Privacy policy

Last updated: 10 September 2026

This policy explains how we collect and use your personal data when you visit www.auroradu.com, place an order, contact us or subscribe to our newsletter.

1. Who is responsible for your data
The data controller is Du Yao, Entrepreneur Individuel (EI), trading as AURORA DÙ, 2 rue Pernelle, 75004 Paris, France — SIRET 933 334 328 00012.
For any question about this policy or to exercise your rights: info@auroradu.com.

2. What we collect

2.1 Data you give us — your name, email address, billing and delivery address, telephone number where you provide one, order contents, correspondence with us, and any account details or preferences you save.

2.2 Payment data — card payments are processed directly by our payment providers. We receive confirmation of the transaction and the last four digits and card type; we never receive or store your full card number.

2.3 Data collected automatically — IP address, device and browser type, pages viewed, referring page, and similar technical data, collected through cookies and comparable technologies subject to your consent (see section 7).

3. Why we use it, and on what legal basis

  • To process and deliver your order, handle returns, refunds and guarantees, and communicate with you about your order — performance of the contract (GDPR Art. 6(1)(b)).
  • To meet our accounting, tax and consumer-law obligations, including retaining invoices and contracts — legal obligation (Art. 6(1)(c)).
  • To send you our newsletter and marketing messages — your consent (Art. 6(1)(a)), which you may withdraw at any time via the unsubscribe link or by writing to us. Where you are already a customer, we may send you information about similar products on the basis of our legitimate interest, and you can object at any time.
  • To secure the site, prevent fraud and abuse, understand how the site is used, and improve our products and service — legitimate interest (Art. 6(1)(f)).
  • To handle disputes and defend our rights — legitimate interest.

Providing the data marked as required at checkout is necessary to conclude the sale; without it we cannot process your order.

4. Who receives your data
We do not sell your personal data. We share it only with the service providers we need to run the business, each acting on our instructions or as an independent controller for their own compliance purposes:

  • Shopify — e-commerce platform and hosting.
  • Payment providers (including Shopify Payments and, where offered, PayPal, Apple Pay, Google Pay) — payment processing and fraud prevention.
  • Carriers and logistics partners — delivery and returns.
  • Email and marketing tools — transactional messages and, subject to your consent, the newsletter.
  • Analytics providers — subject to your cookie consent.
  • Our accountant and, where necessary, our legal advisers.
  • Public authorities, where we are legally required to disclose.

5. Transfers outside the European Union
Some of our providers, and our production partners, are established outside the European Economic Area — including in Canada, the United States and China. Where personal data is transferred outside the EEA, we rely on an adequacy decision of the European Commission where one exists (for example Canada, for commercial organisations), or otherwise on the European Commission's Standard Contractual Clauses together with additional safeguards. You may request a copy of the safeguards in place by writing to info@auroradu.com.

6. How long we keep it

  • Order and customer records: for the duration of the commercial relationship, then archived for the applicable limitation and accounting periods — 10 years for accounting records, and 10 years for contracts concluded online with a value of €120 or more.
  • Account data: until you close your account, then deleted or anonymised, subject to the archiving periods above.
  • Marketing consent and newsletter data: until you withdraw consent, and in any event no more than 3 years after your last interaction with us.
  • Prospect and enquiry data: 3 years from the last contact.
  • Cookies and similar technologies: a maximum of 13 months, with the consent record kept for 6 months to 3 years depending on the tool.

7. Cookies
Cookies strictly necessary to operate the site — keeping you logged in, remembering your cart, security — are placed without consent because the site cannot function without them.

All other cookies, including analytics and advertising cookies, are placed only after you have given your consent through our cookie banner. Continuing to browse the site is not consent. You can accept, refuse or change your choices at any time through the "Cookie preferences" link in the footer, and you can also configure your browser to block or delete cookies.

8. Your rights
Under the GDPR and the French Data Protection Act you have the right to:

  • access your personal data and obtain a copy;
  • have inaccurate data corrected;
  • have your data erased, where the conditions are met;
  • restrict processing;
  • object to processing based on our legitimate interest, and object at any time to direct marketing;
  • receive the data you provided in a structured, machine-readable format and have it transmitted to another controller (portability);
  • withdraw your consent at any time, without affecting processing already carried out;
  • give instructions on what happens to your data after your death.

To exercise any of these rights, write to info@auroradu.com. We reply within one month; if the request is complex we may extend this by two months and will tell you why. We may ask for proof of identity where there is reasonable doubt.

If you consider that your rights have not been respected, you may lodge a complaint with the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.

9. Automated decision-making
We do not take decisions producing legal effects concerning you based solely on automated processing. Our payment providers may run automated fraud checks on transactions; if a payment is declined on that basis you can contact us to have it reviewed.

10. Security
We take appropriate technical and organisational measures to protect your data, and our providers are contractually bound to do the same. No transmission over the internet is completely secure, and we cannot guarantee absolute security.

11. Children
The site is not intended for children under 15, and we do not knowingly collect their data.

12. Changes
We may update this policy. The version in force is the one published on this page, with the date of the last update shown at the top.