Privacy Policy

Last Updated on November 10, 2020

Introduction

Scenery Oils, LLC (“Scenery Oils”, “we”, “us”, “our”) operates and provides services and products through sceneryoils.com and its sub-domains, affiliated sites and associated web pages (the “Site”). We take seriously the protection of your personal data (“Personal Data”). Please read this privacy policy (the “Privacy Policy”) to learn what we are doing with your Personal Data, how we protect it, and what privacy rights you may have. Your continued use of the Site constitutes your acceptance of this Privacy Policy.

What Is Covered by this Privacy Policy

This Privacy Policy addresses data subjects (which includes both individuals and households) whose Personal Data we:

• receive directly through our Site;
• receive from our business partners; or
• process to promote our products and services.

The services and products on the Site are not directed at, or intended for use by, children under the age of 13.

Information Which Does Not Constitute Personal Data
If we do not maintain information in a manner that identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular individual or household, such information is not considered Personal Data and this Privacy Policy will not apply to our processing of that information.

Personal Data Processed in Business to Business Communications and Transactions
This Privacy Policy does not apply to Personal Data reflecting communications or transactions between us and you when you are acting as an employee, owner, director, officer, or contractor company, partnership, sole proprietorship, nonprofit, or government agency (“Your Entity”) and when we are conducting due diligence regarding Your Entity or providing or receiving a product or service to or from Your Entity.

Our Role With Respect to Your Personal Data

Within the scope of this Privacy Policy, Scenery Oils acts as a data controller or “business” for the Personal Data we process. This means that we decide how and why Personal Data is collected and further processed.

Lawful Bases for Processing

We must have a valid reason to use your Personal Data. This is called the "lawful basis for processing". We may process your Personal Data on the basis of:

• your consent;
• the need to perform a contract with you;
• our legitimate interests;
• the need to comply with the law; or
• any other ground, as required or permitted by law.

Where we process your Personal Data based on your consent, you may withdraw it at any time. However, this will not affect the lawfulness of our processing before you withdraw your consent. It will also not affect the validity of our processing of Personal Data performed on other lawful grounds.
Where we receive your Personal Data as part of providing our services to you to fulfill a contract, we require such Personal Data to be able to carry out the contract. Without that necessary Personal Data, we will not be able to provide the services and products to you.

What Personal Data We Process and How We Obtain It

Cookies

A “cookie” is a small file stored on your device that contains information about your device. We may use cookies to provide basic relevant ads, Site functionality, authentication (session management), usage analytics (web analytics), to remember your settings, and to generally improve our Site and services.

If you would prefer not to accept cookies, you can change the setup of your browser to reject all or some cookies. Note, if you reject certain cookies, you may not be able to use all features of our services. For more information, please visit https://www.aboutcookies.org/.

You may also set your browser to send a Do Not Track (DNT) signal. For more information, please visit https://allaboutdnt.com/. Please note that our services do not have the capability to respond to “Do Not Track” signals received from web browsers.

For What Purposes Do We Use Your Personal Data

We may process your Personal Data for the following business purposes:

•     enabling use of our services;
•     providing you with information or products that you request from us;
•     responding to your requests or questions;
•     communication with you on status of delivery of the services and          products;
•     fulfilling legal obligations and enforce our rights;
•     improving our services; and
•     sending you email marketing communications about our business which   we think may interest you.

How Long We Keep Your Personal Data

When the purposes of processing are satisfied, we will delete the related Personal Data or upon receipt of a verified request.

Sharing Personal Data with Third Parties

The categories of third parties to which we may disclose your Personal Data for our business purposes include:

•     Internet service providers
•     Cloud service providers
•     Payment processing providers
•     Email service providers
•     Web analytics providers

When you use the services, certain third parties may collect Personal Data about your online activities over time and across different websites or online services. Please refer to the policies of these third parties to learn more about the way in which they collect and process information about you.

Some of these third parties may be located outside of the United States. However, when the Personal Data is protected by the GDPR, before transferring your Personal Data to these third parties, we will either ask for your explicit consent or require the third party to maintain at least the same level of privacy and security for your Personal Data that we do. We remain liable for the protection of your Personal Data that we transfer or have transferred to third parties through our designated data transfer mechanism, such as Standard Contractual Clauses (“SCCs”), except to the extent that we are not responsible for the event that leads to any unauthorized or improper processing. We do not sell your Personal Data to third parties.

Other Disclosures of Your Personal Data

We may disclose your Personal Data to the extent required by law, or if we have a good-faith belief that we need to disclose it in order to comply with official investigations or legal proceedings (whether initiated by governmental/law enforcement officials, or private parties). If we have to disclose your Personal Data to governmental/law enforcement officials, we may not be able to ensure that those officials will maintain the privacy and security of your Personal Data.

We may also disclose your Personal Data if we sell or transfer all or some of our company’s business interests, assets, or both, or in connection with a corporate restructuring. Finally, we may disclose your Personal Data to our subsidiaries or affiliates, but only if necessary for business purposes, as described in the section above.

We reserve the right to use, transfer, sell, and share aggregated, anonymous data for any legal purpose. Such data does not include any Personal Data. The purposes may include analyzing usage trends or seeking compatible advertisers, sponsors, and customers.

The Privacy Rights You Have

You have specific rights regarding your Personal Data that we collect and process. Please note that you can only exercise these rights with respect to Personal Data that we process about you when we act as a data controller or as a business. 

In this section, we first describe those rights and then we explain how you can exercise those rights.

Right to Know What Happens to Your Personal Data

This is called the right to be informed. It means that you have the right to obtain from us all information regarding our data processing activities that concern you, such as how we collect and use your Personal Data, how long we will keep it, and who it will be shared with, among other things. We are informing you of how we process your Personal Data with this Privacy Policy.

