Privacy Policy

1. Data controller and contact details

Thank you for visiting our online store. Below we explain how we process your personal data when you use our website. Personal data is any information that can be used to identify you.

The data controller for this website, within the meaning of the General Data Protection Regulation (EU) 2016/679 (GDPR), is:

Velour Commerce LLC
A Wyoming limited liability company
30 N Gould St Ste R, Sheridan, WY 82801, United States
Email: info@auracarbon.eu

Velour Commerce LLC operates the Aura Carbon® store and is the entity that determines the purposes and means of the processing of your personal data. Although we are established outside the European Union, the GDPR applies to our processing of the personal data of customers in the EU because we offer our products to them (Article 3(2) GDPR).

For security reasons, and to protect the transmission of personal data and other confidential content (for example, orders or inquiries), this website uses SSL/TLS encryption. You can recognize an encrypted connection by the https:// prefix and the padlock symbol in your browser's address bar.

Our store runs on the Shopify platform, operated in Europe by Shopify International Limited (Ireland), which acts as our processor and hosts the store's data.

2. Data collected when you visit the website

If you use our website for information purposes only — that is, if you do not create an account or otherwise send us information — we only collect the data that your browser sends to the server (so-called server log files):

• the page visited;
• the date and time of access;
• the amount of data transferred, in bytes;
• the source or referrer from which you reached the page;
• the browser used;
• the operating system used;
• the IP address used (in anonymized form, where applicable).

This data is technically necessary to display the website to you. The processing is based on Article 6(1)(f) GDPR, our legitimate interest in improving the stability and functionality of the website. This data is not passed on to third parties or used for any other purpose. We reserve the right to review the server log files retrospectively if there are specific indications of unlawful use.

3. Cookies and similar technologies

To make your visit to our website work and to enable certain features, we use cookies on various pages. Cookies are small text files stored on your device. Some are deleted at the end of your browser session (session cookies); others remain on your device and allow us, or our partners, to recognize your browser on your next visit (persistent cookies).

The cookies we use fall into two groups:

• Strictly necessary cookies — essential for the store to work: keeping the contents of your cart, logging in, completing payment, security and fraud prevention. Legal basis: Article 6(1)(b) GDPR (performance of a contract) or Article 6(1)(f) GDPR (legitimate interest in the functionality and security of the website).
• Analytics and marketing cookies — allow us to measure the performance of the website and of our campaigns and to show you relevant advertising. They are only set with your consent, given through the cookie banner, under Article 6(1)(a) GDPR.

You can change or withdraw your consent at any time by returning to the cookie preferences on our website. You can also set your browser to notify you whenever a cookie is set and decide case by case, or to refuse cookies in general. Please note that if you refuse cookies, some features of the store may be limited.

Instructions by browser:

• Google Chrome: support.google.com/chrome/answer/95647
• Mozilla Firefox: support.mozilla.org/kb/enable-and-disable-cookies-website-preferences
• Safari: support.apple.com/guide/safari/sfri11471
• Microsoft Edge: support.microsoft.com/microsoft-edge
• Opera: help.opera.com/en/latest/web-preferences/#cookies

4. Contact and customer support

When you contact us (through the contact form, by email, on WhatsApp or by message on social media), we collect the personal data you provide. If you use a form, the data collected is the data shown in that form. This data is stored and used exclusively to respond to your request and for the related technical administration.

The legal basis is our legitimate interest in responding to your request, under Article 6(1)(f) GDPR. If your inquiry is aimed at concluding a contract, the additional legal basis is Article 6(1)(b) GDPR. Your data is deleted once your request has been fully dealt with, unless statutory retention obligations require otherwise.

5. Customer account and order processing

Under Article 6(1)(b) GDPR, we collect and process the personal data you provide to us for the performance of a contract or for opening a customer account. The data collected is shown in the relevant forms and typically includes your name, shipping and billing address, email address, phone number and order details.

You can ask us to delete your customer account at any time by writing to the contact address given in section 1. We store and use the data you provide in order to process your order. Once the contract has been fully performed or your account has been deleted, your data is restricted, taking into account tax and commercial retention periods, and deleted once those periods have expired, unless you have expressly consented to further use.

6. Payments

We pass your payment details to the relevant bank or payment service provider to the extent necessary to process your payment. The legal basis is Article 6(1)(b) GDPR.

