Privacy policy

Last updated: September 4, 2026

AuraFem is a brand operated by Hollmann OÜ, an Estonian private limited company registered under registry code 17589770, with its registered address at Sepapaja tn 6, 15551 Tallinn, Estonia.

Hollmann OÜ operates the AuraFem store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the “Services”). AuraFem is powered by Shopify, which enables us to provide the Services to you.

This Privacy Policy describes how we collect, use, process and disclose your personal information when you visit, use, make a purchase or otherwise interact with the Services or communicate with us.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing and disclosure of your personal information.

Please read this Privacy Policy carefully. By using or accessing any of the Services, you acknowledge that you have read and understood this Privacy Policy and the collection, use and disclosure of your personal information as described below.

Personal Information We Collect or Process

When we use the term “personal information,” we mean information that identifies you or can reasonably be linked to you or another individual.

Personal information does not include information that has been collected anonymously or sufficiently de-identified so that it cannot reasonably identify or be linked to an individual.

Depending on how you interact with the Services, where you live and as permitted or required by applicable law, we may collect or process the following categories of personal information:

  • Contact details, including your name, billing address, shipping address, phone number and email address.
  • Financial and payment information, including payment card information, payment details, transaction details, payment method and payment confirmation information.
  • Account information, including your username, password, preferences, settings and account-related information.
  • Transaction information, including products you view, add to your cart or wishlist, purchase, return, exchange or cancel, as well as your previous transactions.
  • Communications with us, including information contained in customer support requests, emails and other communications.
  • Device information, including information about your device, browser, network connection, IP address and other identifiers.
  • Usage information, including information regarding how and when you interact with, access or navigate the Services.

Personal Information Sources

We may collect personal information from the following sources:

  • Directly from you, including when you create an account, make a purchase, use the Services, contact us or otherwise provide information to us.
  • Automatically through the Services, including through your device, browser, cookies and similar technologies.
  • From our service providers, including providers that assist us with payment processing, ecommerce infrastructure, analytics, fulfilment, shipping, customer support and other business functions.
  • From business partners and other third parties, where permitted by applicable law.

How We Use Your Personal Information

Depending on how you interact with us and the Services, we may use your personal information for the following purposes:

Provide, Tailor and Improve the Services

We use personal information to provide the Services and perform our contractual obligations to you, including to:

  • process payments;
  • process and fulfil orders;
  • arrange shipping and delivery;
  • manage returns and refunds;
  • provide order and account notifications;
  • create and maintain customer accounts;
  • remember preferences;
  • provide customer support;
  • detect and resolve operational issues;
  • improve and personalise the shopping experience; and
  • recommend products or content that may be relevant to you.

Marketing and Advertising

Where permitted by applicable law, we may use personal information for marketing and promotional purposes, including:

  • sending marketing and promotional communications by email;
  • displaying relevant advertising;
  • measuring advertising effectiveness;
  • understanding customer engagement; and
  • personalising marketing based on your interactions with our Services.

Where consent is legally required, we will obtain your consent before carrying out such processing.

You may withdraw your consent or unsubscribe from marketing communications at any time using the unsubscribe option included in our communications or by contacting us.

Security and Fraud Prevention

We may use personal information to:

  • authenticate customer accounts;
  • secure transactions and payments;
  • detect, investigate and prevent fraud;
  • detect illegal, malicious, unsafe or unauthorised activity;
  • protect our Services, customers and business; and
  • comply with security and fraud prevention obligations.

Communicating With You

We use personal information to communicate with you regarding:

  • your orders;
  • deliveries;
  • refunds and returns;
  • account matters;
  • customer support requests;
  • changes to our Services or policies; and
  • other operational matters relating to your relationship with us.

Legal and Regulatory Purposes

We may process personal information where necessary to:

  • comply with applicable laws and regulations;
  • comply with tax, accounting and record-keeping obligations;
  • respond to lawful requests from courts, regulators, law enforcement or other authorities;
  • establish, exercise or defend legal claims;
  • enforce our Terms of Service and policies; and
  • investigate potential violations of our rights or legal obligations.

Legal Bases for Processing

Where the General Data Protection Regulation (“GDPR”), the UK GDPR or other applicable European data protection laws apply, Hollmann OÜ processes personal information only where there is a valid legal basis.

Depending on the circumstances, our legal bases may include:

  • Performance of a contract, including processing orders, payments, deliveries, returns, refunds and customer accounts.
  • Compliance with legal obligations, including accounting, tax, regulatory, fraud-prevention and record-keeping requirements.
  • Legitimate interests, including operating, securing, protecting and improving our business and Services, provided those interests are not overridden by your fundamental rights and freedoms.
  • Consent, where required, including for certain cookies, analytics, personalised advertising and marketing communications.

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before your withdrawal.

How We Disclose Personal Information

We may disclose personal information to third parties where necessary for legitimate business purposes and as permitted by applicable law.

This may include:

  • Shopify, which provides the ecommerce infrastructure used to operate the AuraFem store.
  • Payment processors and financial service providers used to process transactions and payments.
  • Fulfilment, logistics and shipping providers responsible for processing and delivering orders.
  • IT, hosting, analytics and cloud service providers that assist us with operating and maintaining the Services.
  • Customer support and communications providers used to communicate with customers.
  • Marketing and advertising partners, where permitted by applicable law and subject to required consent.
  • Professional advisers, including accountants, legal advisers and compliance service providers.
  • Government authorities, regulators or law enforcement, where disclosure is required by law.

