Privacy Policy

1. Scope

This Policy applies to the processing of personal data of customers, website visitors, subscribers and other persons whose data we process in the course of our business, in particular:

• visitors to our website https://aurelyco.com and other related sites where this Policy is referenced;
• customers who purchase products from us;
• persons who contact us by email, through forms or by other means;
• persons who subscribe to our marketing communications.

2. Definitions

Personal data — any information relating to an identified or identifiable natural person.

Processing — any operation performed on personal data, whether or not by automated means.

Controller — the person who determines the purposes and means of processing.

Processor — a person who processes personal data on behalf of the controller.

GDPR — Regulation (EU) 2016/679, and where applicable its UK equivalent.

3. Purposes and legal bases of processing

3.1 Performance of a contract and pre-contractual steps

When you order our products we process your data in order to conclude and perform the contract, including related communication, delivery, returns and refunds.

Legal basis: Article 6(1)(b) GDPR.

Data processed: identification data (first name, surname); contact details (email, delivery address, telephone number); order details (products, quantity, price, date, payment method); payment and billing data; delivery and tracking data; correspondence relating to returns, complaints and refunds.

3.2 Compliance with legal obligations

We process your data to comply with obligations arising from applicable legislation, in particular accounting, tax and consumer protection law.

Legal basis: Article 6(1)(c) GDPR.

Data processed: identification data; billing and payment data; other records we are required to keep by law.

3.3 Legitimate interests

We process personal data on the basis of our legitimate interests in order to:

• protect and enforce our rights, including in the event of a dispute, chargeback or payment dispute;
• prevent fraud and abuse, including verification of orders, addresses and payment methods;
• ensure the security and functionality of our website;
• improve our products and customer support;
• send direct marketing to existing customers about similar products.

Legal basis: Article 6(1)(f) GDPR. You may object to processing based on legitimate interests at any time — see section 12.

3.4 Consent

In some cases we rely on your consent, for example for:

• sending newsletters and commercial offers where you subscribed on the website and are not an existing customer;
• storing and accessing information on your device through analytical and marketing cookies;
• other marketing activities requiring consent.

Legal basis: Article 6(1)(a) GDPR. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before it.

4. Categories of personal data

Identification and contact data. First name and surname; delivery and billing address; email address; telephone number.

Order and transaction data. Ordered goods, quantity and price; date and time of the order; payment method and transaction identifiers; delivery and tracking data; returns, refunds and complaint history.

Technical and usage data. IP address; browser type and version; device type and operating system; access times; approximate location derived from IP; referral source and campaign parameters of the link through which you reached the site.

Communication data. Content of emails, contact and cancellation forms; records of our correspondence with you; product reviews and feedback you submit.

Marketing data. Newsletter subscription status; email opens and clicks where you consented to such tracking; audience and targeting data used for advertising, only where permitted by law.

5. Sources of personal data

We obtain your personal data primarily directly from you: through forms on the website, when you place an order, when you subscribe to newsletters, and through correspondence.

We also receive data from:

• payment service providers and banks, in connection with payment authorisation, verification and disputes;
• carriers, in connection with delivery status, delivery attempts and returned parcels;
• advertising and affiliate partners, where you reached our website through their link;
• analytics and cookie-based tools, as described in section 10.

6. Recipients and processors

We share personal data with the following categories of recipients.

Payment service providers. Depending on the payment method you choose, your data is transmitted to Mollie B.V. (Netherlands), Stripe, PayPal and Klarna Bank AB (publ) (Sweden). Klarna acts as an independent controller for its own assessment of your eligibility for its payment methods; its privacy notice is available at https://www.klarna.com/privacy-policy/.

Order management platform. Our order and customer records are held in the CheckoutChamp e-commerce platform, which processes order and customer data on our behalf.

Carriers and fulfilment. Your name, delivery address, telephone number and email are transmitted to the carrier handling your parcel — international carriers (DHL, DPD, UPS) and local partners in the destination country, listed on our Shipping & Returns page — and to our fulfilment warehouse in the Netherlands.

Advertising and affiliate partners. Where you reached our website through an advertising partner's link, campaign and conversion data is used to attribute and settle that referral with the partner concerned.

Communication and marketing service providers. Klaviyo (email marketing and transactional email) and Twilio (SMS and messaging) process your contact details in order to send the communications you have subscribed to or that relate to your order. We also use customer support tools and other IT service providers necessary to operate the website.

Professional advisers. Accountants, tax advisers and auditors, and legal advisers where necessary to establish, exercise or defend legal claims.

Public authorities, where we are required to disclose data by law.

We enter into a data processing agreement with each processor in accordance with Article 28 GDPR.

7. Automated decision-making and profiling

Where you select a Klarna payment method, Klarna carries out an automated assessment of your eligibility for that method, which may include a credit or risk check. That assessment is made by Klarna as an independent controller and may result in a particular payment option not being offered to you. It does not affect your ability to complete the order using another available payment method. Information on the logic involved and your rights in relation to that assessment is set out in Klarna's privacy notice.

We also apply automated fraud checks to orders, which may result in an order being placed on hold, referred for manual verification or cancelled with a full refund. Any decision to cancel an order is subject to human review before it takes effect.

