This Privacy Policy explains how HASFROS, LDA, through its ScentAI brand, collects, uses, stores and shares personal data when you visit the ScentAI website, create an account, use our fragrance recommendation services, purchase products, contact us or otherwise interact with us.
ScentAI is a brand operated by HASFROS, LDA. This policy is intended for a Portugal-based online store serving customers in the European Union and is designed to reflect the General Data Protection Regulation (EU) 2016/679 (GDPR), applicable Portuguese data-protection law and applicable electronic-communications rules.
1. Who we are
Our website address is: https://scentai.hasfros.com.
ScentAI is a trading name and brand operated by HASFROS, LDA.
For the purposes of the GDPR, the data controller responsible for processing personal data collected through this website is:
Legal name: HASFROS, LDA
Trading name: ScentAI
Registered address: Rua Das Meãs de Cima 229 Meãs do Campo, 3140-164 Montemor-o-Velho Portugal
Tax identification number: PT519234006
Commercial registration: Conservatória do Registo Comercial Coimbra
Email: info@hasfros.com
In this Privacy Policy, “ScentAI”, “we”, “us” and “our” refer to HASFROS, LDA when it operates the ScentAI website, online store and related services.
2. Personal data we collect
Depending on how you use the website, we may collect the following categories of personal data:
- Identity and contact data, such as name, email address, telephone number and delivery or billing address.
- Account data, such as username, password hash, saved preferences and account settings.
- Order and transaction data, such as products purchased, order number, delivery details, invoices, returns and customer-service communications.
- Payment-related information. Payments may be processed by external payment providers. We do not intend to store complete payment-card numbers on our own systems.
- Fragrance preferences and recommendation data, such as favourite notes, preferred scent families, products viewed or selected and answers to a fragrance quiz.
- Technical data, such as IP address, browser type, device information, operating system, language, approximate location derived from IP address, log data and website interactions.
- Marketing preferences, including newsletter subscriptions, communication preferences and records of consent or withdrawal.
- Content you submit, including comments, reviews, contact-form messages, images and other material you choose to provide.
3. How we use your data
We use personal data only for specified and lawful purposes, including:
- To operate, maintain and secure the website.
- To create and manage customer accounts.
- To process orders, payments, delivery, returns, refunds and warranty or legal-guarantee requests.
- To provide customer support and respond to enquiries.
- To provide fragrance recommendations and personalise the website experience.
- To detect fraud, prevent abuse and protect our systems and customers.
- To moderate comments and reviews and detect spam.
- To send service messages, such as order confirmations, delivery updates, account notices and security alerts.
- To send newsletters or promotional communications where permitted and where you have provided the required consent, or where another lawful basis applies.
- To measure website performance and improve products and services, using non-essential analytics only where the required consent has been obtained.
- To comply with tax, accounting, consumer-protection, product-safety, legal and regulatory obligations.
- To establish, exercise or defend legal claims.
4. Legal bases for processing
Depending on the purpose, we rely on one or more of the following legal bases:
- Contract: processing necessary to create or perform a purchase, account or service requested by you.
- Legal obligation: processing required for tax, accounting, consumer, product-safety, fraud-prevention or other legal duties.
- Legitimate interests: processing necessary to operate and secure the website, provide support, prevent fraud, improve services and manage the business, provided that our interests do not override your rights.
- Consent: processing for optional newsletters, non-essential cookies, certain analytics, advertising, profiling or other purposes where consent is required.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Consent must be freely given, specific, informed and based on a clear affirmative action; pre-ticked boxes and silence do not constitute consent.
5. Fragrance recommendations and AI
If you use our fragrance quiz, recommendation tool or other personalisation features, we may process your answers, stated preferences, selected products and interactions to suggest fragrances that may suit you.
Recommendations are intended as product suggestions and do not constitute medical, dermatological or other professional advice. We do not intentionally request health information. Please do not enter information about allergies, medical conditions or other special categories of personal data unless we specifically provide a lawful and appropriate process for doing so.
We will not use solely automated decision-making to make decisions producing legal effects or similarly significant effects on you. If that changes, we will provide the information and safeguards required by applicable data-protection law, including information about the logic involved and available rights where applicable.
6. Comments and reviews
When visitors leave comments or reviews, we collect the information shown in the submission form, together with the visitor’s IP address and browser user-agent string to help detect spam and abuse.
An anonymised string created from your email address, also called a hash, may be provided to the Gravatar service to check whether you use it. The Gravatar service privacy policy is available at https://automattic.com/privacy/. After approval of your comment, your profile picture may be publicly visible in the context of your comment if the relevant Gravatar feature is active.
Do not include personal, confidential, health or payment information in a public comment or review. We may remove content that is unlawful, abusive, misleading, defamatory, discriminatory or unrelated to the product.
7. Media uploads
If you upload images to the website, avoid uploading images containing embedded location data, such as EXIF GPS coordinates. Visitors may be able to download images and extract that information.
Only upload images that you are entitled to share and that do not contain another person’s personal data unless you have an appropriate legal basis and permission.
8. Orders, accounts and payments
When you place an order, we use the information you provide to process the transaction, issue invoices, arrange delivery, manage returns and provide customer support. We may share necessary information with payment processors, delivery companies, fulfilment providers, accountants and other service providers acting on our instructions.
Payment providers may process payment data under their own privacy notices. We do not ask you to send complete card details by email, contact form or chat. Please review the privacy information presented by the payment provider at checkout where applicable.
