Privacy Policy

This policy explains what data is collected when you visit myaromex.com, who collects it, where it goes, and what you can do about it.

The findings set out here are based on an inspection of the live website and of the tag manager container running on it, carried out on 4 September 2026. No tool that does not actually run on the site appears in this policy.

The information required under Article 10 of Law No. 6698 on the Protection of Personal Data is provided through the Aromex Privacy Notice (KVKK). This policy complements that notice and explains in more detail what happens. Cookies are covered in full in the Aromex Cookie Policy. All three documents are published at myaromex.com.

1. Data controller

• Data controller — Detail: Esin Deniz, sole proprietorship
• Brand — Detail: Aromex
• Website — Detail: myaromex.com
• Line of business — Detail: 479114, retail trade over the internet
• Tax office — Detail: Başakşehir Vergi Dairesi Müdürlüğü
• Tax identification number — Detail: 2911234592
• Business address — Detail: Bahçeşehir 1. Kısım Mah. Cenk Koray Cad. Akasya 02.04 Sitesi C2 Blok No: 11 İç Kapı No: 12 Başakşehir / İstanbul
• E-mail — Detail: info@myaromex.com
• WhatsApp link — Detail: wa.me/905304265799

References in this policy to our business mean the Esin Deniz sole proprietorship, and Aromex refers to the brand.

2. First things first: there is no form on the site

• None of the site's eight pages contains a form. There is no field where you could enter a name, telephone number, e-mail address or postal address.
• In practical terms this means that unless you get in touch yourself, your name, telephone number and e-mail address never reach our business.
• No age information is collected on the site either. The site is not directed at children.

3. Tools running on the site

1. Google Tag Manager, container ID GTM-NXV9G7SF. This is the tag manager that loads the other measurement tools onto the page. It does not report anything on its own; it governs which tag runs and when.

2. Google Analytics 4, measurement ID G-N2X3P7TV7B. It collects page view and on-site interaction data.

3. Meta Pixel, pixel ID 1375195121462015. It generates two events: the page view, technically named PageView, and the contact link click, technically named Contact.

4. Server-side bridge. The event generated by the site is passed to a server endpoint operating on behalf of myaromex.com. This endpoint is aromex-capi.vercel.app, runs on Vercel infrastructure, and forwards the event to the Meta Conversions API.

5. Website hosting. The site is published on Natro JetSite, whose infrastructure is provided by Webnode.

4. Data collected

4.1. Collected without you typing anything

• The address of the page visited and on-site interaction data — Source: Google Analytics 4 · Purpose: Measuring how the site is used
• The page view event, technically named PageView — Source: Meta Pixel · Purpose: Advertising measurement
• The contact link click event, technically named Contact — Source: Meta Pixel · Purpose: Advertising measurement
• Event name, event ID, page address, the _fbp cookie and, where present, the _fbc cookie — Source: From your browser to the server-side bridge · Purpose: Matching the same event on the Meta side without duplication
• IP address and browser identification string — Source: Added by the server-side bridge itself · Purpose: Transmitting the event to the Meta Conversions API
• The _fbp cookie and the Google Analytics cookies — Source: Created in your browser · Purpose: Keeping measurement consistent across a visit

• This data does not contain your name, surname or contact details. It consists of identifiers generated at browser and device level.
• The IP address, the browser identification string and cookie identifiers qualify as personal data.
• This data is collected electronically and by fully automated means, through the tag manager, the measurement tags and cookies. The IP address and the browser identification string are processed server-side, independently of any cookie.

4.2. What you send us directly

• WhatsApp. When you write to us over the WhatsApp link on the site, your telephone number and the content of your message reach our business.
• Telephone. When you call using the telephone link, the information you choose to share during the call reaches our business.
• E-mail. When you write to info@myaromex.com, the information you choose to share in that message reaches our business.

You decide how much information to share through these three channels.

5. Exactly what the server-side bridge carries

We set this out separately because it is the least visible part of the setup. The fields the bridge carries are limited to the following.

• Event name
• Event ID
• Page address
• The _fbp cookie in your browser
• The _fbc cookie, where present
• The IP address and browser identification string added by the server

The bridge carries no data beyond these. Your name, telephone number and e-mail address do not go to the bridge, because there is no field on the site where you could enter them.

6. Why we collect it

• To keep the site running and display it to you
• To understand which pages attract interest and how a visit progresses
• To measure advertising results, prevent the same event from being counted twice, and direct the advertising budget correctly
• To answer questions and requests received via WhatsApp, telephone and e-mail
• To manage the relationship established at your request
• To fulfil obligations arising from legislation

7. Legal grounds

The following grounds under Article 5 of the Law are relied upon.

• Hosting the site and displaying it to you — Legal ground: Legitimate interest, Article 5/2-f
• What you send through the contact channels, where your request concerns a purchase — Legal ground: Direct relation to the establishment or performance of a contract, Article 5/2-c
• What you send through the contact channels, in all other cases — Legal ground: Legitimate interest, Article 5/2-f
• Cases where legislation requires records to be kept or information to be provided — Legal ground: Legal obligation, Article 5/2-ç
• Records required in the event of a dispute — Legal ground: Establishment, exercise or protection of a right, Article 5/2-e

We set out the position on measurement and advertising cookies, and the processing carried out through them, exactly as it stands.

• These cookies are not strictly necessary for the site to function. For them, the Law requires processing based on explicit consent.
• The cookie banner on the site offers four categories: Essential cookies, Functional cookies, Performance cookies, and Marketing / third party cookies. Essential cookies are mandatory and cannot be switched off. The other three categories are off by default; the visitor switches them on and off individually and saves that choice.
• The Meta Pixel tag depends on the ad_storage and ad_user_data permissions. As long as these permissions are not granted, the tag does not load, no request is sent to Meta, and the _fbp cookie is not created.
• This processing therefore rests on the explicit consent the visitor gives through the choice made on the cookie banner.
• If you do not want these cookies, you can delete or block them from your browser settings. You may also submit a request through the application channels set out below.

