PRIVACY AND COOKIE POLICY

1.1. This Privacy and Cookie Policy (hereinafter referred to as the Policy) applies to all users of the website https://theelixir.ai/ and its subdomains, including https://app.theelixir.ai/ (hereinafter collectively referred to as the Website), the The Elixir mobile application, as well as to Clients who order or receive services from The Elixir Perfume Laboratory (hereinafter referred to as the Clients).

1.2. The Policy describes the purpose, procedure for collecting, using, processing, storing and transferring personal data that Valeriy Valeriyovych Borysenko, an individual entrepreneur (hereinafter referred to as the Contractor or The Elixir; full details are in section 2) receives when providing services or using the Website.

1.3. By using the Website, the User confirms that he has read this Policy and his rights as a personal data subject. In cases where the processing of personal data is based on consent, such consent is provided separately - by taking an active action (checking the appropriate form, setting cookies, voluntarily completing the AI questionnaire after reading the terms) - and may be withdrawn by the User at any time.

1.4. If the User does not agree with the terms of this Policy, he must refrain from using the Website and the laboratory services.

The personal data controller is:

Sole proprietor Borysenko Valerii Valeriiovych

Brand: The Elixir Perfume Laboratory

Website: https://theelixir.ai/ (including the subdomain https://app.theelixir.ai/)

Email for personal data inquiries: hello@theelixir.ai

(hereinafter — the Contractor or The Elixir)

The Contractor acts as the personal data controller when processing the data of individuals. All requests regarding the exercise of the rights of personal data subjects should be sent to hello@theelixir.ai.

The Law — the Law of Ukraine “On Personal Data Protection” No. 2297-VI of June 1, 2010 (as amended).

GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation).

Personal data — any information relating to an identified or identifiable natural person. A natural person may be identified directly or indirectly — by name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person (Article 4(1) GDPR).

Natural person (data subject) — any person who visits the Website, uses the AI service, or orders services from The Elixir Perfume Laboratory.

Processing of personal data — any operation or set of operations performed on personal data: collection, storage, adaptation, alteration, retrieval, use, transfer, anonymization, blocking, erasure, or destruction of data.

Profiling — automated processing of personal data that consists of using such data to evaluate certain personal aspects, in particular taste preferences in fragrances, in order to provide personalized recommendations.

The Elixir collects only the personal data necessary to provide its services. Unnecessary or excessive data is not collected.

4.1. Client data

— first and/or last name;

— email address;

— mobile phone number;

— delivery address (when ordering goods);

— company name and job title (for corporate clients);

— links to social media profiles (if provided voluntarily).

4.2. Transactional and financial data

— information about ordered services and goods;

— payment data (payment method, transaction status); bank card details are processed exclusively by payment systems — The Elixir does not store full payment card data.

4.3. Booking and session data

— date, time, and format of the ordered perfume session (individual / couples / group);

— number of participants;

— information about allergic reactions or contraindications voluntarily disclosed by the Client before the session (the procedure for processing such information is set out in clauses 4.8 and 6.3 of this Policy).

4.4. AI profiling data (scent profile)

When using The Elixir AI fragrance selection service, the following is collected:

— answers to the taste preference questionnaire;

— scent profile parameters generated based on the answers;

— recommended fragrance families and compositions.

This data is the result of automated processing (profiling). See Section 10 of this Policy for details.

4.5. Data about created formulas

— the unique identifier of the fragrance formula created by the Client during the session;

— the list of ingredients chosen by the Client and their proportions (stored in the laboratory's database so the fragrance can be reproduced at the Client's request).

4.6. Technical data (collected automatically)

— IP address;

— date and time of the request;

— browser type and version, operating system;

— pages viewed on the Website;

— cookies and similar tracking technologies.

4.7. Interaction data

— records of contact with The Elixir: phone calls, email correspondence, messenger messages (Viber, Telegram, WhatsApp, etc.), chat on the Website;

— interaction with The Elixir's official social media pages (Instagram, Facebook, etc.).

4.8. Special categories of data. What The Elixir does not collect

The Elixir does not collect or process: information about racial or ethnic origin; political, religious, or philosophical beliefs; biometric or genetic data.

The only exception is information about allergic reactions or contraindications that the Client voluntarily discloses before the session. Such information constitutes health data (a special category of personal data within the meaning of Article 7 of the Law and Article 9 GDPR) and is processed exclusively on the basis of the Client's explicit consent (Article 9(2)(a) GDPR) and solely for the purpose of conducting the session safely. This information is not shared with third parties and is deleted after the service has been provided, unless the Client has given separate consent to retain it for future sessions.

