Privacy Policy & Advertising Telemetry Disclosures

Live Advertising Platforms & Click Identifiers

aromatek.click receives direct paid traffic from three verified commercial ad platforms: Google Ads, Microsoft Advertising, and Meta Ads. When a prospective buyer arrives at our website via a paid sponsored advertisement, shopping listing, or campaign placement, the originating ad network appends a unique cryptographic query string to the destination URL:

• Google Ads: Appends the gclid (Google Click Identifier) token to measure click provenance and keyword attribution.
• Microsoft Advertising: Appends the msclkid (Microsoft Click Identifier) token to trace Bing search campaign performance and product ad reach.
• Meta Ads: Appends the fbclid (Facebook Click Identifier) token when traffic arrives from Facebook or Instagram business placements.

These tokens allow ad platforms to verify that an incoming visitor engaged with a legitimate, paid advertisement. We do not sell these identifiers. We never claim or imply that any advertising network has reviewed, certified, or endorsed Aromatek.

Consent Mode v2 Operational Mechanics

In compliance with modern European and platform-mandated data governance standards, aromatek.click implements Consent Mode v2. When any visitor first arrives at our domain, the browser initializes all advertising and measurement primitives to a strict denied state:

• ad_storage='denied': Prevents reading or writing of cookies for advertising purposes.
• ad_user_data='denied': Forbids transmitting visitor telemetry to Google, Microsoft, or Meta for marketing profile enrichment.
• ad_personalization='denied': Prohibits retargeting, remarketing, or personalized audience indexing.
• analytics_storage='denied': Suspends non-essential tracking cookies and analytical aggregation until affirmative authorization.

These four consent signals remain strictly held as denied until the visitor explicitly clicks “Allow Storage” on our docked consent banner. If the visitor clicks “Deny Optional” or re-opens preferences to withdraw permission, all four signals immediately revert to denied. Under denied states, our analytics tags transmit only stateless, non-identifying telemetry pings without setting persistent cookies or tracking across sessions.

Global Privacy Control (GPC)

Our frontend scripts and server-side intake scripts actively evaluate the HTTP header Sec-GPC (Global Privacy Control). If your browser or privacy extension broadcasts an active Global Privacy Control signal, we recognize it immediately as a binding legal opt-out under California and state privacy laws. In this state, the docked consent banner suppresses optional marketing requests, advertising pixels remain disabled, and all Consent Mode v2 signals remain fixed at denied without requiring manual interaction.

Third-Party Processors & Service Providers

We share inquiry and diagnostic information exclusively with contracted third-party processors who provide operational infrastructure for our Tampa catalog:

Categories of Personal Data Collected

Because aromatek.click has no payment processing, cart checkout, or user account creation, we collect only the minimal data required to respond to space deodorizing inquiries:

• Inquiry Form Submissions (submit.php): Name, phone, email, address, the kind of enquiry, the message, the requested specification, the consent tick.
• Automated Transmission Metadata: Incoming IP address, browser user-agent string, HTTP referring URL, moment the form was rendered and moment it was sent.
• Support Chat Logs (chat.php): Message body transcripts of the conversation and a session token stored in the visitor's browser localStorage so they can return to it.
• Consent Registry: The visitor’s choice stored in the browser under site_consent_v2, and nothing else on this site persists a choice.
• Advertising Click Identifiers: Technical click parameters attached to incoming links by advertising platforms (gclid, msclkid, fbclid).
• Server Diagnostics: Standard web server and access logs recording request method, requested URI, response status code, and bytes transferred.

Purposes of Data Processing

We process these categories strictly for direct commercial fulfillment:

1. Calculating accurate freight and batch fulfillment quotes based on physical room square footage, ventilation volume, and item format.
2. Dispatching formal commercial invoices and courier tracking links via telephone or email from our Tampa dispatch desk.
3. Preventing fraudulent automated submissions via hidden server-side honeypots (department and site).
4. Monitoring web server security, latency, and firewall access integrity.
5. Measuring paid ad performance in accordance with active Consent Mode v2 permissions.

Legal Bases for Processing

Under GDPR and applicable international frameworks, our processing relies on the following legal bases:

• Contractual Preparation (Art. 6(1)(b) GDPR): Processing catalog inquiry details, item specs, and delivery addresses to prepare a non-binding price estimate and dispatch schedule requested by the visitor.
• Consent (Art. 6(1)(a) GDPR): Operating optional analytics and marketing telemetry (Google Ads, Microsoft Advertising, Meta Ads) governed by Consent Mode v2.
• Legitimate Interests (Art. 6(1)(f) GDPR): Maintaining server infrastructure security, preventing automated bot abuse, and protecting our communications against unauthorized penetration.
• Legal Obligation (Art. 6(1)(c) GDPR): Retaining tax, transaction, and commercial dispatch records required under Florida and federal United States trade statutes.

Strict Data Retention Schedules

We do not keep data “as long as necessary.” Aromatek enforces hard calendar retention limits:

Technical & Physical Security Controls

Aromatek enforces transport layer security (TLS 1.3 encryption) across all web traffic. Inquiry forms transmit through authenticated endpoints utilizing honeypot verification and server-side input sanitization. Administrative workstations at our 42 Aegean Avenue workshop utilize full-disk encryption, hardware multi-factor authentication, and strict role-based access. No plain-text credit card data is ever received, processed, or held on our hardware.

