Privacy Policy

1. Who We Are?

Aura&Raíz (“we,” “us,” “our,” or the “Company”) respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you visit our website, place an order, communicate with us, or otherwise use our online store.

Aura&Raíz operates an online store specializing in beauty and fashion products using a dropshipping business model. Our website is hosted on Wix, and payments are accepted through PayPal and credit card payment services.

This Privacy Policy is intended to comply with applicable privacy and data protection laws, including, where applicable, the European Union General Data Protection Regulation (GDPR), the UK GDPR, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable privacy legislation.

By using our website, you acknowledge that you have had the opportunity to read this Privacy Policy. Where consent is legally required, we will request it separately and will not treat your mere use of the website as consent.

 

2. Data Controller and Contact Information

For the purposes of the GDPR, Aura&Raíz acts as the data controller for personal information processed in connection with our online store, except where a service provider independently determines the purposes and means of its processing under applicable law.

Business name: Aura&Raíz
Location: Toronto, Ontario, Canada
Email: murillofrank745@gmail.com
Telephone: +1 (647) 574-9588

For privacy-related questions, requests to exercise your rights, or complaints concerning the handling of your personal information, please contact us using the details above.

Where required by applicable law, we will designate a representative in the European Union or United Kingdom and provide the relevant contact details. We will also provide the contact details of a Data Protection Officer if we are legally required to appoint one.

 

3. Personal Information We Collect

We collect only the personal information reasonably necessary for our business purposes, subject to applicable legal requirements.

 

3.1 Information You Provide Directly

Depending on how you interact with our store, we may collect:

• Identity information: Your first name, last name, and other identifying details you provide.

• Contact information: Your email address, telephone number, billing address, and shipping address.

• Order information: Products purchased, quantities, order numbers, order history, order status, delivery preferences, and returns or refund information.

• Payment-related information: Payment status, transaction references, payment method, and other information provided by our payment processors. We generally do not receive or store complete credit card numbers or security codes when payment processing is handled by third parties.

• Customer service communications: Messages, questions, complaints, and other information you provide when contacting us.

• Marketing preferences: Your choices regarding promotional emails, newsletters, and other marketing communications.

• Account information: Login details and account preferences, if you choose to create an account.

Please do not submit sensitive personal information through our website unless specifically requested and lawfully necessary.

 

3.2 Information Collected Automatically

When you visit our website, certain information may be collected automatically, depending on your browser, device, and privacy settings:

• Internet Protocol (IP) address.

• Browser type and version.

• Device type, operating system, and general technical identifiers.

• Website pages viewed, referral sources, and navigation activity.

• Dates, times, and duration of visits.

• Cookie identifiers and similar tracking information.

• Website performance, security, and diagnostic data.

Where required by law, non-essential tracking technologies will only operate after you have provided valid consent.

3.3 Information Received from Third Parties

We may receive relevant information from third parties involved in fulfilling your order or providing services to our store, including:

• Wix and its relevant website or ecommerce services.

• PayPal and the payment providers processing credit card transactions.

• Dropshipping suppliers, manufacturers, fulfillment partners, and shipping carriers.

• Fraud prevention and transaction verification providers.

• Analytics, advertising, and marketing providers, where enabled and permitted.

• Public authorities or other parties where disclosure is legally required.

The information received depends on the services used and the particular transaction.

 

4. Purposes and Legal Bases for Processing

We process personal information for specific, legitimate purposes and rely on an appropriate legal basis under Article 6 of the GDPR whenever the GDPR applies.

PurposeLegal basis under the GDPR

Processing and delivering ordersPerformance of a contract

Accepting payments and issuing refundsPerformance of a contract and, where applicable, legal obligations

Responding to customer inquiriesContractual necessity or legitimate interests, depending on the inquiry

Maintaining transaction and accounting recordsCompliance with legal obligations

Detecting fraud and protecting website securityLegitimate interests, subject to applicable balancing requirements

Improving website functionality and customer experienceConsent or legitimate interests, depending on the technology and applicable law

Sending promotional emails to customersConsent or another lawful basis where expressly permitted by applicable law

Using non-essential advertising or analytics cookiesConsent where required by applicable law

Managing legal claims and disputesLegitimate interests and, where applicable, legal obligations

Our legitimate interests may include protecting our business against fraud, maintaining secure systems, improving our services, and establishing or defending legal claims. We will consider your rights and interests before relying on legitimate interests.

Where we rely on consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

If you do not provide information necessary to fulfill an order, we may be unable to process or deliver your purchase.