Your data is not used for purposes other than those stated in this section. No profiling that produces legal effects concerning you is carried out through analysis by automated systems.

8. Cookies and consent state

• The tags on the Google side are configured so that the consent state is treated as denied by default. This default covers the following permissions: ad_storage, analytics_storage, ad_user_data, ad_personalization, functionality_storage, personalization_storage.
• You can switch these permissions on and off category by category from the banner's advanced panel.
• When consent is given to the Performance cookies category, the analytics_storage permission moves to the granted state. When consent is given to the Marketing / third party cookies category, the ad_storage, ad_user_data, ad_personalization and personalization_storage permissions also move to the granted state.
• The Meta Pixel tag depends on the ad_storage and ad_user_data permissions. As long as these permissions are not granted, the tag does not load, no request is sent to Meta, and the _fbp cookie is not created.
• In the measurement carried out on 4 September 2026, it was observed that when consent was given only to the Performance cookies category, the Google Analytics cookies were created, no request whatsoever was sent to Meta, and the _fbp cookie was not created.
• The detail of the cookies, their classification and what you can do on the browser side are set out in the Aromex Cookie Policy.

9. Who receives your data

• Google. Within the scope of the Google Tag Manager and Google Analytics 4 services: page view and on-site interaction data, together with the Google Analytics cookie identifiers.
• Meta. Within the scope of the Meta Pixel and the Meta Conversions API: event name, event ID, page address, the _fbp and, where present, _fbc cookie values, IP address and browser identification string. If you choose to use the WhatsApp link, your correspondence takes place over Meta's messaging service.
• Vercel. The infrastructure provider on which the server-side bridge runs. Event data passes over this infrastructure while being transmitted to Meta.
• Natro JetSite and Webnode. The infrastructure on which the site is hosted.
• Authorised public institutions and organisations. Where required by legislation and limited to the scope requested.

Other than the parties listed above, your personal data is not shared with third parties, is not sold, and is not assigned for the marketing activity of any other business.

10. Processing abroad

• The providers listed above are international service providers. It is possible that data is processed abroad within the scope of these services.
• As our business has no verified information about the countries in which these providers' servers are located, no country or region is named here and no specific undertaking is given on this point.
• The conditions set out in Article 9 of the Law apply to transfers abroad. Any transfer is limited to the purposes listed in this policy and to the scope necessary for the relevant services to function.
• This section will be updated once verified information is obtained.

11. Retention periods

• Data is retained for as long as the purpose of processing requires, and for as long as the statutory limitation periods and retention obligations laid down in the relevant legislation require.
• When the purpose ceases to exist and the statutory periods expire, the data is deleted, destroyed or anonymised.
• The lifetime of a cookie in your browser is the period set by the tool that created it. You can delete cookies yourself at any time.
• Retention periods within the systems of providers such as Google and Meta are subject to their own policies.

12. Data security

• Under Article 12 of the Law, it is our obligation to take the necessary technical and administrative measures to prevent the unlawful processing of personal data and unlawful access to it.
• Where it is established that personal data has been unlawfully obtained by others, notification is made to the data subject and to the Personal Data Protection Board.
• Even so, no absolute guarantee of security can be given for any transmission over the internet. We recommend that you do not share sensitive information through these channels.

13. Your rights

Under Article 11 of the Law, you have the following rights.

• To learn whether your personal data is being processed
• To request information about it if it has been processed
• To learn the purpose of processing and whether the data is used in line with that purpose
• To know the third parties in Türkiye or abroad to whom your data is transferred
• To request correction if the data has been processed incompletely or inaccurately
• To request deletion or destruction within the conditions laid down in the Law
• To request that correction, deletion and destruction operations be notified to the third parties to whom your data has been transferred
• To object to an outcome to your detriment arising from the analysis of processed data exclusively by automated systems
• To claim compensation for damage suffered as a result of unlawful processing

Where processing is based on explicit consent, you may withdraw your consent at any time. Withdrawal takes effect prospectively. You can manage your cookie preferences category by category from the advanced settings screen of the cookie banner, and withdraw the consent you have given from there. You can also delete or block cookies from your browser settings. In addition, you may submit a request through the application channels set out below.

14. Applications

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit your requests as follows.

• A written application bearing a wet signature, delivered in person, through a notary or by post to the business address stated above.
• A message signed with a secure electronic signature or mobile signature, sent to info@myaromex.com.
• A message sent from the e-mail address you have previously notified to our business and which is registered in our system, sent to info@myaromex.com.

Your application must include your name and surname and, if the application is in writing, your signature; for citizens of the Republic of Türkiye the national identity number, and for foreign nationals nationality and passport number or identity number, if any; your residential or business address for the purposes of notification; your e-mail address, telephone and fax number for notification, if any; and the subject of your request. Where we cannot verify your identity, we may ask for additional information.

Your application is concluded as soon as possible and in any case within thirty days of it reaching us. Applications are free of charge as a rule. Where the process incurs an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.

If your application is rejected, if you find the response insufficient, or if no response is given within the time limit, you may file a complaint with the Personal Data Protection Board within thirty days of learning of the response and in any case within sixty days of the date of application.

15. Related documents

• Aromex Privacy Notice (KVKK)
• Aromex Cookie Policy

16. Changes

• This policy is updated whenever the tools used on the site or the data flow change.
• The current version is always published at myaromex.com. The date at the end of the document shows the last update.

Last updated: 4 September 2026