Privacy Policy

Last updated: September 2026

This Privacy Policy explains how AURA Maison collects, uses, retains and protects the personal data of users and customers of the website auramaison.pt.

AURA Maison is committed to processing personal data lawfully, transparently and securely, in accordance with the General Data Protection Regulation — Regulation (EU) 2016/679, the GDPR — and applicable Portuguese law.

1. Data controller

The controller of personal data collected through this website is:

AURA Maison

The GDPR requires data subjects to be informed of the controller’s identity and contact details.

2. Personal data we may collect

Depending on how you use the website, we may collect different categories of personal data.

Data provided by the Customer

When you place or attempt to place an order, we may collect:

• name;
• email address;
• billing address;
• delivery address;
• postal code;
• city and country;
• information required for invoicing;
• information about the order;
• information voluntarily provided through contact forms.

If a telephone number is requested for delivery by the carrier, it will be used only for purposes necessary to process and deliver the order.

Payment data

Payments may be processed by third parties, such as PayPal, JumpPay or other payment service providers available in the store.

AURA Maison does not need to receive or store the Customer’s full payment card details when those details are processed directly by the relevant payment provider.

Each payment provider may process personal data in accordance with its own privacy policy.

Technical and browsing data

When you visit the website, certain technical data may be collected automatically, including:

• IP address;
• browser type;
• device type;
• operating system;
• language;
• date and time of access;
• pages viewed;
• the source of the visit to the website;
• data relating to interactions with the store.

Some of this data may be collected through cookies or similar technologies.

3. Purposes of processing

Personal data may be processed for the following purposes:

• processing and managing orders;
• receiving and confirming payments;
• preparing and dispatching orders;
• issuing invoices and other mandatory documents;
• communicating with the Customer about their order;
• providing customer support;
• managing returns, exchanges and refunds;
• preventing fraud and abuse;
• complying with legal, tax and accounting obligations;
• ensuring the operation and security of the website;
• improving the experience of using the store;
• sending marketing communications where there is a legal basis to do so.

4. Legal bases for processing

We process personal data only when there is a legal basis for doing so.

Depending on the circumstances, processing may be based on:

Performance of a contract: when the data is necessary to process an order, payment, delivery, return or request related to a purchase.

Compliance with legal obligations: when certain data must be retained for tax, accounting or other reasons under applicable law.

Legitimate interests: when necessary, for example, to protect the website, prevent fraud or improve our services, provided that the data subject’s rights and freedoms do not override those interests.

Consent: when legally required, particularly for certain marketing communications or non-essential cookies.

Consent must be freely given, specific, informed and unambiguous, and it must be as easy to withdraw as it was to give.

5. Sharing data with third parties

AURA Maison may share personal data only with entities whose involvement is necessary for the store to operate or for an order to be fulfilled.

These may include:

• the ecommerce platform;
• payment service providers;
• carriers and logistics providers;
• invoicing and accounting services;
• hosting and technology service providers;
• website analytics services, where used;
• public authorities, where required by law.

These entities receive only the data necessary to provide their respective services.

For example, a carrier may receive a name, delivery address and other data strictly necessary to deliver an order.

6. Google Analytics and similar tools

If AURA Maison uses Google Analytics or similar analytics tools, these may collect data about website use through cookies or equivalent technologies.

The use of cookies for analytics purposes may require the user’s prior consent. Portugal’s data protection authority, the CNPD, considers analytics cookies subject to information and consent requirements where applicable.

7. Cookies

The website may use cookies necessary for its operation, as well as other categories of cookies.

These may include, for example:

• strictly necessary cookies, essential for the shopping cart, checkout or session to function;
• preference cookies, which save certain user choices;
• analytics cookies, used to understand how the website is used;
• marketing cookies, used to measure campaigns or display personalised advertising, where applicable.

Cookies that are not strictly necessary will be used only where the consent required by law has been obtained.

The CNPD states that the website controller must inform users and obtain prior consent when required, particularly in relation to analytics cookies.

Users may manage or withdraw their consent through the cookie management mechanism available on the website.

8. Marketing communications

AURA Maison may send communications about news, products or promotions only where there is an appropriate legal basis.

Where such communications rely on consent, the Customer may withdraw it at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Users must be able to opt out of future marketing communications easily. The CNPD states that consent to promotional communications must be obtained in advance, be explicit and be easy to withdraw.

9. International data transfers

Some technology service providers may process data outside the European Economic Area.

Where this occurs, AURA Maison will seek to use providers that adopt legally recognised mechanisms to ensure an adequate level of protection for personal data.

This policy does not assume that data is automatically transferred to any particular country. Any transfer will depend on the providers actually used by the store.

10. Data retention

Personal data will be retained only for as long as necessary for the purposes for which it was collected.

Certain data relating to orders, invoicing and payments may be retained for longer periods when required by tax, accounting or legal obligations.

Data used for marketing will be retained while there is a legal basis for processing it or until the data subject withdraws consent, where consent is the applicable legal basis.

The GDPR requires data subjects to be informed of the retention period or, where an exact period cannot be determined, the criteria used to determine it.

11. Data subject rights

Under the GDPR, data subjects may exercise the following rights where applicable:

• access to their personal data;
• correction of inaccurate or incomplete data;
• erasure of data;
• restriction of processing;
• objection to processing;
• data portability;
• withdrawal of consent where processing is based on consent.

The exercise of these rights may be subject to the conditions and exceptions provided for by applicable law.

To exercise any of these rights, contact:

aura.maison@outlook.com

The GDPR expressly provides for the rights of access, rectification, erasure, restriction, objection and portability.

12. Data protection complaints

If you believe that your personal data is not being processed in accordance with applicable law, you have the right to lodge a complaint with the competent supervisory authority.

In Portugal:

Comissão Nacional de Proteção de Dados — CNPD

The right to lodge a complaint with a supervisory authority is provided for by the GDPR.

13. Data security

AURA Maison seeks to use appropriate technical and organisational measures to protect personal data against:

• unauthorised access;
• alteration;
• disclosure;
• loss;
• destruction;
• misuse.

However, no electronic transmission or storage system can guarantee absolute security.

14. Children

The AURA Maison store sells homeware and is not specifically directed at children.

We do not intentionally seek to collect personal data from minors through the website.

If we become aware that a minor’s personal data has been provided inappropriately, steps may be taken to delete it where legally applicable.

15. Links to third-party websites

The website may contain links to external services or websites.

AURA Maison does not control the privacy practices of these third parties, so we recommend reading their privacy policies before providing them with personal data.

16. Changes to this Privacy Policy

This Privacy Policy may be updated whenever necessary, including to reflect:

• changes in legislation;
• changes to the services used by the store;
• new payment methods;
• new website features;
• changes in the way data is processed.

The latest version will always be available at auramaison.pt.

17. Contact

For questions about this Privacy Policy or the processing of your personal data, contact:

AURA Maison
Email: aura.maison@outlook.com