Privacy policy

Last updated: 2 October 2026

This privacy policy explains how we collect and use your personal data when you visit www.rohomallorca.com, place an order, subscribe to our newsletter or contact us. We process your data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD").

1. Controller

Roho Airdeco SL
CIF/NIF: B16822942
Plaza Mare de Déu de la Salut 4, 1º 2ª, 07002 Palma (Illes Balears), Spain
Email: info@rohomallorca.com
Telephone: +34 676 45 00 50
Contact person: Pedro Aranda Escudero

We have not appointed a data protection officer, as we are not legally required to do so. For any data protection questions, please contact us at the email address above.

2. Which data we process

  • Contact and order data: name, billing and delivery address, email address, telephone number, ordered products, order history, payment status.
  • Payment data: payment method and transaction details. Card details are processed exclusively by our payment providers; we do not have access to your full card number.
  • Customer account data: login data and order history if you create a customer account.
  • Communication data: content of emails, contact form messages or social media messages you send us.
  • Newsletter data: email address, name (optional), date of subscription and consent, interaction with our emails (e.g. opens and clicks).
  • Usage and device data: IP address, browser and device type, operating system, language, approximate location, pages visited, referring website, date and time of access, and data collected via cookies and similar technologies (see section 8).
  • Review data: name, rating, review text and photos if you submit a product review.
  • Business data: company and contact details for wholesale, B2B and custom candle inquiries.

3. Purposes and legal bases

  • Processing orders and delivery (contract, payment, shipping, invoicing, returns, customer service) – Art. 6(1)(b) GDPR (performance of a contract).
  • Customer account – Art. 6(1)(b) GDPR.
  • Answering inquiries by email, contact form or social media – Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in answering your request).
  • Newsletter and marketing emails – Art. 6(1)(a) GDPR (your consent). If you are already our customer, we may send you emails about similar products of our own based on Art. 21(2) of Spanish Law 34/2002 (LSSI) and Art. 6(1)(f) GDPR; you can object at any time.
  • Automated welcome and promotional messages on Instagram/Facebook – Art. 6(1)(a) GDPR (consent, by interacting with or following our accounts).
  • Product reviews – Art. 6(1)(a) GDPR (consent) – review invitations after a purchase are based on Art. 6(1)(f) GDPR.
  • Analytics, personalisation and advertising (e.g. measuring visits, showing relevant ads on social networks) – Art. 6(1)(a) GDPR and Art. 22(2) LSSI (your consent via the cookie banner).
  • Technically necessary functions, IT security and fraud prevention – Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning online shop).
  • Compliance with legal obligations (e.g. tax and accounting obligations) – Art. 6(1)(c) GDPR.

Providing your data is necessary to conclude a contract. Without this data, we cannot process your order.

4. Recipients and service providers

We only share your data where necessary for the purposes described above. We use the following service providers, who process data on our behalf or as independent controllers:

  • Shopify (Shopify International Ltd., Ireland) – hosting and operation of our online shop, checkout, customer accounts.
  • Payment providers – Shopify Payments (powered by Stripe) and other payment providers you select at checkout, to process your payment.
  • Shipping – Packlink and the carriers we use (e.g. UPS, DPD) receive your name, delivery address and, where necessary, email/telephone for delivery notifications.
  • Email marketing – Omnisend (newsletter and automated emails); Orderly Emails (design of order emails).
  • Reviews – Judge.me (collection and display of product reviews).
  • Website features – Weglot (translation of the website), Instafeed (display of our Instagram feed), Visual Quiz Builder (scent quiz), Shopify Search & Discovery and other Shopify apps that provide shop functions.
  • Social media and advertising – Meta Platforms (Facebook, Instagram, including the Meta Pixel), ManyChat (automated Instagram/Facebook messages), Google (Google Analytics, Google Ads, YouTube), Pinterest – only with your consent where cookies or similar technologies are involved.
  • Wholesale – Ankorstore and Faire, for business customers who order through these platforms.
  • Advisors and authorities – tax advisors, accountants, lawyers, banks and public authorities where required by law.

5. Transfers outside the EU/EEA

Some of our service providers (e.g. Shopify, Stripe, Meta, Google, Pinterest, Omnisend, ManyChat) may process data in countries outside the European Economic Area, in particular the United States. Such transfers take place on the basis of an adequacy decision of the European Commission (e.g. the EU-U.S. Data Privacy Framework, for certified companies) or the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

6. How long we keep your data

  • Order and invoice data: for as long as required by commercial and tax law, generally six (6) years (Art. 30 of the Spanish Commercial Code) and up to the applicable limitation periods.
  • Customer account: until you delete your account or ask us to delete it, subject to the legal retention periods above.
  • Newsletter: until you unsubscribe or withdraw your consent; proof of consent is kept for as long as we may need to demonstrate it.
  • Inquiries: as long as necessary to handle your request and up to two (2) years thereafter, unless a contract is concluded.
  • Cookies: according to the storage periods indicated in the cookie banner or in section 8.

7. Your rights

You have the right to:

  • access your personal data (Art. 15 GDPR);
  • have inaccurate data rectified (Art. 16 GDPR);
  • have your data erased (Art. 17 GDPR);
  • restrict the processing of your data (Art. 18 GDPR);
  • receive your data in a portable format (Art. 20 GDPR);
  • object to processing based on legitimate interests, and at any time to direct marketing (Art. 21 GDPR);
  • withdraw your consent at any time with effect for the future (Art. 7(3) GDPR) – e.g. via the unsubscribe link in each newsletter or in the cookie settings.

To exercise your rights, please write to info@rohomallorca.com or to our postal address. We may ask you to verify your identity.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence or place of work. The competent authority in Spain is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

8. Cookies and similar technologies

We use cookies and similar technologies (e.g. pixels and local storage). Technically necessary cookies are used without consent, as they are required for the shop to function (e.g. shopping cart, checkout, login, security and storing your cookie preferences). All other cookies – for analytics, personalisation and marketing – are only set if you give your consent via our cookie banner. You can change or withdraw your consent at any time via the cookie settings on our website or by deleting cookies in your browser.

Necessary cookies (Shopify) – e.g. _shopify_essential, _secure_session_id, cart, cart_sig, cart_ts, cart_currency, checkout, checkout_token, keep_alive, localization, _tracking_consent, secure_customer_sig, storefront_digest, identity-state. Purpose: shopping cart, checkout, customer login, security, saving your consent. Duration: from session to 1 year (secure_customer_sig up to 20 years).

Analytics cookies (with consent) – e.g. Shopify analytics (_shopify_y, _shopify_s, _shopify_sa_p, _shopify_sa_t, _landing_page, _orig_referrer) and Google Analytics (_ga, _ga_*). Purpose: understanding how visitors use our shop. Duration: 30 minutes to 2 years.

Marketing cookies (with consent) – e.g. Meta Pixel (_fbp, _fbc), Google Ads (_gcl_au), Pinterest (_pin_unauth, _epik) and Omnisend (soundestID, omnisendSessionID). Purpose: measuring the success of our advertising, showing you relevant ads on other platforms and personalising our emails. Duration: session to 2 years.

When you visit our pages on Instagram or Facebook, Meta Platforms Ireland Ltd. and Roho Airdeco are joint controllers for the page insights (Art. 26 GDPR). Further information is available in Meta's privacy policy.

9. Security

We use appropriate technical and organisational measures to protect your data. Our website uses SSL/TLS encryption.

10. Minors

Our shop is aimed at adults. We do not knowingly collect personal data from persons under 14 years of age. Purchases may only be made by persons aged 18 or over.

11. Changes to this privacy policy

We may update this privacy policy to reflect changes in our services or in the law. The current version is always available on our website.