Privacy policy

Privacy policy – Maison Aurela

Protecting your personal data matters to us. This privacy policy explains what data we collect, why, and how we protect it, in line with the General Data Protection Regulation (GDPR).

1. Controller
MyPostura LLC (operator of the Maison Aurela online store), 30 N Gould St, Sheridan, WY 82801, USA
Email: velorallc@proton.me

2. Data we collect

  • When you order: first and last name, email address, shipping and billing address, phone number if you give one, order and payment details. Payment details are processed by our payment providers (see section 5).
  • When you visit the store: IP address, browser type, pages viewed, cookies (see section 10).
  • When you contact us: name, email address and the content of your message.
  • When you return an item or withdraw from a purchase: name, order number, email address and the content of your message.
  • When you sign up for our newsletter: email address.

3. Purposes

  • Processing and delivering your orders
  • Customer service, returns, withdrawals and our 30-day guarantee
  • Email marketing, only with your consent
  • Improving our store and preventing fraud
  • Meeting our legal obligations, for example accounting and tax

4. Legal bases (Art. 6(1) GDPR)

  • Performance of a contract (b): orders, delivery, customer service
  • Consent (a): newsletter, non-essential cookies
  • Legitimate interests (f): improving the store, fraud prevention, strictly necessary cookies
  • Legal obligation (c): record-keeping duties, handling withdrawals

5. Recipients
We share your data only where this is necessary for the purposes above, with:

  • our store platform and hosting provider (Shopify)
  • payment providers (for example Shopify Payments and PayPal)
  • the shipping company that delivers your order
  • our email service for the newsletter, if you have subscribed

We do not sell your data.

6. Processing outside the EU
Our company is based in the USA, so your data is also processed there. Processing your order data in the USA is necessary to perform the contract of sale (Art. 49(1)(b) GDPR). Where service providers process data on our behalf in other countries, this is based on adequacy decisions of the European Commission (for example the EU-US Data Privacy Framework) or on EU standard contractual clauses.

7. How long we keep your data

  • Order and invoice data: for the statutory retention periods
  • Customer account: until you delete it
  • Newsletter: until you unsubscribe

After that, the data is deleted.

8. Your rights
Under the GDPR you have the right to:

  • access (Art. 15)
  • rectification (Art. 16)
  • erasure (Art. 17)
  • restriction of processing (Art. 18)
  • data portability (Art. 20)
  • withdraw your consent at any time, with effect for the future (Art. 7(3))

Right to object (Art. 21 GDPR): where we process your data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation. You can object to the use of your data for direct marketing at any time, without giving a reason.

To exercise your rights, write to velorallc@proton.me. You can also lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live.

9. Data security
We protect your data with appropriate technical and organisational measures, including SSL encryption, restricted access rights and carefully selected service providers.

10. Cookies
We use strictly necessary cookies, for example for the cart and checkout, without asking for consent. We use analytics and marketing cookies only with your consent, which you can give or withdraw at any time in the cookie settings.

11. Changes
We may update this privacy policy, for example when we add new features or the law changes. The version published on this page applies.

12. Contact
Questions about privacy: velorallc@proton.me

Last updated: November 2026