 

5. How We Use Your Personal Information

We may use your personal information to:

1. Operate and maintain our online store.

2. Process orders, payments, refunds, returns, and exchanges.

3. Forward necessary order details to dropshipping suppliers and fulfillment partners.

4. Arrange shipping and provide order tracking information.

5. Respond to customer service requests and resolve complaints.

6. Maintain business, accounting, tax, and transaction records.

7. Detect, prevent, and investigate fraudulent transactions or unauthorized activities.

8. Improve our website, products, services, and customer experience.

9. Send promotional communications where legally permitted and where any required consent has been obtained.

10. Comply with applicable laws, regulatory requirements, court orders, and lawful requests.

11. Establish, exercise, or defend legal claims.

We will not use your personal information for materially different purposes without providing any additional information or obtaining any additional consent required by law.

 

6. Cookies and Similar Technologies

Our website may use cookies, pixels, tags, local storage, and similar technologies to operate the store and understand how visitors interact with it.

Cookies are small files stored on your device that can help websites remember preferences, maintain sessions, and recognize returning visitors.

 

6.1 Types of Cookies

Strictly necessary cookies

These cookies are needed for core website functions, such as security, shopping cart operations, checkout, session management, and payment-related functionality. They are used where necessary to provide the service you request or for another applicable lawful purpose.

Functional cookies

These cookies may remember preferences, language settings, or other choices to improve your experience. Where required, we will request consent before using them.

Analytics and performance cookies

These technologies may help us understand website traffic, identify technical issues, and improve store performance. Where required by law, they will only be activated after you provide consent.

Advertising and marketing cookies

If we use advertising or remarketing technologies, these may help measure advertising effectiveness or show relevant promotions. Such technologies will be used only where legally permitted and, where required, after obtaining your consent.

 

6.2 Managing Cookie Preferences

You can manage non-essential cookies through the cookie consent banner or preference settings available on our website, where implemented.

You can also manage or delete cookies through your browser settings. Blocking certain cookies may affect website functionality, including checkout or other essential services.

Where consent is required, we will not rely solely on browser settings or continued browsing as evidence of consent. You may withdraw your cookie consent at any time through the available preference mechanism.

 

6.3 Wix and Third-Party Cookies

Because our store is hosted on Wix, Wix and certain integrated services may use cookies or similar technologies to provide security, hosting, analytics, ecommerce, or other functionality.

The specific cookies and tracking technologies depend on the features and integrations enabled on our website. Please consult the cookie preference tool and any relevant third-party privacy notices for further details.

 

7. Third-Party Service Providers and Data Sharing

We do not sell your personal information to third parties for their own independent commercial use. However, we may share personal information with service providers when necessary to operate our business, fulfill orders, or comply with legal obligations.

 

7.1 Wix

Our website is hosted on Wix. Wix may process personal information to provide website hosting, ecommerce functionality, website security, customer account features, and other services we enable.

Information processed through Wix may include contact details, account information, order information, technical data, and website usage information.

Wix may also engage subprocessors to deliver its services. Its handling of personal information is subject to its applicable privacy documentation and contractual arrangements.

 

7.2 PayPal and Credit Card Processors

We accept payments through PayPal and credit card payment services integrated into our store.

Payment providers may process payment details, billing information, transaction identifiers, and fraud prevention data to authorize transactions, prevent fraud, process refunds, and meet regulatory requirements.

Your payment information is handled according to the relevant provider's privacy policy and security procedures. We do not intentionally store complete payment card numbers or card security codes on our own systems.

Depending on the payment method selected, the relevant provider may act as an independent controller for certain processing activities.

 

7.3 Dropshipping Suppliers and Fulfillment Partners

Because Aura&Raíz operates through dropshipping, products may be shipped directly from suppliers or fulfillment partners to customers.

To fulfill your order, we may share the information reasonably necessary for delivery, including:

• Your name.

• Your shipping address.

• Your contact details where required for delivery.

• The products ordered and relevant order identifiers.

• Delivery instructions or information needed to resolve shipping issues.

Suppliers may use this information to prepare, package, dispatch, and support delivery of your order.

We require appropriate contractual or other safeguards from service providers where required by applicable law. Suppliers may be located outside Canada, including in countries where data protection laws differ from those in your place of residence.

We will not disclose more personal information than is reasonably necessary for fulfillment.

 

7.4 Shipping Carriers and Logistics Providers

We may share delivery details with postal services, courier companies, customs brokers, and other logistics providers to arrange shipment, provide tracking, complete customs formalities, and resolve delivery problems.