If you register for an account, you are responsible for keeping your password confidential. We store passwords in a protected form and do not intentionally store passwords in readable plain text.
9. Cookies and similar technologies
Cookies are small files or identifiers stored on your device. We use strictly necessary cookies for functions such as the shopping basket, secure login, checkout, session management, language or cookie-consent preferences. These cookies are used because the website or service cannot operate properly without them.
We may also use optional analytics, personalisation, advertising or social-media cookies. These non-essential technologies will be activated only after the required consent has been obtained. You can reject optional cookies, change your choices or withdraw consent through the “Cookie settings” link available on the website.
If you leave a comment, you may choose to save your name, email address and website in cookies so that you do not need to re-enter them when leaving another comment. These cookies may last for one year.
If you visit our login page, we may set a temporary cookie to determine whether your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.
When you log in, we may set cookies to save your login information and screen-display choices. Login cookies may last for two days, screen-option cookies may last for one year, and a “Remember Me” selection may keep you logged in for up to two weeks. Logging out removes the login cookies.
If you edit or publish an article, an additional cookie may be saved in your browser. It contains no personal data and indicates the post ID of the article edited. It expires after one day.
The exact cookies used by this website depend on the WordPress core, WooCommerce, plugins, theme, payment provider, analytics tools and consent-management platform installed. The live cookie banner and cookie list must be checked and updated whenever these services change.
10. Embedded content from other websites
Articles and pages on this website may include embedded content, such as videos, images, articles, maps, payment interfaces or social-media content. Embedded content from other websites may behave as though you had visited the other website directly.
Those websites may collect data about you, use cookies, embed additional third-party tracking and monitor your interaction with the embedded content, particularly if you have an account and are logged in to that website. Where required, non-essential embedded content will be blocked until you provide consent.
11. Who we share your data with
We share personal data only when necessary for the purposes described in this policy and on an appropriate legal basis. Depending on the services active on the website, recipients may include:
- Website hosting, maintenance, security and technical-support providers.
- WordPress, WooCommerce and relevant plugin or service providers.
- Payment processors and fraud-prevention providers.
- Couriers, fulfilment providers and warehouse or returns providers.
- Email, customer-support and communication providers.
- Accounting, tax, legal, insurance and professional advisers.
- Analytics, advertising or personalisation providers, only where permitted and where the necessary consent has been obtained.
- Public authorities, courts, regulators or law-enforcement bodies where required by law.
HASFROS, LDA may use service providers located in Portugal, other European Economic Area countries or countries outside the European Economic Area. Where personal data is transferred outside the European Economic Area, we will use an adequacy decision or appropriate safeguards required by the GDPR, such as standard contractual clauses, together with any supplementary measures required in the circumstances.
If you request a password reset, your IP address may be included in the reset email or associated security records.
12. How long we retain your data
We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.
- Order, invoice and accounting records are retained for the periods required by Portuguese tax and accounting law.
- Account data is retained while your account remains active, unless deletion is requested and we have no legal reason to retain it.
- Customer-service messages are retained for as long as necessary to handle the request and protect our legal interests.
- Comments and their metadata may be retained while the relevant article or service is available, unless deletion is requested or moderation requires removal.
- Marketing data is retained until you withdraw consent or unsubscribe, subject to records needed to demonstrate compliance.
- Security and technical logs are retained for a limited period appropriate to security, troubleshooting and legal requirements.
- Cookie information is retained for the period stated in the cookie settings or until consent is withdrawn, depending on the cookie.
For registered users, we store the personal information provided in the user profile. Users can view, edit or request deletion of their personal information, except where a username cannot be changed or where data must be retained for administrative, legal, accounting, security or fraud-prevention purposes.
13. Security
We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure and destruction. No internet transmission or storage system can be guaranteed to be completely secure.
If we become aware of a personal-data breach, we will assess it and notify the competent authority and affected individuals where required by the GDPR.
14. Your rights
Subject to applicable legal conditions and exceptions, you may have the right to:
- Request access to the personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Request erasure of your data.
- Request restriction of processing.
- Object to processing based on legitimate interests.
- Object to direct marketing at any time.
- Request portability of data you provided to us where the right applies.
- Withdraw consent at any time where processing is based on consent.
- Request human intervention or challenge a decision where applicable to solely automated decision-making.
You can exercise these rights by contacting us at info@hasfros.com. We may need to verify your identity before responding. We normally respond within one month, subject to the extensions permitted by the GDPR for complex or multiple requests.
You may also lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or with the supervisory authority in the EU country where you live, work or believe an infringement occurred. Information about submitting a complaint to the CNPD is available through the Portuguese public-services portal: https://www2.gov.pt/en/servicos/apresentar-reclamacao/queixa-sobre-a-protecao-de-dados-pessoais.
15. Children
Our online store is not directed to children. We do not intentionally collect personal data from children without the consent or authorisation required by applicable law. If you believe that a child has provided us with personal data, contact us so that we can assess and delete it where appropriate.
16. Changes to this policy
We may update this Privacy Policy when our processing activities, services, technology or legal obligations change. We will publish the updated version on this page and change the “Last updated” date. If a change materially affects your rights, we will provide additional notice where required.
17. Contact us
For privacy questions or requests, contact:
- Data controller: HASFROS, LDA, operating the ScentAI brand
- Address: Rua Das Meãs de Cima 229 Meãs do Campo, 3140-164 Montemor-o-Velho Portugal
- Email: info@hasfros.com
