Privacy Policy

1. Who is responsible for your data

AURA PURE TRADING L.L.C ("Aura Labs", "we", "us") is the controller of the personal data described in this policy.

Registered address: Office M56, Naima Hamad Abdulla Al Badr Al Muhairi Building, Naif, Deira, Dubai, United Arab Emirates Trade licence number: 1616242 Data protection contact: privacy@aura-pure.ae

If any detail above is shown as pending, it is being finalised and this policy will be updated when it is issued.

2. What we collect

Account and contact data. Your name, email address, phone number and password credentials.

Order data. Products ordered, quantities, prices, order history, delivery address and delivery zone.

Payment data. We do not receive or store your full card number. Card payments are processed on the payment provider's hosted page. We receive and retain the transaction reference, approval code, card brand, the first six digits and the issuing country, and the result of the transaction.

Application data. Where you apply for a membership, wholesale or affiliate account we collect the information requested in that form, which may include business name, intended use, and how you heard about us.

Technical data. Server logs generated when you use the site, including IP address and browser information.

We do not operate third party analytics or advertising trackers on this site.

3. Why we use it, and on what basis

To perform our contract with you: creating and maintaining your account, processing and delivering orders, taking payment, and providing customer support.

To meet legal obligations: tax and VAT records, and record keeping required of a licensed business in the UAE.

With your consent: marketing email. Consent is collected separately from your acceptance of our terms, is recorded against your contact record with the date it was given, and can be withdrawn at any time using the unsubscribe link in any marketing message or by contacting us.

For our legitimate interests: securing the site, preventing fraud and misuse, and keeping records of account approvals.

4. Who we share it with

We share personal data only with processors acting on our instructions:

• Supabase, for authentication and database hosting • Vercel, for application hosting • Cloudflare R2, for image storage • Resend, for transactional and marketing email delivery • Our payment provider, for card processing

We do not sell personal data. We do not share it with advertisers.

5. Where your data is processed

Our hosting and database providers operate infrastructure outside the United Arab Emirates. Where personal data is transferred outside the UAE, we rely on the safeguards required by UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

The specific processing regions for our hosting and database are being confirmed and this section will state them explicitly once verified.

6. How long we keep it

Account data is retained for as long as your account is open, and for up to 12 months after you close it.

Order, payment and tax records are retained for the period required by UAE tax and commercial law, currently 5 years from the end of the relevant tax period.

Marketing consent records are retained for as long as the consent is relied on, and for 12 months after it is withdrawn so that we can evidence the withdrawal.

Application records for accounts that are refused are retained for 12 months.

7. Your rights

Under UAE data protection law you may request access to your personal data, correction of inaccurate data, deletion of your data, restriction of processing, and portability of data you provided to us. You may also withdraw consent to marketing at any time and object to processing carried out on the basis of legitimate interests.

To exercise any of these rights, contact privacy@aura-pure.ae. We will respond within 30 days. You may also lodge a complaint with the UAE Data Office.

You can delete your account and its associated data yourself from your account settings.

8. Cookies

We use only cookies that are strictly necessary for the site to function: your sign-in session, your cart, and a referral cookie set for 30 days when you arrive through an affiliate link.

We do not use analytics, advertising or profiling cookies, so no cookie consent banner is required for optional cookies. If that changes, we will ask for your consent before setting any non-essential cookie.

9. Security

Access to customer data in our administration portal is restricted to authorised staff accounts. Passwords are stored hashed by our authentication provider. Card details are never held on our systems.

10. Changes to this policy

We will update this page when our processing changes. The date at the top shows when it was last revised.