 

7.5 Analytics, Advertising, and Marketing Providers

If we enable analytics tools, advertising platforms, email marketing services, or customer relationship management tools, those providers may process relevant contact, technical, or usage information on our behalf or for their own purposes as described in their privacy notices.

We will configure these services in accordance with applicable consent and data protection requirements.

7.6 Legal and Business-Related Disclosures

We may disclose personal information when reasonably necessary to:

• Comply with applicable law or a valid legal process.

• Respond to lawful requests from public authorities.

• Protect our rights, property, customers, or business.

• Investigate fraud, security incidents, or suspected unlawful activity.

• Complete a merger, restructuring, financing, sale, or transfer of business assets, subject to appropriate protections.

 

8. International Data Transfers

Aura&Raíz is based in Canada. However, Wix, payment processors, dropshipping suppliers, shipping companies, and other service providers may process or store personal information in Canada, the United States, the European Economic Area, or other countries, depending on the services used.

Where the GDPR applies and personal information is transferred outside the European Economic Area to a country without an applicable European Commission adequacy decision, we will implement an appropriate transfer mechanism as required by law. This may include:

• Standard Contractual Clauses approved by the European Commission.

• Additional technical, organizational, or contractual safeguards where necessary.

• Another legally recognized transfer mechanism applicable to the circumstances.

Where required, we will assess the protection available in the destination country and take additional measures to address identified risks.

For transfers from the United Kingdom or other jurisdictions with separate transfer rules, we will use the safeguards required by the applicable legal framework.

You may contact us to request further information about relevant transfer safeguards, subject to legal restrictions and the protection of confidential information.

 

9. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention periods depend on the type of information, the reason it was collected, applicable legal obligations, and the need to establish or defend legal claims.

Our general retention approach is as follows:

• Order and transaction records: Retained for the period necessary to complete transactions, manage customer service, and comply with applicable accounting, tax, and commercial recordkeeping requirements.

• Customer communications: Retained for the period needed to resolve inquiries, maintain relevant business records, and address potential disputes.

• Account information: Retained while the account remains active and for a reasonable period afterward where necessary for legal compliance or dispute resolution.

• Marketing information: Retained until you unsubscribe, withdraw consent where applicable, or the information is no longer needed, subject to limited records maintained to respect your preferences.

• Technical and security logs: Retained for a period appropriate to security, troubleshooting, and operational needs.

• Cookie and analytics information: Retained according to the applicable cookie settings, service configurations, and provider retention policies.

Where a specific retention period cannot reasonably be determined in advance, we use criteria such as the duration of our business relationship, statutory retention requirements, and the time needed to resolve claims.

When personal information is no longer required, we will take reasonable steps to delete it, securely destroy it, or anonymize it, subject to legal obligations and legitimate retention requirements.

 

10. Data Security

We take reasonable administrative, technical, and organizational measures to protect personal information against unauthorized access, loss, misuse, alteration, disclosure, or destruction.

Depending on the information and systems involved, these measures may include:

• Access restrictions and account permissions.

• Secure website connections and platform security features.

• Authentication and account protection measures.

• Use of established third-party payment processors.

• Appropriate contractual requirements for service providers.

• Monitoring and measures to address suspected security incidents.

No method of electronic transmission or storage is completely secure. Accordingly, we cannot guarantee absolute security.

If a personal data breach occurs, we will assess the incident and make any notifications to affected individuals and relevant authorities required by applicable law.

 

11. Your Rights Under the GDPR

If the GDPR applies to the processing of your personal information, you may have the following rights, subject to applicable conditions and exceptions.

 

11.1 Right of Access

You may request confirmation of whether we process your personal information and obtain access to that information, together with relevant details about our processing.

 

11.2 Right to Rectification

You may request correction of inaccurate personal information or completion of incomplete information.

11.3 Right to Erasure

You may request deletion of your personal information in circumstances provided by law. This right is not absolute; we may need to retain certain information to comply with legal obligations or establish, exercise, or defend legal claims.

11.4 Right to Restrict Processing

You may request that we restrict the processing of your personal information in certain circumstances, such as while the accuracy of the information is being verified.

11.5 Right to Data Portability

Where the applicable legal conditions are met, you may request a copy of personal information you provided to us in a structured, commonly used, machine-readable format and request that it be transmitted to another controller where technically feasible.

 

11.6 Right to Object

You may object to processing based on our legitimate interests where the law provides this right.

You have an absolute right to object to the processing of your personal information for direct marketing purposes, including related profiling.