8. Transfers outside the European Economic Area

We are established in the United Kingdom, and some of our processors are established outside the European Economic Area. This means your personal data is transferred outside the EEA in the course of ordinary processing.

Such transfers take place only on one of the following bases:

• an adequacy decision of the European Commission under Article 45 GDPR — this covers transfers to the United Kingdom;
• appropriate safeguards under Article 46 GDPR, in particular the European Commission's standard contractual clauses together with supplementary measures where required;
• your explicit consent under Article 49(1)(a) GDPR, where no other basis applies.

You may request further information about the specific mechanism applied to a given transfer by contacting us.

9. Retention periods

We retain personal data only for as long as necessary for the purposes for which it was collected, or for the period required by law:

• accounting and tax records, including invoices — six (6) years from the end of the relevant financial year, in accordance with United Kingdom accounting and tax requirements;
• contract and order data — for the duration of the contract and six (6) years thereafter, covering the statutory guarantee period and the limitation period for claims;
• complaint, return and dispute records — six (6) years from closure of the matter;
• marketing data — until consent is withdrawn or an objection is made, and in any event no longer than three (3) years from the last contact;
• data processed on the basis of legitimate interests — for as long as that interest applies, as a rule no longer than five (5) years;
• technical and cookie data — for the retention periods stated in our cookie settings.

After the retention period expires we delete or anonymise the data.

10. Cookies and tracking technologies

Our website uses essential cookies for basic functions, together with analytical and marketing cookies.

Essential cookies. Always active; required for the website, the basket and payment to function securely.

Analytical cookies. Traffic measurement and analysis of how the website is used.

Marketing cookies. Advertising measurement, remarketing and personalisation. On our website this is the Meta pixel (Facebook and Instagram), which allows us to measure the results of our advertising and to show ads to relevant audiences.

Affiliate and campaign tracking. Where you reach our website through an advertising partner's link, a parameter identifying that partner is stored so that the referral can be attributed and settled.

Your consent. By submitting a form or placing an order on our website, you agree to the use of analytical and marketing cookies as described above. You can disable or delete cookies at any time through your browser settings, and you can object to marketing processing at any time using the contact details in section 16. Disabling certain categories may affect how the website functions.

Klarna cookies. If you use a Klarna payment method, cookies may be set by Klarna as part of the checkout process. They enable Klarna to offer you the appropriate payment options and to ensure a secure payment process, and may be used to analyse user behaviour and link it to technical data such as browser type, device and IP address for fraud prevention and payment eligibility assessment. See Klarna's privacy notice for details. https://www.klarna.com/privacy-policy/

11. Reviews and published content

Where you send us feedback about a product by email, we may publish it on our website as a review, together with your first name or your initials. We publish reviews only from verified customers who have actually purchased the product, and we do not remove genuine negative reviews. You may ask us to withdraw a published review at any time using the contact details in this Policy.

12. Your rights

You have the following rights, which you may exercise at any time by contacting us:

Access (Article 15). To obtain confirmation whether we process your data, a copy of it, and information about how it is processed.

Rectification (Article 16). To have inaccurate data corrected and incomplete data completed without undue delay.

Erasure (Article 17). To have your data deleted where it is no longer necessary, where you withdraw consent and no other basis applies, where you object and there are no overriding grounds, where it was processed unlawfully, or where deletion is required by law. This right does not apply where we must continue processing, for example to meet a legal obligation or to defend legal claims.

Restriction (Article 18). To have processing restricted while accuracy is contested, where processing is unlawful but you prefer restriction to erasure, where we no longer need the data but you require it for legal claims, or while an objection is being assessed.

Data portability (Article 20). To receive the data you provided to us in a structured, commonly used, machine-readable format and to have it transmitted to another controller, where processing is based on consent or a contract and carried out by automated means.

Objection (Article 21). To object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. Where you object to direct marketing, we stop processing your data for that purpose without exception.

Withdrawal of consent. To withdraw consent at any time, without affecting the lawfulness of prior processing.

Complaint to a supervisory authority. If you believe our processing infringes data protection law, you may lodge a complaint with a supervisory authority — in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The European Data Protection Board publishes contact details for the national authorities. In the United Kingdom the competent authority is the Information Commissioner's Office (ico.org.uk).

We respond to requests without undue delay and in any event within one month, which may be extended by two further months for complex requests; we will inform you if an extension applies.

13. Data security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including, as applicable: pseudonymisation and encryption of personal data; measures ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems; measures to restore availability and access to data in the event of a physical or technical incident; and regular testing and evaluation of the effectiveness of those measures.

Transmission of data over the internet is not completely secure and we cannot guarantee absolute security of data transmitted to our website.

14. Children

Our products are sold only to persons aged 18 or over, and our website is not intended for children. We do not knowingly collect personal data from children under 16. Where the law of your country sets a lower age of digital consent, that age applies to consent-based processing. If we become aware that we hold data of a child without the required consent, we will delete it.

15. Changes to this Policy

We may update this Policy to reflect changes in our practices or for legal or regulatory reasons. The updated version is published on our website with its effective date. Where changes are significant we may notify you by email or by a prominent notice on the website. We retain previous versions and provide them on request.

16. Contact

Please send any question, request or complaint concerning personal data to the address above.