Effective Date: October 14, 2026

Welcome to the privacy policy of ESTEBAN SA, the operator of our official e-commerce website www.estebansa.com. At ESTEBAN SA, we are dedicated to crafting small, daily rituals that wrap your space in quiet comfort through our carefully curated range of home fragrance and car fragrance products, including hand-poured reed diffusers, non-toxic indoor fragrance solutions, portable car air fresheners, aromatherapy candles and more. We understand that your personal data privacy is of utmost importance, and this policy is designed to clearly explain how we collect, use, store, protect and share your personal information when you interact with our website, make purchases of our products, sign up for our newsletters, participate in our promotional activities or communicate with our customer support team.

This Privacy Policy applies to all personal information processed by ESTEBAN SA, regardless of where our services are delivered to users across the world. We have formulated this policy in full compliance with applicable global data protection regulations, including the General Data Protection Regulation (GDPR) for users located in the European Economic Area, as well as other relevant local data protection laws that apply to our operations. By accessing and using our website www.estebansa.com, you explicitly agree to the practices described in this Privacy Policy. If you do not agree with any terms outlined in this document, please refrain from accessing our website or using any of our e-commerce services.

1. Information We Collect From You

We only collect information that is necessary to deliver our premium home fragrance products and seamless shopping experience to you. The categories of personal information we may gather include the following:

1.1 Information You Provide Voluntarily

This refers to all data you actively submit to us when interacting with our website:

• ‌Account Registration Data‌: When you create a user account on www.estebansa.com, we collect your full name, valid email address, chosen password, and preferred contact language. This information helps you access order history tracking, save your favorite product lists, and enjoy one-click checkout services on your next visit.
• ‌Checkout and Transaction Data‌: When you place an order for products like our Pine Forest Reed Diffuser, Jasmine Blossom Reed Diffuser, or Eucalyptus Mint Solid Car Air Freshener, we require your full delivery address including street name, postal code, city, and country, your valid phone number for delivery coordination, and billing information. We do not store full credit card or payment card details on our servers: all payment processing is completed through our certified third-party payment providers who comply with the highest level of payment card industry security standards.
• ‌Communication Data‌: When you reach out to us via our contact page, send emails to our official contact email hexar@estebansa.com, or call our support line at +49 7665 92020, we may collect the content of your messages, support ticket records, and our response notes to resolve your queries about product usage, order status, return policies or fragrance recommendations more efficiently.
• ‌Marketing Preference Data‌: When you sign up for our exclusive newsletter to receive updates on new arrivals, limited-time holiday scents, and member-only discounts, we collect your email address and your self-reported preferences for specific fragrance categories, such as floral scents, woody aromas, or energizing citrus blends, to send you only the most relevant content that aligns with your interests.
• ‌Survey and Feedback Data‌: When you voluntarily participate in our post-purchase satisfaction surveys or leave product reviews on our website, we collect your feedback content, your self-disclosed user nickname for public review display, and your rating scores for our diffusers, car fresheners and other products to help us improve our product formulation and customer service quality.

1.2 Automatically Collected Information

When you browse www.estebansa.com, certain technical information is automatically collected through cookies and similar tracking technologies to ensure the stable operation of our e-commerce platform:

• ‌Device and Browser Data‌: We collect your device model, operating system version, browser type and version, language settings, unique device identifiers, and IP address to troubleshoot technical issues on our website, optimize the display of product pages for different devices, and prevent unauthorized access to our system.
• ‌Website Usage Data‌: We record your browsing behavior on our site, including the pages you visit, the time you spend viewing our New Arrivals section or Best Sellers collection, the links you click, your search keywords for specific fragrances, your cart addition and removal history, and your checkout process progress, to analyze user habits and optimize our website navigation design for a smoother shopping experience.
• ‌Location Data‌: With your explicit permission, we may collect approximate geolocation data from your IP address to display region-specific shipping policies, currency conversion for your local payment, and localized promotional offers that apply to your residential area.