Right to Know What Personal Data We Have About You

This is called the right of access. This right allows you to ask for full details of the Personal Data we hold on you, including confirmation of whether or not we process Personal Data concerning you, and, where that is the case, a copy or access to the Personal Data and certain related information.

Once we receive and confirm that the request came from you or your authorized agent, we will disclose to you:

•     The categories of your Personal Data that we process;
•     The categories of sources for your Personal Data;
•     Our purposes for processing your Personal Data;
•     Where possible, the retention period for your Personal Data, or, if not possible, the criteria used to determine the retention period;
•     The categories of third parties with whom we share your Personal Data;
•     If we rely on legitimate interests as a lawful basis to process your Personal Data, the specific legitimate interests; and
•     The appropriate safeguards used to transfer Personal Data from the EU to a third country, if applicable.

Under some circumstances, we may deny your access request. In that event, we will respond to you with the reason for the denial.

Right to Change Your Personal Data

This is called the right to rectification. It gives you the right to ask us to correct without undue delay anything that you think is wrong with the Personal Data we have on file about you , and to complete any incomplete Personal Data.

Right to Delete Your Personal Data

This is called the right to erasure, right to deletion, or the right to be forgotten. This right means you can ask for your Personal Data to be deleted.

Sometimes we can delete your information, but other times it is not possible for either technical or legal reasons. If that is the case, we will consider if we can limit how we use it. We will also inform you of our reason for denying your deletion request.

Right to Ask us to Change How We Process Your Personal Data

This is called the right to restrict processing. It is the right to ask us to only use or store your Personal Data for certain purposes. You have this right in certain instances, such as where you believe the data is inaccurate or the processing activity is unlawful.

Right to Ask Us to Stop Using Your Personal Data

This is called the right to object. This is your right to tell us to stop using your Personal Data. You have this right where we rely on a legitimate interest of ours (or of a third party). You may also object at any time to the processing of your Personal Data for direct marketing purposes.

We will stop processing the relevant Personal Data unless: (i) we have compelling legitimate grounds for the processing that override your interests, rights, or freedoms; or (ii) we need to continue processing your Personal Data to establish, exercise, or defend a legal claim.

If we have received your Personal Data in reliance on the Privacy Shield or the SCCs, you may also have the right to opt out of having your Personal Data shared with third parties and to revoke your consent to our sharing your Personal Data with third parties. You may also have the right to opt out if your Personal Data is used for any purpose that is materially different from the purpose(s) for which it was originally collected or which you originally authorized.

Right to Port or Move Your Personal Data

This is called the right to data portability. It is the right to ask for and receive a portable copy of your Personal Data that you have given us or that you have generated by using our services, so that you can:

•     Move it;
•     Copy it;
•     Keep it for yourself; or
•     Transfer it to another organization.

We will provide your Personal Data in a structured, commonly used, and machine-readable format. When you request this information electronically, we will provide you a copy in electronic format.

Right to Withdraw Consent

Where we rely on your consent as the legal basis for processing your Personal Data, you may withdraw your consent at any time. If you withdraw your consent, our use of your Personal Data before you withdraw is still lawful.

If you have given consent for your details to be shared with a third party and wish to withdraw this consent, please also contact the relevant third party in order to change your preferences.

Right to Non-Discrimination 

We will not discriminate against you for exercising any of your privacy rights. Unless the applicable data protection laws permit it, we will not:

•     Deny you goods or services;
•     Charge you different prices or rates for goods or services, including through granting discounts or other benefits or imposing penalties;
•     Provide you a different level or quality of goods or services; or
•     Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Right to Lodge a Complaint with a Supervisory Authority

If the GDPR applies to our processing of your Personal Data, you have the right to lodge a complaint with a supervisory authority if you are not satisfied with how we process your Personal Data. Specifically, you can lodge a complaint in the Member State of the European Union of your habitual residence, place of work, or the alleged violation of the GDPR.

How To Exercise Your Privacy Rights

To exercise any of the rights described above, please submit a request by contacting us by email at info@sceneryoils.com.

Verification of Your Identity

In order to correctly respond to your privacy rights requests, we need to confirm that you made the request. Consequently, we may require additional information to confirm that you are who you say you are.

We will only use the Personal Data you provide us in a request to verify your identity or authority to make the request.

Our Response Timing

We will confirm the receipt of your request within ten (10) days and, in that communication, we will also describe our identity verification process (if needed) and when you should expect a response, unless we have already granted or denied the request.

Please allow us up to thirty (30) days to reply to your requests from the day we received your request. If we need more time (up to 90 days in total), we will inform you of the reason why and the extension period in writing. If we cannot satisfy a request, we will explain why in our response. 

We will not charge a fee for processing or responding to your requests. However, we may charge a fee if we determine that your request is excessive, repetitive, or manifestly unfounded. In those cases, we will tell you why we made that determination and provide you with a cost estimate before completing your request.

Data Integrity & Security

We are strongly committed to keeping your Personal Data safe. We have implemented and will maintain technical, administrative, and physical measures that are reasonably designed to help protect your Personal Data from unauthorized processing. Unauthorized processing includes unauthorized access, exfiltration, theft, disclosure, alteration, or destruction.

Changes to this Privacy Policy

If we make any material change to this Privacy Policy, we will post the revised Privacy Policy to this web page. We will also update the Effective date. By continuing to use our services after we post any of these changes, you accept the modified Privacy Policy.

Contact Us

If you have any questions about this Privacy Policy or our processing of your Personal Data, or want to submit a verifiable consumer request, please write to us by email at info@sceneryoils.com.