— when visiting the Website and using its features;

— when filling out booking forms for a session, master class, or corporate event;

— when completing the AI fragrance selection questionnaire;

— when placing an order to purchase goods;

— when subscribing to the newsletter;

— during and after a perfume session (formula, booking data);

— when contacting The Elixir by phone, email, messengers, or social media;

— when interacting with The Elixir's official social media pages (likes, follows, comments).

6.1. Performance of a contract (Article 6(1)(b) GDPR)
— recording and confirming bookings for perfume sessions and master classes;
— providing the ordered services and selling goods;
— processing payments and managing transactions;
— informing the Client about changes to the order, schedule, or terms of service;
— arranging delivery of ordered goods by logistics partners, including international delivery;
— storing formulas so they can be reproduced at the Client's request.
6.2. Legitimate interest (Article 6(1)(f) GDPR)
— analyzing and improving the quality of services and products;
— statistics and marketing research (in anonymized form);
— ensuring Website security and detecting fraud;
— keeping records of contact with Clients to resolve disputes or claims.
6.3. Consent of the data subject (Article 6(1)(a) GDPR)
— sending marketing newsletters, news, promotional offers, and event announcements (only with separate consent);
— AI profiling of taste preferences and creation of a personalized scent profile;
— processing voluntarily disclosed information about allergic reactions or contraindications — on the basis of explicit consent (Article 9(2)(a) GDPR, Part 2 of Article 7 of the Law), solely for conducting the session safely;
— use of analytics and marketing cookies (see Section 7 for details).
Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
6.4. Compliance with a legal obligation (Article 6(1)(c) GDPR)
— transfer of data to authorized state bodies in accordance with the requirements of Ukrainian law;
— compliance with tax, accounting, and statistical reporting requirements;
— compliance with other regulatory obligations.

Cookies are small text files stored on the User's device when visiting the Website. The Elixir uses the following types of cookies:

​

Technical (required)

Necessary for the correct operation of the Website: authorization, saving the cart, language settings. Do not require consent.

Analytical

Collects anonymous visit statistics to improve the Website (Google Analytics or similar). Requires consent.

Marketing

Used to show relevant advertising and track campaign performance. Consent required.

Functional

Stores User preferences (AI survey results, favorite fragrances). Requires consent.

Session cookies are automatically deleted after closing the browser. Persistent cookies are stored until they expire or until they are deleted by the User.

When you first visit the Website, you will be notified about the use of cookies and can adjust your preferences through the Cookie Settings Center. Opting out of non-essential cookies will not limit your access to the basic functions of the Website.

More information about managing cookies in your browser: https://allaboutcookies.org/european-privacy-laws

The Elixir does not sell, disclose or transfer Clients' personal data to third parties without their consent, except in the following cases:

8.1. Logistics partners

The Client's address and full name are transferred to transport and courier companies exclusively for the purpose of organizing the delivery of ordered goods: LLC "NOVA POSHTA" (EDRPOU 31316718) - delivery in Ukraine and international shipments; JSC "Ukrposhta" (EDRPOU 21560045) - international shipments.

8.2. Payment systems

The data required for payment processing is transferred to payment providers. The Elixir does not receive or store full payment card details.

8.3. Marketing and analytical services

With the Client's consent, data may be transferred to providers of analytical and marketing tools (Google, Meta, etc.) exclusively to the extent specified in the consent.

8.4. Technical service providers (processors)

To ensure the operation of the Website and the provision of services, The Elixir engages providers of hosting services, CRM systems, email newsletter services and communication platforms (messengers) who process personal data on behalf of and on behalf of The Elixir on the basis of agreements guaranteeing confidentiality and data protection. The current list of processor categories is provided upon request: hello@theelixir.ai.

8.5. Authorized state bodies

The Elixir discloses personal data at the request of competent authorities in accordance with the current legislation of Ukraine.

All third parties processing data on behalf of The Elixir are required to comply with this Policy and the requirements of applicable law.

The Elixir may transfer personal data outside of Ukraine when using cloud services or marketing platforms registered in other countries, as well as when organizing international delivery of orders (transfer of recipient address data to a foreign carrier). Such transfer is carried out only if:

— the transfer is necessary for the performance of the contract with the Client (in particular, for the international delivery of the order); or

— the European Commission has recognized that the country of destination ensures an adequate level of protection of personal data; or

— the supplier is bound by standard contractual clauses in accordance with the requirements of data protection legislation.

10.1. The Elixir uses an AI service for automated analysis of the Client's responses and formation of a personalized aroma profile - recommendations regarding aromatic families and specific compositions.

10.2. AI profiling does not have legally significant or similarly significant consequences for the Client - it is exclusively an information and recommendation tool and does not limit access to services.

