1. Who we are
AureoLife is an official brand name of Plantagusto Group Ltd. Oy (Business ID 3016223-8), the controller responsible for personal data described in this notice.
Registered contact address: Riimukuja 6a, 00750 Helsinki, Finland.
Privacy enquiries: privacy@aureolife.com
General enquiries: hello@aureolife.com
2. Information we process
Consumer orders
Your name, email, delivery address, selected products, destination country, prices, VAT breakdown, order reference, payment status, accepted terms version, fulfilment information and correspondence about delivery, returns or defects. Revolut processes your payment credentials; AureoLife receives the payment and order status, not your full card details.
Private List
Your email address, subscription status, consent evidence, and technical delivery information needed to maintain the list and honour unsubscribes.
Trade enquiries
Your name, business email, company, country, optional company website, area of interest, message, marketing choice, and the correspondence that follows.
Website use
When you allow analytics, Google Analytics may process device, browser, approximate location, referral and interaction information. When you allow marketing, Google Merchant Center, Meta and Pinterest may process campaign referrals, page views, product views, basket actions, checkout activity, purchases and related device information for conversion measurement and attribution. Google receives order reference, value, currency, VAT, shipping and product details for completed purchase measurement; it does not receive your delivery address or email from this tag. For consented orders, AureoLife may send Meta a one-way hashed email address, order value and products, browser and click identifiers, IP address and user agent through the Conversions API. Necessary technical information may also be processed to provide secure sessions, protect forms, diagnose faults and prevent abuse.
Information from other sources
If you contact us through a retailer, event, professional introduction or social channel, we may receive the contact and correspondence information you choose to provide.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Take payment, fulfil and deliver consumer orders, provide confirmations, and handle withdrawals, returns and customer service. | Performance of the sales contract and steps requested before entering it. |
| Maintain accounting, VAT and transaction records. | Compliance with legal obligations. |
| Respond to trade enquiries, assess partnerships and provide requested information. | Our legitimate interests in conducting and developing our business and, where relevant, steps requested before entering a contract. |
| Send Private List and optional trade marketing updates. | Your consent. A trade enquiry is never treated as marketing consent. |
| Measure website use through optional analytics. | Your consent. |
| Measure Google Merchant Center, Meta and Pinterest campaign visits and conversions, attribute purchases, and optimize advertising for completed purchases. | Your consent. |
| Operate secure forms, prevent spam, maintain suppression records and protect the website. | Our legitimate interests in security, service integrity and respecting opt-out choices; and legal obligations where applicable. |
| Establish, exercise or defend legal claims and comply with lawful requests. | Our legitimate interests and compliance with legal obligations. |
You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before it was withdrawn.
5. How long we keep information
| Record | Retention |
|---|---|
| Consumer orders, payments, VAT and accounting records | For the statutory accounting and tax retention period, normally at least 6 years after the relevant financial year. |
| Withdrawal, return and defect correspondence | For the transaction and any applicable claims period. |
| Trade enquiries and form delivery records | 24 months after the last substantive contact. |
| Active commercial discussions | For the relationship, then 24 months, unless a longer period is required for contracts, accounting or legal claims. |
| Private List subscriber data | Until you unsubscribe or we close the list. |
| Consent evidence | Up to 3 years after withdrawal; a minimal suppression record may remain as needed to honour your choice. |
| Google Analytics user/event data | Configured for 14 months, subject to Google’s technical operation. |
| Security logs and anti-spam records | Normally 90 days for logs and 30 days for anti-spam records, unless an incident requires longer preservation. |
| Privacy rights requests | 3 years after completion. Identity documents used for verification are deleted when verification is complete. |
| Backups | Normally rotated within 90 days. |
We may keep information longer where required by law, an unresolved dispute or a necessary legal hold.
6. Your rights
Subject to the conditions in data-protection law, you may request access to your personal data, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time.
You can change analytics and marketing consent through “Cookie settings” on any page. Marketing emails include an unsubscribe method. We may ask for proportionate information to confirm identity before acting on a request. There is no fee in ordinary cases.
We do not use the website information described here for decisions based solely on automated processing that produce legal or similarly significant effects.
7. Children
AureoLife’s website and services are not directed to children, and we do not knowingly seek personal data from children.
8. Changes to this notice
We may update this notice when our services, providers or legal obligations change. The effective date above identifies the current version. Material changes will be presented appropriately on the website.
9. Contact and complaints
Send privacy requests to privacy@aureolife.com. You also have the right to complain to the Finnish supervisory authority, the Office of the Data Protection Ombudsman, or the supervisory authority in the EEA country where you live or work.