For example:

• Google Search Console may help us understand website visibility, search performance, indexing and technical issues.

• Google Analytics, if enabled, may provide information about website usage and visitor interactions, subject to applicable consent requirements.

• Website hosting and security providers may generate technical logs required to operate and protect the website.

Search-performance information does not necessarily identify individual visitors.

Where an analytics service processes personal data, we apply the relevant GDPR requirements, including appropriate contractual safeguards and cookie consent where necessary.

We use website performance information to improve accessibility, speed, navigation, product discovery and the overall online shopping experience.

9. Marketing Communications

Where Aromatic Buds offers newsletters, promotional updates or other direct marketing communications, we process personal information in accordance with applicable marketing and privacy laws.

We may contact you with promotional messages where you have provided valid consent or where another specific legal permission applies.

Customers may withdraw marketing consent or object to direct marketing at any time.

Marketing preferences can be changed by following an unsubscribe mechanism, where provided, or by contacting us directly.

We distinguish essential transactional communications, such as order confirmations and delivery updates, from promotional marketing.

We do not sell customer contact lists or personal information to third-party advertisers.

10. Sharing Personal Information with Third Parties

Aromatic Buds may share relevant personal information with trusted third parties when necessary to operate our business, fulfil orders or comply with the law.

Website Hosting and Technology Providers

Providers that host, maintain, secure or support our e-commerce website, including Hostinger and relevant technical service providers.

Delivery and Logistics Providers

Courier companies and delivery partners responsible for transporting orders to customers.

Communication Service Providers

Email, telephone, messaging and customer support platforms used to communicate with customers.

Professional Service Providers

Accountants, legal advisers, IT support providers and other professionals where access to information is reasonably necessary for their services.

Public Authorities

Tax authorities, regulators, courts, law enforcement or other competent bodies when disclosure is required or authorised by applicable law.

Where third parties act as processors on our behalf, we take appropriate steps to ensure relevant data protection obligations and contractual safeguards are in place.

Some third parties may act as independent data controllers and have their own privacy notices.

We do not disclose customer personal information to unrelated third parties for their independent marketing purposes without an appropriate lawful basis.

11. Third-Party Ordering Platforms

Aromatic Buds products may also be available through independent third-party ordering and delivery platforms, including Wolt and Bolt Food.

These platforms may collect and process personal information under their own privacy policies when customers place orders directly through their services.

Where relevant order information is passed to Aromatic Buds, we process it for legitimate fulfilment, customer support, business accounting and other applicable purposes.

The privacy practices of independent ordering platforms are not necessarily governed by this Privacy Policy.

Customers should consult the privacy notices of those platforms to understand how their information is collected and used.

12. Data Security

We take the protection of customer information seriously.

Aromatic Buds aims to implement reasonable technical and organizational security measures appropriate to the nature of the data and the risks involved.

These may include:

• Encrypted HTTPS connections for website communications

• Restricted access to customer information

• Secure authentication for administrative services

• Appropriate access controls for order management

• Security monitoring and software maintenance

• Limited sharing of personal information with service providers

• Measures to prevent unauthorised access, misuse, loss or disclosure

Access to customer information should be limited to authorised personnel and service providers who require it for legitimate business purposes.

Although reasonable security measures can reduce risk, no internet-based system can guarantee absolute security.

If a personal data breach occurs, we will assess and manage it in accordance with applicable GDPR requirements, including notification to the competent authority and affected individuals where legally required.

13. How Long We Keep Personal Information

Aromatic Buds retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including applicable legal, accounting, tax and regulatory requirements.

Different categories of information may have different retention periods.

For example:

• Order and transaction records: retained for the period required by applicable Maltese accounting, tax and other record-keeping laws.

• Customer support communications: retained for as long as necessary to resolve enquiries, manage disputes or meet relevant legal obligations.

• Delivery information: retained for the time reasonably required to complete deliveries and handle delivery-related matters.

• Marketing preferences: retained until consent is withdrawn or the relevant information is no longer necessary, subject to maintaining suppression records where appropriate.

• Technical logs: retained for a limited period based on operational and security requirements.

• Age-verification records: retained only to the extent necessary for the relevant verification purpose or legal obligation.

Where a specific retention period cannot be stated, we determine it based on the purpose of processing, applicable statutory requirements, potential legal claims and the principle of data minimization.

When information is no longer required, we take appropriate steps to delete, anonymize or otherwise securely dispose of it.

14. International Data Transfers

Although Aromatic Buds is based in Malta, some service providers may process or store personal information in other countries.

Where personal data is transferred outside the European Economic Area (EEA), we take steps to ensure that appropriate protection measures apply.