 

11.7 Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing lawfully carried out before withdrawal.

 

11.8 Rights Relating to Automated Decision-Making

Where applicable, you may have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, subject to statutory exceptions.

Aura&Raíz does not intend to make decisions producing such effects solely through automated processing. If this changes, we will provide any disclosures and protections required by law.

 

11.9 Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority, particularly in the EU or EEA country where you live, work, or believe an infringement occurred. You may also contact us directly to raise your concerns.

 

12. How to Exercise Your Privacy Rights

To submit a privacy request, contact us at:

Email: murillofrank745@gmail.com
Telephone: +1 (647) 574-9588

Please describe your request and provide sufficient information for us to understand and verify it. We may request additional information where reasonably necessary to verify your identity and protect your personal information from unauthorized disclosure.

We will respond to requests in accordance with applicable law. Under the GDPR, requests will generally be answered within one month. Where legally permitted, this period may be extended by up to two additional months for complex or numerous requests, and we will inform you of any extension and the reasons for it within the initial month.

Requests will generally be handled free of charge. We may charge a reasonable fee or refuse to act on a request where the law permits this, including for manifestly unfounded or excessive requests.

If we cannot comply with a request, we will explain our decision and inform you of any applicable rights to seek a remedy or lodge a complaint.

 

13. Supervisory Authorities and Complaints

If you believe we have mishandled your personal information, we encourage you to contact us first so that we can investigate and attempt to resolve your concerns.

If the GDPR applies, you may also lodge a complaint with a competent supervisory authority in the EU or EEA. A list of national data protection authorities is available through the European Data Protection Board:

https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

Individuals in the United Kingdom may contact the Information Commissioner's Office (ICO):

https://ico.org.uk/make-a-complaint/

Customers in Canada may contact the Office of the Privacy Commissioner of Canada, where it has jurisdiction:

https://www.priv.gc.ca/

Depending on the applicable law and the nature of the matter, a provincial privacy regulator may also be relevant.

Nothing in this Privacy Policy limits any statutory right you may have to complain to a regulator, seek a judicial remedy, or exercise other rights available under applicable law.

 

14. Children's Privacy

Our online store is intended for a general consumer audience and is not knowingly designed to collect personal information from children in circumstances prohibited by applicable law.

We do not knowingly collect personal information from children where parental consent or another legal authorization is required and has not been obtained.

If you believe a child has provided us with personal information unlawfully, please contact us. We will assess the matter and take appropriate steps, including deletion where required by law.

 

15. Marketing Communications

We may send promotional emails about products, offers, and store updates where permitted by applicable law.

Where consent is required, we will obtain it before sending marketing communications. Where another legal basis or an existing-customer exception is permitted, we will comply with the applicable conditions.

You may unsubscribe at any time by using the unsubscribe link in a marketing email or by contacting us directly.

Unsubscribing from promotional communications will not prevent us from sending essential transactional or service-related messages, such as order confirmations, delivery updates, refund notifications, or responses to your inquiries.

We will respect applicable consent and opt-out requirements for electronic marketing, including relevant Canadian anti-spam rules.

 

16. Third-Party Websites and Services

Our website may contain links to third-party websites, payment services, social media platforms, or other external services.

These third parties may collect personal information according to their own privacy policies and practices. Aura&Raíz does not control the privacy practices of websites or services that it does not operate.

We encourage you to review the applicable privacy policies before submitting personal information to third-party services.

 

17. Canadian Privacy Rights

For customers whose personal information is subject to Canadian privacy legislation, Aura&Raíz will handle personal information in accordance with applicable requirements, including those concerning consent, appropriate purposes, limiting collection, safeguards, retention, transparency, and individual access.

Where applicable, you may request access to your personal information, request corrections, and raise concerns about how your information has been collected, used, or disclosed.

Canadian privacy laws may differ from the GDPR, and the rights available to you will depend on the applicable law and circumstances.

 

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, technology, service providers, or legal requirements.

When we make changes, we will revise the “Last updated” date at the beginning of this policy. Where required by law, we will provide additional notice or obtain renewed consent before implementing material changes.

We encourage you to review this page periodically to remain informed about our privacy practices.

 

19. Contact Us

If you have questions about this Privacy Policy, our data protection practices, or your privacy rights, please contact:

Aura&Raíz
https://www.auraandraiz.com/

Email: murillofrank745@gmail.com
Telephone: +1 (647) 574-9588

We will make reasonable efforts to respond to your inquiry and address any privacy concerns in accordance with applicable law.