Privacy Policy
Privacy policy
This policy explains what we do with your personal data. It is written to comply with the UK GDPR and the Data Protection Act 2018.
Who is the controller
DEX EMPIRE LIMITED, trading as The Scents, St. Edmund Terrace, London, United Kingdom. Data protection queries go to info@thescents.co.za.
What we collect, why, and on what basis
| Data | Purpose | Lawful basis (Article 6) |
|---|---|---|
| Name, delivery and billing address, email, telephone | To take, fulfil and deliver your order | 6(1)(b) performance of a contract |
| Order and payment history | Returns, cancellations, statutory rights, accounting | 6(1)(b) contract and 6(1)(c) legal obligation |
| Wholesale account details, including company number and VAT number | To assess and operate a wholesale account | 6(1)(b) contract and 6(1)(f) legitimate interests |
| Email address, if you ask for offers | Marketing you asked for | 6(1)(a) consent, withdrawable at any time |
| IP address, browser, pages viewed | Keeping the site working and secure | 6(1)(f) legitimate interests in site security |
What we never do
We do not sell your personal data. We do not rent it, trade it, or pass it to anyone for their own marketing. We do not carry out profiling or automated decision-making that produces legal effects for you.
Payment details
We never see or store your card number. Card payments are handled entirely by our payment provider on their own systems. We receive only confirmation of success or failure, and the last digits of the card for reconciliation.
Recipients
Only those who need the data to complete your order: our carrier, our payment provider, and our accountants and auditors where law requires records. Each acts as a processor under a written contract and may use the data only on our instructions.
Transfers outside the UK
The Scents operates storefronts in South Africa and Nigeria as well as the UK, and some service providers are outside the UK. Where personal data is transferred out we rely on UK adequacy regulations where they exist, and otherwise on the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. You can ask us for a copy of the safeguards used.
How long we keep it
Order records are kept for six years from the end of the tax year they fall in, because HMRC and company law require it and because Consumer Rights Act claims can run that long. Marketing consents are kept until withdrawn. Wholesale account records are kept while the account is open and for six years after it closes. Web and security logs are kept for 12 months.
Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent at any time without affecting processing already carried out. Write to info@thescents.co.za. We respond within one month and there is no charge.
If you are not satisfied, you may complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, on 0303 123 1113 or at ico.org.uk.
Cookies
We use cookies that are strictly necessary for the site to function: keeping you signed in, remembering your cart, and holding your currency and market choice. Under the Privacy and Electronic Communications Regulations these do not require consent. We do not set advertising or cross-site tracking cookies. The site also stores, in your own browser rather than on our servers, whether you have dismissed the market suggestion bar or the welcome message.
Security
The site is served over HTTPS. Access to customer records is limited to staff who need it, and the platform is kept patched and monitored. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and tell you where the risk is high.