Depending on the destination and circumstances, these may include:

• An adequacy decision issued by the European Commission

• Approved Standard Contractual Clauses

• Other transfer mechanisms or safeguards recognized under applicable GDPR requirements

Where required, we assess whether supplementary safeguards are necessary to provide an appropriate level of protection.

Further information about applicable international transfers and safeguards may be requested using our contact details.

15. Your Rights Under GDPR

Individuals whose personal information is processed by Aromatic Buds have rights under the GDPR, subject to applicable conditions and exceptions.

These include:

Right of Access

You may request confirmation of whether we process your personal data and obtain access to information about that processing.

Right to Rectification

You may request correction of inaccurate personal information or completion of incomplete information.

Right to Erasure

You may request the deletion of personal information in circumstances provided for under the GDPR.

This right is not absolute. Certain information may need to be retained to comply with legal obligations or establish, exercise or defend legal claims.

Right to Restrict Processing

You may request that we restrict the processing of your personal information in certain circumstances.

Right to Data Portability

Where applicable, you may request personal information in a structured, commonly used, machine-readable format or request its transfer to another controller.

Right to Object

You may object to processing based on legitimate interests in accordance with the GDPR.

You have the right to object to the processing of your personal information for direct marketing at any time.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Rights Concerning Automated Decision-Making

You have rights relating to decisions based solely on automated processing, including profiling, where such decisions produce legal or similarly significant effects, subject to applicable GDPR provisions.

Exercising Your Rights

To exercise your data protection rights, please contact:

Aromatic Buds – Privacy Enquiries

Email: info@aromaticbuds.com

Website: https://www.aromaticbuds.com

We may request reasonable additional information where necessary to confirm your identity before fulfilling a request.

We aim to respond without undue delay and normally within one month, as required by the GDPR.

Where legally permitted, this period may be extended for complex or multiple requests, and we will inform you of the extension and the reasons for it.

Requests are generally handled free of charge, subject to the exceptions permitted by GDPR.

16. Complaints to the Maltese Data Protection Authority

If you believe your personal information has been processed unlawfully or that your data protection rights have been infringed, you may contact us to raise your concerns.

You also have the right to lodge a complaint with the Maltese supervisory authority:

Office of the Information and Data Protection Commissioner (IDPC)

Floor 2, Airways House
High Street
Sliema, SLM 1549
Malta

Website: https://idpc.org.mt

You may also have the right to lodge a complaint with another competent EU or EEA supervisory authority in accordance with the GDPR.

17. Children's Privacy

Aromatic Buds offers certain products that are subject to age-related restrictions.

We do not knowingly solicit personal information from children for the purpose of selling age-restricted products.

Our website may use age-confirmation controls and other appropriate measures to restrict access to relevant products or services.

If we become aware that personal information has been collected from a child in circumstances that do not have an appropriate legal basis, we will take suitable steps to address the issue, which may include deleting the information.

Parents or legal guardians who have concerns regarding information provided by a minor may contact us through our official communication channels.

18. Automated Processing and Profiling

Aromatic Buds may use automated technologies for routine website functions, order management, security monitoring, analytics and operational efficiency.

Where such processing involves personal data, it is subject to applicable data protection requirements.

Any use of automated decision-making or profiling that produces legal or similarly significant effects will be assessed against the requirements of Article 22 of the GDPR and accompanied by any necessary safeguards.

We will provide additional information where required by law.

19. Third-Party Websites and External Links

Our website may contain links to external websites, social media platforms, delivery services and other independent third-party services.

These websites may operate under privacy policies that differ from ours.

Once you leave www.aromaticbuds.com or access an independent third-party service, the collection and processing of your information may be governed by that provider's own privacy practices.

We encourage visitors to review the relevant privacy policies before submitting personal information.

20. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our services, data-processing activities, website technologies or applicable legal requirements.

The latest version will be published on this page with an updated revision date.

Where changes materially affect how personal data is processed, we will provide additional notice or obtain consent where required by law.

We encourage visitors and customers to review this page occasionally to stay informed about how we protect personal information.

21. Contact Us About Your Privacy

Your trust is important to us.

If you have any questions about this Privacy Policy, how your personal information is handled, or how to exercise your rights under GDPR, we welcome you to contact our team.

Aromatic Buds Malta

Website: https://www.aromaticbuds.com
Email: info@aromaticbuds.com
Legal Data Controller: Aromatic Buds
Business Address: Malta

We aim to handle all legitimate privacy enquiries professionally, confidentially and in accordance with applicable data protection legislation.

Aromatic Buds – Respecting Your Privacy. Protecting Your Information.

This Privacy Policy applies to personal data processed by Aromatic Buds in connection with its website, customer services, order fulfilment and related business operations, except where a separate privacy notice applies.