2. How We Use Your Personal Information

We strictly limit the usage of your personal data to the purposes that are directly related to providing you with high-quality e-commerce services, and we will never process your information in a way that conflicts with the purposes stated in this policy. The main usage scenarios include:

• ‌Order Fulfillment and Delivery‌: We use your delivery address, contact phone number and order details to process your purchase, arrange logistics and shipping, send you order status update notifications, and ensure that your selected ESTEBAN home fragrance or car fragrance products are delivered to you accurately and on time. For example, when you purchase a Sandalwood Vanilla Reed Diffuser or Ocean Breeze Gel Car Air Freshener, we share only the necessary delivery information with our trusted logistics partners solely for the purpose of completing the parcel delivery.
• ‌Service Operation and Website Optimization‌: We analyze the automatically collected website usage data to resolve technical bugs, improve page loading speed, optimize the layout of our product display sections, and make your shopping journey more convenient. For instance, we use aggregated non-personal browsing data to understand which of our new arrival scents receive the most user attention, helping our product team curate more popular fragrance blends in future collections.
• ‌Customer Support Service‌: We use your contact information and communication records to respond to your questions about product ingredient information, usage instructions for our electric diffusers, return and refund rules, or shipping notification settings, and provide you with timely, personalized support at any time. Our support team can be reached via email at hexar@estebansa.com or phone at +49 7665 92020, and all your communication records will be kept securely to ensure continuity of service when you follow up on previous queries.
• ‌Personalized Service Delivery‌: With your explicit consent, we use your fragrance preference data and purchase history to recommend products that may suit your taste, for example suggesting our Lavender Fields Reed Diffuser for users who previously purchased aromatherapy products for stress relief, or our Cinnamon Clove Hanging Car Air Freshener to users who showed interest in winter festive scents. This personalized recommendation service is designed to help you discover more of our products that match your lifestyle needs without overwhelming you with irrelevant information.
• ‌Marketing Communication Management‌: When you opt in to receive our marketing emails, we send you regular updates about new product launches, seasonal promotional campaigns, exclusive member discounts, and limited-time flash sales. You can unsubscribe from our marketing email list at any time by clicking the “unsubscribe” link at the bottom of every marketing email, or by sending an unsubscribe request to our contact email hexar@estebansa.com. We will process your opt-out request within 3 working days, and you will no longer receive any non-transactional marketing messages from us after that.
• ‌Legal Compliance and Rights Protection‌: We may process your personal information when it is necessary to comply with our legal obligations, such as retaining transaction records for tax reporting requirements, or when it is necessary to protect the legitimate rights and interests of ESTEBAN SA, our users, and the public, for example to prevent fraudulent payment transactions, intellectual property infringement, or malicious attacks that threaten the security of our website.

3. Cookie and Similar Tracking Technologies Policy

We use cookies, web beacons, and other similar tracking technologies on www.estebansa.com to distinguish your visit from other visitors to our website, which helps us provide you with a better browsing experience. The types of cookies we use are categorized as follows:

• ‌Strictly Necessary Cookies‌: These cookies are essential for the basic operation of our e-commerce website. They enable core functions such as adding products to your shopping cart, completing checkout procedures, and logging into your user account. You cannot disable these cookies through our website’s setting function, as the website cannot operate normally without them.
• ‌Functional Cookies‌: These cookies record your preferences on our website, such as your selected language, default currency, and saved product favorites. They are used to make your next visit to our website more convenient, so that you do not need to reset these preferences every time you browse our site.
• ‌Performance Cookies‌: These cookies collect anonymous statistical data about how visitors interact with our website, for example which product pages are the most frequently viewed, and whether users encounter error messages when accessing certain sections. We use these data to improve the overall performance and stability of our website.
• ‌Marketing Cookies‌: These cookies are used to track browsing behavior across websites, allowing us to display targeted promotional advertisements about our new fragrance products and exclusive offers to users on third-party platforms that are relevant to their previous interests on our website. We will only deploy marketing cookies after we obtain your explicit consent when you first visit our site.

You can manage or delete cookies through the privacy settings of your own browser at any time. Please note that disabling certain categories of cookies may affect your access to some functions of our website.