Depending on the payment method you choose at checkout:

• Credit or debit card (Shopify Payments) — the payment is processed by Shopify International Limited (Ireland) and Stripe Payments Europe, Limited (Ireland), acting as payment service providers.
• MB WAY (Portugal) — the payment is processed by our payment service provider and the SIBS MB WAY network; you will be asked for the mobile number linked to your MB WAY account so that you can confirm the transaction in the app.
• PayPal — if you choose PayPal, including card payment or direct debit through PayPal, your payment details are passed to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal reserves the right to carry out a credit check. You can object to this processing at any time by contacting PayPal directly.
• Klarna — if you choose Klarna, your data is passed to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, which may carry out a credit and identity check to decide on the installment or deferred payment method. Processing by Klarna is governed by Klarna's own privacy policy.
• Apple Pay and Google Pay — the payment is processed by Apple Inc. or Google Ireland Limited, together with our payment service provider, which receives an identifier for your card (a token) instead of the full card number.

We do not store your full payment card number in our systems.

7. Shipping your order and suppliers

We pass your contact and delivery details to the carriers and logistics providers responsible for delivery, to the extent necessary to deliver your products. The legal basis is Article 6(1)(b) GDPR. This includes:

• our logistics partners and the local postal carriers used for delivery in your country;
• our production and fulfillment partner, which prepares and ships orders and receives the recipient's name, delivery address and contact details. Our items are produced and shipped from China, outside the European Economic Area — see section 11.

When your order is shipped, your email address and phone number may be used to send you delivery tracking notifications.

8. Direct marketing

8.1 Email newsletter

If you subscribe to our newsletter, we will regularly send you information about our new products and offers. The only information required for sending it is your email address.

We use the double opt-in procedure: we only send the newsletter once you have expressly confirmed, through the link we email to you, that you agree to receive it. By clicking that link, you consent to the use of your personal data under Article 6(1)(a) GDPR. When you subscribe, we store the IP address assigned by your internet service provider and the date and time of registration as proof of consent.

Our emails are sent through our email marketing provider, Klaviyo, Inc. (USA), which acts as our processor. You can unsubscribe at any time using the link included in every message. Once you unsubscribe, your email address is immediately removed from our mailing list.

8.2 Messages to existing customers

If you gave us your email address when buying products, we reserve the right to send you regular email offers for products similar to those you have already purchased. We do not need your separate consent for this: the processing is based solely on our legitimate interest in personalized direct advertising, under Article 6(1)(f) GDPR, as permitted by Article 13(2) of the ePrivacy Directive 2002/58/EC as implemented in national law. You have the right to object at any time, with effect for the future, to the use of your email address for advertising purposes.

8.3 Abandoned carts

If you entered your email address during checkout but did not complete your order, we may send you one or more reminders about the items left in your cart. These messages are sent with your consent under Article 6(1)(a) GDPR, or on the basis of the legitimate interest described in section 8.2 if you are already a customer. You can object at any time.

9. Website analytics (Google Analytics 4)

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies and similar identifiers that make it possible to analyze how the website is used. The information generated is transmitted to Google and used on our behalf to evaluate your use of the website, compile reports on website activity and provide other services relating to website and internet use.

We use Google Analytics with IP anonymization enabled, so your IP address is truncated before it is stored and cannot be directly linked to you. The IP address sent by your browser as part of Google Analytics is not merged with other Google data.

Where applicable, we also use cross-device analytics features through a user identifier (User ID). This identifier is assigned on your first visit, is pseudonymized and does not contain any data that directly identifies you.

This processing is based on your consent under Article 6(1)(a) GDPR, given in the cookie banner, which you can withdraw at any time. You can also prevent data collection by installing the Google Analytics opt-out browser add-on: tools.google.com/dlpage/gaoptout

10. Advertising, remarketing and conversion tracking

We work with advertising platforms that allow us to show our offers to people who are interested in them and to measure the results of our campaigns. All the technologies described in this section are only activated with your consent under Article 6(1)(a) GDPR, which you can withdraw at any time in the cookie preferences.

10.1 Meta Pixel and Conversions API (Facebook and Instagram)

This website uses the Meta Pixel and the Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. This technology tells us which actions were taken on the website after a user saw or clicked an ad on Facebook or Instagram — for example, viewing a product, adding it to the cart or completing a purchase — so that we can measure the effectiveness of our ads for statistical and market research purposes, and show ads to similar audiences.

Through the Conversions API, certain event data (including, in encrypted form, the email address or phone number you gave us when you made a purchase) may be sent to Meta from our server for event matching purposes. The data returned to us is aggregated and anonymous to us, but it is stored and processed by Meta, which acts as an independent controller for part of this processing. Consent to the use of the Meta Pixel can only be given by users over the age of 13.

