Privacy Policy

Enquiry data: the contact form collects your role (brand, retailer, agent or other), name, company, business email, the content of your message and any file you attach, together with the language you were browsing in.

Account data: name, company, business email and account type when you request access to the client area. Authentication and credentials are handled by our hosted authentication provider (Supabase, EU-hosted); we never see or store your password. Your approval status is recorded so an administrator can review the request.

Technical data: essential logs needed to operate and secure the site.

To answer enquiries, prepare quotations and perform manufacturing or wholesale contracts (Art. 6(1)(b) GDPR).

To review and approve client-area access requests, and to keep our accounting and customs records as required by Italian law (Art. 6(1)(c) GDPR).

For limited business communication about your project, based on our legitimate interest (Art. 6(1)(f) GDPR).

Account profiles, approval status and contact-form submissions are stored in our managed PostgreSQL database (Supabase) hosted in the European Union. Files attached to an enquiry are stored in a private storage bucket that is not publicly accessible; the database keeps only the controlled file path and basic metadata. Enquiry follow-up is handled on business email systems located in the European Union.

We do not sell personal data and we do not share it for advertising purposes.

Data may be shared with our accountants, freight forwarders and IT providers acting as data processors, and with public authorities when the law requires it.

Enquiry data is kept for up to 24 months. Contract, invoicing and customs records are kept for 10 years as required by Italian law. Client-area accounts are kept until you ask us to delete them.

You may request access, rectification, erasure, restriction, portability or object to processing by writing to contact@auralunasrls.com.

You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali).

Credentials are managed by our authentication provider and are never stored by this website. Access to client records, orders and settlement records is restricted server-side by role, database row-level security applies to every table, and attachments are kept in a private bucket reachable only through authorised, time-limited links.