4. Information Sharing and Disclosure

ESTEBAN SA will never sell, rent, or lease your personal information to any third parties for their own commercial marketing purposes without your explicit consent. We may share your limited personal data only in the following limited scenarios:

• ‌Trusted Service Providers‌: We share necessary information with third-party service providers who perform services on our behalf, including certified payment processing providers, professional logistics and delivery partners, cloud server hosting service providers, email delivery service platforms, and website data analysis vendors. All of our service providers are strictly selected and have signed data protection agreements with ESTEBAN SA, which require them to protect your personal information at a security level that meets or exceeds applicable legal requirements, and they are not allowed to process your personal data for any purposes other than the specific tasks authorized by us.
• ‌Business Transaction Transfer‌: In the event of a merger, acquisition, asset reorganization, or partial or full sale of ESTEBAN SA’s business assets, your personal information may be transferred as part of the business assets. We will provide at least 30 days advance notice on our website homepage to all affected users before the transfer of personal data takes place, to inform you of any changes in the data controller identity and data processing practices.
• ‌Legal Mandatory Disclosure‌: We may disclose your personal information if we are required by applicable laws, court orders, or official legal requests from competent government authorities to do so. We will make every reasonable effort to verify the legitimacy of such disclosure requests before releasing any of your personal data, to ensure that the disclosure is compliant and necessary.

All information sharing activities we conduct are strictly limited to the minimum scope of data required to achieve the stated purpose, and we never disclose more personal data than is necessary.

5. International Data Transfers

As an enterprise based in Europe, ESTEBAN SA may transfer your personal information to countries or regions outside of your residential jurisdiction, for example to our cloud service server locations, or to logistics service providers that operate cross-border delivery services. For users located in the European Economic Area, we ensure that all such cross-border data transfers are carried out in full compliance with the requirements of GDPR. We will implement appropriate safeguards to protect your transferred personal data, such as signing standard data protection clauses that are approved by the European Commission with the relevant data recipients, or verifying that the recipient country has an adequate level of data protection as recognized by the European Commission. You can contact us via our email hexar@estebansa.com to request a copy of the relevant documents related to these cross-border data transfer safeguards.

6. Data Retention Period

We will not retain your personal information for longer than it is necessary to fulfill the specific purposes for which the information was originally collected. The specific data retention rules are as follows:

• For transaction data generated when you place an order on our website, we retain the relevant information for 10 years after the completion of your order, to comply with local tax laws and commercial accounting record requirements.
• For marketing communication related data (such as your email address in our newsletter subscription list), we retain the data until you submit an unsubscribe request, or until you have not interacted with our marketing messages for a consecutive 36-month period, after which we will securely delete your relevant contact information from our marketing system.
• For your user account data, we retain your information for as long as your account remains active. If you choose to permanently delete your ESTEBAN SA user account, we will erase all your personal profile data within 10 working days, except for the transaction records we are legally required to retain.
• For customer support communication records, we retain the data for 5 years after we close your support ticket, to ensure that we can refer back to historical context if you raise relevant queries again in the future.

After the corresponding retention period expires, we will securely anonymize or permanently delete your personal information, so that it can no longer be associated back to your specific identity.

7. Your Data Subject Rights

Under applicable data protection laws, you have a series of clear rights related to your personal information processed by ESTEBAN SA. You can exercise these rights at any time by sending us a request via email at hexar@estebansa.com, or by calling our support phone number at +49 7665 92020. Before processing your request, we may need to verify your identity to ensure that the applicant is the legitimate data subject corresponding to the relevant personal information. The rights you are entitled to include:

• ‌Right of Access‌: You have the right to obtain a confirmation from us about whether we are processing your personal information, and you can request a free copy of all your personal data stored in our system, along with detailed information about how we process your data.
• ‌Right to Rectification‌: If you find that any of your personal information stored in our system is inaccurate or incomplete, you have the right to request us to correct the erroneous data or supplement the missing information without unnecessary delay. For example, you can update your delivery address or preferred contact phone number at any time through the account management page on our website, or submit a correction request to our support team.
• ‌Right to Erasure (Right to be Forgotten)‌: Under specific circumstances, including the situation where your personal information is no longer necessary for the original purposes for which it was collected, or you withdraw your consent for data processing and there are no other legal grounds for us to continue processing your data, you have the right to request us to delete all your personal information, and we will complete the deletion procedure in compliance with legal requirements.
• ‌Right to Restriction of Processing‌: You have the right to request us to restrict the processing of your personal data in scenarios such as when you contest the accuracy of your personal data, when the processing is unlawful but you refuse to have the data deleted, or when we no longer need the personal data for the original processing purposes but you require the data for the establishment, exercise or defense of legal claims.
• ‌Right to Data Portability‌: You have the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another data controller without hindrance from our side, for all the data processing activities that are based on your consent or on a contract.
• ‌Right to Object‌: You have the right to object to our processing of your personal information at any time, for the processing activities that are based on our legitimate interests. We will stop processing your personal information unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing is for the establishment, exercise or defense of legal claims. You also have the absolute right to object to the processing of your personal information for direct marketing purposes, and we will immediately stop sending you all marketing messages after you submit such an objection.
• ‌Right to Withdraw Consent‌: For all data processing activities that are based on your explicit consent, you have the right to withdraw your previously given consent at any time. The withdrawal of consent will not affect the lawfulness of any data processing activities that we have already carried out before you submit the withdrawal request.

If you are not satisfied with the way we handle your personal data related request, you also have the right to submit a complaint to the local data protection supervisory authority in your residential location.

8. Data Security Protection

At ESTEBAN SA, we have implemented comprehensive industry-standard technical, physical and organizational security measures to protect your personal information from unauthorized access, accidental loss, destruction or damage. Our security protection system includes:

• All data transmission between your browser and our www.estebansa.com website is encrypted with advanced TLS 1.3 technology, to ensure that your sensitive information such as checkout details cannot be intercepted by unauthorized third parties during transmission.
• All our servers that store personal user data are deployed in high-security certified data centers, with multi-layer firewalls, intrusion detection systems, and regular automated vulnerability scanning. We also conduct regular data backup operations to prevent data loss caused by unexpected system failures.
• Only a very limited number of authorized employees who need to access your personal data to perform their job duties (such as customer support staff and order processing team members) are granted permission to access your personal information, and all access operations are logged and audited regularly. All our team members have signed strict data confidentiality agreements, and regular data protection training is conducted every quarter to raise security awareness across the whole organization.
• In the very unlikely event of a personal data security breach that may pose a high risk to your rights and freedoms, we will notify you and the corresponding competent data supervisory authority in accordance with the requirements of applicable laws, without undue delay, within 72 hours after we become aware of the incident.

9. Protection of Minors

Our e-commerce website www.estebansa.com is not intended for use by individuals under the age of 16. We do not knowingly collect any personal information from minors under 16 years old. If you are a parent or legal guardian, and you find that your child under 16 has provided personal information to us without your consent, please contact us immediately via our email hexar@estebansa.com. Once we confirm that we have inadvertently collected personal data from a minor, we will take immediate measures to securely delete all relevant information from our servers.

10. Third-Party Links

Our website may contain hyperlinks to third-party websites, for example links to our trusted social media profile pages, or links to our authorized payment service provider’s portal. Please be aware that these third-party websites have their own independent privacy policies, and ESTEBAN SA has no control over and assumes no responsibility for the data processing practices and content of these external websites. We recommend that you carefully review the privacy policy of every third-party website you visit after leaving www.estebansa.com, before providing any of your personal information to those platforms.

11. Updates to This Privacy Policy

We may revise and update this Privacy Policy from time to time, to adapt to the adjustments of our business operations, the new product lines we launch, or the changes in applicable legal requirements. When we make material changes to this policy, we will prominently display the updated notice on the homepage of www.estebansa.com, and update the “Effective Date” at the top of this document accordingly. For changes that will significantly expand the scope of our data processing activities, we will obtain your explicit consent again before the new policy takes effect. We encourage you to review this Privacy Policy periodically to stay informed of the latest terms about how we protect your personal information.

12. Contact Information

If you have any questions, comments, or concerns about this Privacy Policy, or if you wish to exercise any of your data subject rights that are outlined in this document, you can contact our data protection team through any of the following channels:

• Company Name: ESTEBAN SA
• Official Website: www.estebansa.com
• Contact Email: hexar@estebansa.com
• Contact Address: Rue du Perpignan, 34880 Lavérune
• Contact Phone: +49 7665 92020‌