Privacy Policy
This Privacy Policy explains how OMNITRADE HORIZONS LIMITED (ABN [to be confirmed]), trading as AURELLE (“we”, “us”, “our”), collects, uses, discloses and protects your personal information when you visit https://aurelle-vip.com or buy from us.
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we serve customers in the European Economic Area or the United Kingdom we also apply the GDPR/UK GDPR standards described in section 10.
1. Who is responsible for your data
- Data controller / APP entity: OMNITRADE HORIZONS LIMITED (ABN [to be confirmed])
- Address: [to be confirmed]
- Privacy contact: [email protected]
2. What we collect
Information you give us
- Order details — name, email address, phone number, delivery address, billing address.
- Account details — email address, password (stored only as a salted hash), order history, saved addresses, wishlist.
- Communications — the content of emails, contact-form messages and reviews you send us.
- Marketing preferences — whether you have subscribed to our newsletter, and your sizing or style preferences if you tell us.
- Returns information — reason for return and bank or payment details where a refund cannot be issued to the original method.
Information collected automatically
- IP address, browser type and version, device type, operating system and screen size.
- Pages viewed, products viewed, referring URL, and the date and time of your visit.
- Cookies and similar technologies — see our Cookie Policy.
Payment information
We do not collect or store your full card number, expiry date or security code. Card data is captured directly by Stripe and PayPal in a hosted, PCI DSS compliant field and never passes through our servers. We receive only a payment token, the last four digits, the card brand, and the authorisation result — enough to identify the payment, issue refunds and investigate disputes.
If you pay with PayPal, PayPal shares with us your name, email address and the delivery address confirmed in your PayPal account.
Information we do not seek
We do not collect sensitive information as defined in the Privacy Act (such as health, racial or ethnic origin, political or religious beliefs) and ask that you do not send it to us. Our Site is not directed at children under 16 and we do not knowingly collect their personal information.
3. Why we collect it and our lawful basis
| Purpose | Information used | Basis |
|---|---|---|
| Process and deliver your order, handle returns and refunds | Order, contact and payment token data | Performance of our contract with you |
| Send transactional email (order confirmation, dispatch, refund) | Name, email, order data | Performance of our contract |
| Provide customer service | Contact and order data, message content | Performance of our contract / legitimate interests |
| Detect and prevent fraud, chargeback abuse and card testing | IP address, device data, order and payment metadata | Legitimate interests / legal obligation |
| Maintain accounting and tax records | Order and invoice data | Legal obligation |
| Improve the Site and our range | Aggregated analytics data | Legitimate interests / consent for non-essential cookies |
| Send marketing emails | Name, email, purchase history | Your consent (opt-in), withdrawable at any time |
If you choose not to provide the information needed to fill an order, we will not be able to process that order.
4. Who we share it with
We do not sell your personal information and we do not disclose it for third-party advertising. We share it only with the following categories of recipient, and only as far as they need it:
- Payment providers — Stripe and PayPal, to authorise payments, issue refunds and resolve disputes. Each is an independent controller of the payment data it collects and applies its own privacy policy (Stripe, PayPal).
- Carriers — Australia Post and Aramex, to deliver your parcel and provide tracking. They receive your name, address and phone number.
- Hosting and IT providers — our web host, email service and backup provider.
- Analytics providers — Google Analytics, only where you have accepted analytics cookies.
- Professional advisers — accountants and lawyers, where reasonably required.
- Law enforcement and regulators — where we are required or authorised by law to disclose.
- A buyer of our business — if we sell or restructure the business, subject to equivalent privacy protections.
5. Overseas disclosure
Our systems and some of our service providers store data in Singapore and Australia. Our payment providers operate globally and may process payment data in the United States, Ireland and Singapore. Where we disclose personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including by contract.
6. How long we keep it
- Order and invoice records — 7 years from the end of the financial year, as required by Australian tax law.
- Account data — while your account is open, then 12 months after you close it.
- Customer service correspondence — 24 months.
- Marketing list — until you unsubscribe, then we keep a suppression record so we do not email you again.
- Analytics data — 14 months.
- Fraud prevention records — up to 6 years where an incident occurred.
When we no longer need personal information we destroy or de-identify it.
7. How we protect it
- The entire Site is served over TLS (HTTPS); payment pages are additionally protected by our providers’ PCI DSS Level 1 environment.
- Passwords are stored as salted hashes, never in plain text.
- Administrative access is restricted, individually accounted for, and protected by strong authentication.
- Databases are backed up daily and backups are encrypted at rest.
- Staff and contractors are bound by confidentiality obligations.
No method of transmission or storage is completely secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
8. Marketing and unsubscribing
We only send marketing email if you have opted in. Every marketing email carries a working unsubscribe link that takes effect within 5 business days, as required by the Spam Act 2003 (Cth). Unsubscribing from marketing does not stop transactional emails about an order you have placed.
9. Your rights
You may ask us to:
- Access the personal information we hold about you;
- Correct anything inaccurate, out of date or incomplete;
- Delete your information, where we are not required to keep it by law;
- Stop using it for marketing, or withdraw a consent you previously gave;
- Receive a copy of the information you gave us, in a portable format;
- Object to or restrict processing based on our legitimate interests.
Email [email protected]. We may ask you to verify your identity. We respond within 30 days and do not charge for a reasonable request.
We do not use automated decision-making or profiling that produces legal or similarly significant effects for you.
10. Visitors from the EEA, the UK and California
EEA / UK: where the GDPR or UK GDPR applies, the lawful bases are those set out in section 3, and you additionally have the right to lodge a complaint with your local supervisory authority.
California: we do not sell or share personal information as those terms are defined in the CCPA/CPRA, and we do not offer financial incentives in exchange for personal information. California residents may exercise the rights in section 9 without discrimination.
11. Complaints
If you think we have mishandled your personal information, email [email protected] with the subject line “Privacy complaint”. We acknowledge complaints within 5 business days and aim to resolve them within 30 days.
If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC): oaic.gov.au/privacy/privacy-complaints, phone 1300 363 992.
12. Changes to this policy
We may update this policy. The “last updated” date at the top shows when it last changed. If we make a material change we will tell you by email or by a prominent notice on the Site before it takes effect.
13. Contact
Privacy Officer, OMNITRADE HORIZONS LIMITED
[to be confirmed]
Email: [email protected]