10.2 Google Ads — conversion tracking and remarketing

This website uses Google Ads, including its conversion tracking and remarketing features, provided by Google Ireland Limited. A cookie is placed in your browser when you click on one of our Google ads, allowing us to see whether the visit led to a purchase, and allowing advertising to be shown to you based on interests inferred from the pages you visited, using a pseudonymized cookie identifier. These cookies usually expire after a limited period and are not used to identify you personally.

Your data is only processed more extensively if you have allowed Google to link your web and app browsing history to your Google account.

10.3 TikTok Pixel

This website uses the TikTok Pixel of TikTok Information Technologies UK Limited and TikTok Technology Limited (Ireland), for the same purpose: to measure the results of our ads on TikTok and to show relevant ads to similar audiences. Event data is sent to TikTok, which processes it in accordance with its own privacy policy.

11. International data transfers

Some of the providers we use are based outside the European Economic Area (EEA), or process data outside it — in particular in the United States of America, the United Kingdom and China. In addition, Velour Commerce LLC, as the data controller, is established in the United States, so your personal data is also accessed by us from the United States.

In these cases, the transfer is based on one of the following safeguards provided for in Chapter V of the GDPR:

• an adequacy decision of the European Commission, in particular the decision on the United Kingdom and the EU–US Data Privacy Framework, where the US provider is certified under that framework;
• standard contractual clauses approved by the European Commission, supplemented where necessary by additional technical and organizational measures, such as encryption and minimization of the data transferred.

In particular, sharing the recipient's name, address and contact details with our production and fulfillment partner outside the EEA is necessary for the performance of the sales contract, under Article 6(1)(b) and Article 49(1)(b) GDPR. You can ask us for a copy of the applicable safeguards using the contact details given in section 1.

12. Retention periods

How long we keep personal data is determined by the applicable statutory periods, in particular:

• order, invoicing and accounting data — kept for the statutory tax and commercial retention period of 10 years from the end of the financial year to which the data relates;
• customer account data — kept for as long as the account exists and, after that, only for the period stated in the previous point;
• contact and customer support data — deleted once your request has been resolved, unless a legal obligation requires otherwise;
• newsletter subscription data — kept for as long as your subscription is active; proof of consent is kept for as long as necessary to demonstrate compliance;
• analytics and advertising cookies and identifiers — kept for the period stated in our cookie banner and, in any case, no longer than the lifetime of each cookie.

Once the relevant period has expired, the data is routinely deleted, provided it is no longer needed to perform or prepare a contract and there is no remaining legitimate interest in keeping it.

13. Your rights

Data protection law gives you extensive rights against the data controller regarding the processing of your personal data:

• Right of access (Article 15 GDPR) — the right to obtain information about your personal data processed by us, the purposes of the processing, the categories of data, the recipients and the envisaged retention period, among other things.
• Right to rectification (Article 16 GDPR) — the right to have inaccurate data we hold about you corrected without delay and incomplete data completed.
• Right to erasure (Article 17 GDPR) — the right to ask us to delete your personal data where the conditions of Article 17(1) GDPR are met.
• Right to restriction of processing (Article 18 GDPR) — the right to ask us to restrict the processing of your personal data.
• Right to be informed about recipients (Article 19 GDPR) — the right to be told which recipients your data has been disclosed to.
• Right to data portability (Article 20 GDPR) — the right to receive your personal data in a structured, commonly used and machine-readable format.
• Right to withdraw consent (Article 7(3) GDPR) — the right to withdraw your consent at any time, with effect for the future.
• Right to lodge a complaint (Article 77 GDPR) — the right to lodge a complaint with a supervisory authority.

To exercise any of these rights, simply send a message to info@auracarbon.eu. We will reply within one month of receiving your request; this period may be extended in accordance with Article 12(3) GDPR.

14. Right to object

Objection on grounds relating to your particular situation. Where we process your personal data on the basis of our overriding legitimate interest, following a balancing of interests, you have the right to object to that processing at any time, with effect for the future, on grounds relating to your particular situation. If you exercise this right, we will stop processing the data concerned. However, we may continue the processing if we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defense of legal claims.

Objection to direct marketing. Where we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of your data for that purpose. If you exercise this right, we will stop processing the data concerned for direct marketing purposes, without you having to give any reason.

15. Supervisory authority

If you believe that the processing of your data infringes data protection law, you can lodge a complaint with a data protection supervisory authority, in particular the authority of the EU member state of your habitual residence, your place of work or the place of the alleged infringement. Contact details for all EU supervisory authorities are available on the website of the European Data Protection Board: edpb.europa.eu

16. Changes to this policy

We may update this privacy policy to reflect changes to our services, to the technologies we use or to the applicable law. The version in force is always the one published on this page, showing the date of the last update. We recommend that you check it from time to time.