Privacy policy

AURYXRESEARCH LTD (company number 17388727), trading as AURYX Parfums, is the data controller for personal data collected through this website. That means we decide what is collected and why, and we are accountable for it under the UK GDPR and the Data Protection Act 2018.

For any privacy question, or to exercise the rights in section 6, email hello@auryx.co.uk.

Rather than describe this in prose, here it is as a table. Each row states the data, the purpose, our lawful basis for processing it, and how long we hold it.

We never see your full card number, expiry date or security code. Card entry happens on Stripe’s hosted checkout page, and what comes back to us is a yes or no plus the last four digits for your reference.

We do not build advertising profiles, we do not run third-party ad pixels, and we do not collect special category data — nothing about your health, beliefs, ethnicity or anything else in that class. If you tell us about a skin sensitivity in an email so we can advise you, we use it to answer you and then it stays in that email thread; we do not add it to a profile.

We use a small number of processors, each contracted to act only on our instructions:

• Stripe — takes payment. Stripe is a controller in its own right for fraud prevention; see its own privacy policy.
• Royal Mail and courier partners — receive your name, address and, where you give it, a phone number or email for delivery notifications.
• Our email provider — sends order confirmations and, separately, the newsletter you opted into.
• Our hosting provider — runs the website and holds server logs.

We will also disclose data where the law requires it, or to establish or defend a legal claim. We do not sell, rent or trade personal data. There is no circumstance in which we would.

Some of our processors operate outside the United Kingdom. Where personal data is transferred abroad, it is protected either by UK adequacy regulations for that country, or by the International Data Transfer Agreement or the UK addendum to the EU Standard Contractual Clauses. You can ask us which applies to a given provider.

Under UK data protection law you have the right to:

• be told what we hold about you, and get a copy of it;
• have inaccurate data corrected;
• have data erased, where we have no overriding obligation to keep it — note that we must retain order and tax records for seven years, so we cannot delete a completed order on request;
• restrict or object to processing, including profiling;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, where consent is the basis — unsubscribing from the newsletter is the common case, and does not affect anything done before you withdrew.

Email us to exercise any of these. We respond within one month, free of charge, and will ask you to confirm your identity first so that we are not handing your data to someone else.

The site is served over HTTPS. Access to order data is limited to the people who need it to pack orders and answer questions, and payment data never reaches our systems at all.

No system is perfect. If a breach occurs that is likely to risk your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware, and tell you directly without undue delay where the risk to you is high.

This site is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us personal data, tell us and we will delete it.

Cookies and similar storage are covered separately on the cookie policy, including how to refuse the non-essential ones.

Please raise it with us first — most privacy complaints come from a misunderstanding we can clear up quickly.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113. You do not need our permission and you do not have to come to us first.