10.3. The Client has the right at any time:

— refuse to complete the AI questionnaire and receive the service without profiling;

— request information about the logic and parameters used in the formation of the aroma profile;

— appeal the result of automated profiling and obtain advice from a laboratory specialist.

10.4. To opt out of AI profiling or to exercise the above rights, please send a request to: hello@theelixir.ai

The Elixir retains personal data only for as long as necessary to achieve the purposes of processing, taking into account the duration of the contractual relationship, the retention periods established by Ukrainian law, and the need to resolve possible disputes or assert legal claims. Approximate retention periods by data category:

​

Order and transaction data and primary documents

For the periods established by Ukrainian tax and accounting legislation (at least 1,095 days). Basis — legal obligation.

Booking data and contact records (correspondence, inquiries)

For the duration of the contractual relationship and 3 years after the last order (the general limitation period). Basis — legitimate interest.

AI scent profile and saved formulas

For the lifetime of the Client's account and 12 months after its closure or the last order. Basis — contract / consent.

Data for marketing newsletters

Until consent is withdrawn by the Client.

Information about allergic reactions and contraindications

Until the service (session) has been provided, unless the Client has given separate consent to retain it for future sessions. Basis — explicit consent.

Technical data and cookies

In accordance with cookie expiration periods and the User's settings (Section 7).

​

After the specified periods expire, or at the Client's request, the data is deleted or anonymized, provided there are no other legal grounds for retaining it.

The Elixir takes organizational and technical measures to protect personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, namely:

— data encryption in transit (HTTPS/TLS);

— restricted access to personal data — for authorized employees only;

— regular review and updating of security measures.

If a personal data breach is detected, The Elixir will:

— take immediate measures to contain and remedy the incident;

— notify the relevant regulatory authority within the time limits set by law (in particular, within 72 hours — in accordance with Article 33 GDPR);

— notify the Clients whose data may have been affected, where required by law.

In accordance with the Law of Ukraine “On Personal Data Protection” No. 2297-VI of June 1, 2010 and the GDPR, the Client has the following rights:

1. Right of access

The Client has the right to obtain confirmation of whether their personal data is being processed, and a copy of such data (Subject Access Request).

2. Right to rectification

The Client may request the correction of inaccurate personal data or the completion of incomplete personal data.

3. Right to erasure (“right to be forgotten”)

The Client may request the deletion of personal data if: the purpose of processing no longer applies; consent has been withdrawn; the data was processed unlawfully. This right is limited where the data is necessary to comply with a legal obligation or to assert legal claims.

4. Right to restriction of processing

The Client may request the temporary suspension of data processing if: the accuracy of the data is contested; the processing is unlawful but the Client opposes deletion; the data is no longer needed but is required by the Client for legal claims.

5. Right to data portability

The Client has the right to receive their personal data in a structured, commonly used, and machine-readable format, and to transfer it to another controller (where technically feasible).

6. Right to object

The Client may at any time object to the processing of data based on legitimate interest or carried out for marketing purposes, including profiling.

7. Right to withdraw consent

The Client may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. After consent is withdrawn, The Elixir may be unable to provide certain services (for example, AI fragrance selection).

8. Rights regarding automated decisions

The Client has the right not to be subject to a decision based solely on automated processing if such a decision has legally significant consequences for them. Regarding The Elixir's AI profiling — see Section 10 for details.

To exercise any of these rights, send a request to: hello@theelixir.ai

The Elixir may ask you to verify your identity before fulfilling a request in order to protect personal data. A response is provided within 30 calendar days.

If the Client believes that their personal data is being processed in violation of the law, they have the right to lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights — the supervisory authority for personal data protection in Ukraine.

The Commissioner's website: https://www.ombudsman.gov.ua/

For Clients located in the EU: a complaint may be lodged with the supervisory authority of the member state of the Client's residence.

Where the processing of personal data is based on consent, the consent of a child in relation to the offering of information society services to him or her is lawful if the child is 16 years old. For persons under 16 years of age, processing based on consent is only permitted with the consent of a parent or another person with parental responsibility. The Elixir does not knowingly collect personal data from persons under 16 years of age without appropriate parental consent.

The Elixir Website may contain links to third-party websites. The Elixir is not responsible for the privacy practices or content of such resources. We recommend reviewing the privacy policy of each website before providing any personal data.

The Elixir may make changes to this Policy in connection with changes in legislation, expansion of the range of services, or functional development of the Website. The current version is always published on the Website with the date of the last update.

In the event of significant changes affecting Clients' rights, The Elixir sends an additional notification to the Client's email address.

If the Client does not agree with the changes to the Policy, they have the right to stop using the services and submit a request for deletion of their personal data to: hello@theelixir.ai