Privacy Policy

Last updated: 3 October 2026

1. Who we are

Box of Scents OÜ (registry code 17511940, address Tammepargi tee 2, Sõrve küla, 76908 Harku vald, Harju maakond, e-mail info@boxofscents.ee) is the controller of the personal data processed through the website boxofscents.ee (the “Website”). In this Privacy Policy “we”, “us” and “our” mean Box of Scents OÜ.

This Privacy Policy explains what personal data we collect when you visit the Website or sign up to our newsletter, why we collect it, how long we keep it and what rights you have. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Personal Data Protection Act of the Republic of Estonia and other applicable law.

2. What this policy covers

The Website currently provides information about Box of Scents and lets you subscribe to our newsletter. You cannot buy anything on the Website. If we add new features in the future, we will update this Privacy Policy before they start.

3. What personal data we process and why

3.1 Newsletter

  • Purpose: sending you news, updates and educational content from Box of Scents.
  • Personal data: e-mail address, first name, the date and time of sign-up, the IP address you used to sign up (and the approximate location derived from it), the form used to sign up, your consent record, and how you interact with our e-mails (for example opens and clicks).
  • Legal basis: your consent, Article 6(1)(a) GDPR.
  • Retention: until you unsubscribe. After that we keep only your e-mail address on a suppression list, so we do not e-mail you again, on the basis of our legitimate interest, Article 6(1)(f) GDPR.

3.2 Website analytics

  • Purpose: understanding how visitors use the Website so we can improve it.
  • Personal data: online identifiers (cookie IDs), pages viewed, time spent, device and browser type, approximate location, referring website.
  • Legal basis: your consent, Article 6(1)(a) GDPR.
  • Retention: in line with our Google Analytics retention setting.

3.3 Advertising and measurement (Meta Pixel)

  • Purpose: measuring how well our Facebook and Instagram ads work and showing our ads to people who may be interested.
  • Personal data: online identifiers (cookie IDs), pages viewed, actions on the Website, device and browser type, IP address.
  • Legal basis: your consent, Article 6(1)(a) GDPR.
  • Retention: the Meta cookie lasts 3 months. Data held by Meta is kept under Meta’s own policies.
  • For collecting this data and sending it to Meta we act as joint controllers with Meta Platforms Ireland Limited. Meta is responsible for what it does with the data afterwards.

3.4 Answering your messages

  • Purpose: replying when you contact us.
  • Personal data: your name, e-mail address and the content of your message.
  • Legal basis: our legitimate interest in replying to you, Article 6(1)(f) GDPR.
  • Retention: as long as needed to handle your request, normally no more than 2 years.

3.5 Security and operation of the Website

  • Purpose: keeping the Website secure and working.
  • Personal data: IP address, technical log data.
  • Legal basis: our legitimate interest, Article 6(1)(f) GDPR.
  • Retention: for as long as our hosting provider keeps server logs, which is no longer than needed for security and technical purposes.

We do not use your personal data for automated decision-making or profiling that has legal or similarly significant effects on you.

4. Newsletter

When you sign up through the form on our Website, you give us your e-mail address and first name and agree that we may send you e-mails about Box of Scents. This may include news, announcements and educational content.

  • Signing up is voluntary. You can use the Website without subscribing.
  • You are subscribed as soon as you submit the form. We do not send a separate confirmation e-mail. Instead, we send you a welcome e-mail right after you sign up.
  • The sign-up form is provided by Klaviyo and only works if you have accepted marketing cookies on the Website. If you have not, we will ask you to accept them before the form opens.
  • You can unsubscribe at any time using the link at the bottom of every e-mail, or by writing to info@boxofscents.ee. Withdrawing your consent does not affect the lawfulness of the processing before the withdrawal.
  • Our e-mails are sent through Klaviyo, which also records whether you open or click our e-mails so we can see what content is useful. If you accept the relevant cookies (see our Cookie Policy below), Klaviyo may also link your activity on the Website to your subscriber profile.
  • We record when and how you signed up as proof of your consent.

5. Who we share data with

We share personal data only with service providers that process it on our behalf and under our instructions, and with Meta as described in 3.3:

  • Klaviyo, Inc.: e-mail marketing and subscriber management;
  • Google Ireland Limited / Google LLC: Google Analytics;
  • Meta Platforms Ireland Limited: Meta Pixel for Facebook and Instagram ads (see 3.3);
  • Zone Media OÜ (zone.ee): hosting of the Website.

Our cookie banner is provided by the WordPress plugin GDPR Cookie Compliance (Moove Agency). It stores your cookie choices in your own browser and runs on our Website, so your choices are not sent to a separate service.

We may also disclose personal data to public authorities where the law requires it. We do not sell your personal data.

6. Transfers outside the EU/EEA

Some of our providers, including Klaviyo, Google and Meta, may process data outside the EU/EEA, for example in the United States. In that case we rely on appropriate safeguards such as the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

7. Security

We apply organisational and technical measures to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure and other unlawful processing. Access to personal data is limited to people and providers who need it.

8. Your rights

You have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected or incomplete data completed;
  • have your data erased;
  • restrict the processing of your data;
  • receive your data in a structured, commonly used format (data portability);
  • object to processing based on our legitimate interest;
  • withdraw your consent at any time, where processing is based on consent.

To use these rights, write to info@boxofscents.ee. We will answer within one month.

If you think we are processing your data unlawfully, you can lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee. You may also contact the supervisory authority in your own country.

9. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always available on the Website with its date at the top. If the changes are significant, we will let you know in a suitable way.

Cookie Policy

Last updated: 3 October 2026

1. What are cookies

Cookies are small text files that a website stores on your device when you visit it. They help the website work, remember your choices and show the owner how the website is used. Similar technologies, such as pixels and local storage, work in the same way and are covered by this policy.

2. How we use cookies and your choices

  • Strictly necessary cookies are needed for the Website to work and to remember your cookie choices. They do not need your consent.
  • Analytics cookies help us understand how visitors use the Website.
  • Marketing cookies link your activity on the Website to your newsletter subscriber profile, if you have one, and help us measure and show our Facebook and Instagram ads.

When you first visit the Website, a cookie banner asks for your choice. Analytics and marketing cookies are only set after you accept them. You can accept all cookies, or open the cookie settings and choose by category. Strictly necessary cookies are always on, and the Website works the same way without the other categories. The only exception is the newsletter sign-up form: it is provided by Klaviyo, which needs marketing cookies, so the form opens only after you have accepted them.

You can change or withdraw your choice at any time by deleting the cookies of this Website in your browser settings. The cookie banner will then ask for your choice again. You can also block cookies in your browser settings, but some parts of the Website may then not work properly.

3. Cookies used on the Website

Necessary

  • Saves your cookie choices. Duration: 12 months.

Analytics

  • Google Analytics: counts visits and shows how the website is used. Duration: 2 years.

Marketing

  • Klaviyo: makes the newsletter form work and links your visit to your subscriber profile. Duration: 2 years.
  • Meta: helps us measure and improve our Facebook and Instagram ads. Duration: 3 months.

4. Third-party cookies

Analytics, e-mail and advertising cookies come from Google, Klaviyo and Meta. They process data under their own privacy policies:

See section 6 of the Privacy Policy for information about transfers outside the EU/EEA.

5. Questions

If you have questions about cookies or this policy, write to info@boxofscents.ee.

Powered by  GDPR Cookie Compliance (opens in a new tab)

Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.