Cross-Border Data Transfers

Aromatek is located in Tampa, Florida, within the United States. When international visitors access our website or transmit inquiries, their data is transferred directly to and processed on secure web servers located inside the United States. Where personal data of European Economic Area or UK residents is transferred to United States entities, such transfers are conducted pursuant to standard contractual clauses (SCCs) approved by the European Commission, or pursuant to international data privacy framework adequacy decisions governing US service providers.

United States State Privacy Rights (CCPA / CPRA & State Laws)

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA / CPRA), as well as consumer data privacy statutes in Virginia, Colorado, Connecticut, Utah, and Texas, consumers have explicit rights regarding their personal information:

• Right to Know: You may request disclosure of the specific categories of personal information we have collected, the sources of collection, and the commercial business purpose.
• Right to Delete: You have the right to request deletion of personal information collected through our inquiry desk, subject to standard commercial tax and invoice retention exceptions.
• Right to Correct: You may request correction of inaccurate business or contact records held in our dispatch ledger.
• Right to Opt-Out of Sale or Sharing: Aromatek does not sell personal information for financial compensation. We do not exchange customer lists with brokers. To the extent that cross-context behavioural advertising tokens (via Google Ads or Meta Ads) are defined as “sharing” under CCPA, you may opt out instantly by activating Global Privacy Control or declining optional storage in our cookie banner.
• Non-Discrimination: We do not alter catalog pricing, reject trade quotes, or deny dispatch service to any customer exercising their privacy rights under US state law.

European Union & UK Rights (GDPR)

For visitors accessing our catalog from the European Economic Area or the United Kingdom, our processing conforms to the General Data Protection Regulation (GDPR). You hold the following enforceable rights:

1. Right of Access (Art. 15 GDPR): Confirmation as to whether personal data concerning you is processed, and a copy of the specific data.
2. Right to Rectification (Art. 16 GDPR): Prompt correction of inaccurate or incomplete contact or facility records.
3. Right to Erasure (‘Right to be Forgotten’, Art. 17 GDPR): Erasure of your inquiry submissions when data is no longer necessary for quote preparation.
4. Right to Restriction of Processing (Art. 18 GDPR): Restricting the processing of your data during pending verification disputes.
5. Right to Data Portability (Art. 20 GDPR): Receiving your inquiry records in a structured, commonly used, and machine-readable format.
6. Right to Object (Art. 21 GDPR): Objecting at any time to processing based on legitimate interests.
7. Right to Withdraw Consent (Art. 7(3) GDPR): Withdrawing consent previously granted for advertising or analytical telemetry at any moment via our docked cookie banner controls.

Regulatory Complaints & Supervisory Authorities

If you believe Aromatek has processed your personal information in violation of applicable data protection statutes, you maintain the statutory right to lodge a formal complaint with an appropriate supervisory authority:

• In the United States: You may contact the Florida Attorney General (Office of the Attorney General, State of Florida, The Capitol PL-01, Tallahassee, FL 32399), or your state Consumer Protection Division. California residents may file complaints with the California Privacy Protection Agency (CPPA) at cppa.ca.gov.
• In the European Union: You may lodge a complaint with your national Data Protection Authority (DPA) in the member state of your habitual residence or place of work.
• In the United Kingdom: You may lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

Data Access Request Protocol

To exercise your rights of access, correction, portability, or deletion under CCPA or GDPR, submit your request directly to our Tampa compliance desk:

Accessibility Statement (WCAG 2.1 AA)

Aromatek maintains digital accessibility for all visitors. This website is constructed in conformance with Web Content Accessibility Guidelines (WCAG) 2.1 at Level AA:

• Keyboard Operability: All navigational items, interactive forms, and tab controls are fully navigable via standard Tab, Shift+Tab, Enter, and Arrow keystrokes.
• Visual Contrast: High-contrast typography utilizing our Brick Oxide palette keeps text elements above the required 4.5:1 contrast threshold against all background grounds.
• Reduced Motion Compliance: The layout honors the prefers-reduced-motion operating system setting, freezing 3D canvas viewport rotations and SVG line diagram drawing animations.
• Assistive Technology: Semantic HTML5 structural elements, ARIA landmarks, clear labels, and explicit alt attributes support screen reading software.

If you encounter an accessibility barrier or require assistance placing a catalog order, please contact our dispatch team at +1 (464) 785-0613 or email office@aromatek.click.

Policy Revisions & Notices

Aromatek reserves the right to amend this Privacy Policy to reflect modifications in statutory legislation, platform advertising rules (such as updates from Google Ads, Microsoft Advertising, or Meta Ads), or internal dispatch procedures. When changes occur, the updated policy is published at this URL with a revised effective date. If an amendment fundamentally alters how previously collected catalog inquiry data is handled, we provide prominent notice on our homepage or contact active commercial account holders directly before implementation.

Direct Human Contact

For any questions, clarifications, or technical concerns regarding our privacy practices or advertising disclosures, reach our human operators directly: