Privacy Policy

The controller of your personal data is African Rare Aromatics & Minerals DMCC, Dubai, United Arab Emirates, which processes it under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Where our Johannesburg office handles your data, African Rare Aromatics & Minerals (Pty) Ltd acts under South Africa's Protection of Personal Information Act (POPIA). Where you are in the EU or UK, we apply the GDPR standard to your data.

We collect only what a business transaction requires. That falls into four groups:

• Account data — name, email address, password hash, and the company you are associated with.
• Company data — registered name, country, registration and tax numbers, website, industry and stated intended use, where you submit these for business verification.
• Transaction data — orders, quote requests, sample requests, sourcing requests, shipping addresses and their status history.
• Technical data — a session cookie, a cart token, and rate-limiting records tied to a hashed identifier.

We do not receive, transmit or store raw payment card details under any configuration of this platform. Where a payment processor is connected, card data is captured directly by that processor and never reaches our servers.

We do not sell personal data, and we do not share it with advertising networks.

To operate your account and fulfil orders, which is performance of a contract. To respond to quote, sample and sourcing requests, which is a legitimate interest in responding to an enquiry you initiated. To verify business status, which is a legitimate interest in confirming that professional-use materials go to professional buyers. To meet record-keeping and export-documentation obligations, which is a legal obligation.

Analytics and marketing communications run on consent, which you may withdraw at any time.

Account and transaction records are retained while your account is active, and afterwards for as long as tax, customs and export-control record-keeping require in the relevant jurisdictions. Enquiry records are retained while the enquiry is live and for a reasonable period afterwards. Session records expire automatically.

Depending on where you are, you may have rights of access, rectification, erasure, restriction, portability and objection, and a right to complain to your data protection authority. Contact us to exercise any of them. We will not charge you for a reasonable request or make it difficult to make one.

Where erasure would conflict with a record we are legally required to keep — an export document, for example — we will tell you which record and why, rather than refusing without explanation.

We operate internationally, so your data may be processed in a country other than your own. Where that happens we rely on an appropriate transfer mechanism for the jurisdictions involved.