GDPR Compliance

Last Updated: September 22, 2026

Aura Crag is committed to protecting the privacy and personal data of individuals in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

Data Controller

Aura Crag acts as the data controller for personal information collected through our website and business operations. We are responsible for ensuring that your personal data is processed lawfully, fairly, and transparently.

Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contractual necessity: To fulfill orders and provide services you have requested
• Legitimate interests: To improve our products and services
• Consent: For marketing communications and optional data uses
• Legal obligations: To comply with applicable laws and regulations

Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access: You may request a copy of the personal data we hold about you
• Right to rectification: You may request correction of inaccurate or incomplete data
• Right to erasure: You may request deletion of your personal data under certain circumstances
• Right to restrict processing: You may request limitation on how we use your data
• Right to data portability: You may request transfer of your data to another service
• Right to object: You may object to certain types of data processing
• Right to withdraw consent: You may withdraw previously given consent at any time

Data Processing Activities

We process personal data for the following purposes:

• Order processing and fulfillment
• Customer communication and support
• Product delivery coordination
• Payment processing through secure third-party providers
• Website analytics and improvement
• Marketing communications with consent

International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area. When this occurs, we ensure appropriate safeguards are in place to protect your data in accordance with GDPR requirements.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

Security Measures

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts on individuals.

Exercising Your Rights

To exercise any of your GDPR rights or if you have questions about how we process your personal data, please contact us at [email protected]. We will respond to your request within one month.

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated.

Updates to This Notice

We may update this GDPR compliance notice from time to time. Material changes will be communicated through our website.