We may also disclose information:

  • when you direct or consent to such disclosure;
  • as part of a merger, acquisition, restructuring, financing, sale or other business transaction; or
  • where necessary to protect our rights, property, customers or business.

Relationship With Shopify

The Services are hosted by Shopify.

Shopify collects and processes personal information about your access to and use of the Services in order to provide and improve the ecommerce services made available to us and to you.

Information submitted through the Services may be transmitted to and processed by Shopify and other service providers located in countries other than your country of residence.

We also use certain Shopify enhanced features that may incorporate data obtained from your interactions with our store together with information relating to interactions with Shopify and other merchants.

In these circumstances, Shopify may act independently in relation to certain processing activities and may be responsible for responding to requests regarding personal information processed for those purposes.

You can learn more about Shopify's privacy practices through the Shopify Consumer Privacy Policy:

https://www.shopify.com/legal/privacy/app-users

You may also exercise certain privacy rights relating to data processed by Shopify through the Shopify Privacy Portal:

https://privacy.shopify.com/en

Cookies and Similar Technologies

We and our service providers may use cookies, pixels, local storage and similar technologies to operate the Services, remember preferences, analyse usage, improve functionality and, where permitted, provide personalised advertising and marketing.

Where applicable law requires consent for non-essential cookies or similar technologies, such technologies will only be activated after the required consent has been obtained.

You may manage your cookie preferences through the cookie banner or privacy controls available on our website.

Third-Party Websites and Links

The Services may contain links to websites, platforms or services operated by third parties.

If you follow a link to a third-party website or service, that third party's privacy practices and terms will apply.

We are not responsible for the privacy, security, accuracy or practices of third-party websites or services that are not controlled by Hollmann OÜ.

You should review the privacy policies and terms of those third parties before providing personal information to them.

Children's Data

The Services are not intended for children.

We do not knowingly collect personal information from children under the age at which they may legally consent to the processing of their personal information in their jurisdiction.

If you are a parent or legal guardian and believe that a child has provided personal information to us, please contact us using the information provided below so that we can take appropriate action.

As of the effective date of this Privacy Policy, we do not knowingly sell or share personal information relating to individuals under 16 years of age where such terms are defined under applicable law.

Security and Retention of Your Information

We take reasonable technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or misuse.

However, no method of transmission over the internet or electronic storage system can be guaranteed to be completely secure.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to:

  • provide the Services;
  • maintain customer accounts;
  • complete transactions;
  • comply with legal, tax and accounting obligations;
  • resolve disputes;
  • prevent fraud; and
  • enforce our agreements and policies.

Retention periods may vary depending on the nature of the information and applicable legal requirements.

Your Rights and Choices

Depending on where you reside and applicable law, you may have some or all of the following rights in relation to your personal information:

  • Right of access — to request information about the personal information we process about you.
  • Right to rectification — to request correction of inaccurate or incomplete personal information.
  • Right to deletion — to request deletion of personal information in certain circumstances.
  • Right to data portability — to receive certain personal information in a structured, commonly used and machine-readable format and, where applicable, request its transfer to another provider.
  • Right to object — to object to certain processing of your personal information.
  • Right to restriction — to request restriction of processing in certain circumstances.
  • Right to withdraw consent — where processing is based on consent, you may withdraw that consent at any time.
  • Right to manage marketing preferences — you may unsubscribe from promotional email communications at any time.

Even if you opt out of marketing communications, we may continue to send non-marketing communications necessary to provide the Services, including communications relating to orders, payments, deliveries, returns, refunds, security or your customer account.

You may exercise your rights by contacting us using the information provided in the Contact section below.

We may request information necessary to verify your identity before processing certain requests, where permitted or required by applicable law.

We will not discriminate against you for exercising your privacy rights.

Additional Rights for EEA and UK Residents

If you reside in the European Economic Area or the United Kingdom, you may have additional rights under applicable data protection law, including:

  • the right to object to processing based on legitimate interests;
  • the right to restrict processing;
  • the right to withdraw consent;
  • the right to lodge a complaint with a competent supervisory authority; and
  • the right not to be subject to certain decisions based solely on automated processing where applicable.

If you withdraw consent, this will not affect the lawfulness of processing carried out before your consent was withdrawn.

Complaints

If you have a complaint regarding how Hollmann OÜ processes your personal information, please contact us using the details provided below.

If you are located in the EEA, you also have the right to lodge a complaint with your local data protection supervisory authority.

As Hollmann OÜ is established in Estonia, you may also contact the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) where applicable.

A list of EEA supervisory authorities is available through the European Data Protection Board.

International Transfers

We and our service providers may transfer, store or process personal information outside the country in which you reside.

Where personal information originating in the European Economic Area or the United Kingdom is transferred to a country that has not been recognised as providing an adequate level of data protection, we rely on recognised safeguards where required, including the European Commission's Standard Contractual Clauses or equivalent mechanisms recognised under applicable law.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to:

  • our privacy practices;
  • the Services;
  • service providers;
  • legal or regulatory requirements; or
  • operational requirements.

When we update this Privacy Policy, we will update the “Last updated” date above and provide additional notice where required by applicable law.

Contact

If you have questions about this Privacy Policy, our privacy practices, or would like to exercise any rights available to you under applicable data protection law, please contact:

Hollmann OÜ
Operating the AuraFem brand
Registry code: 17589770
Registered address: Sepapaja tn 6, 15551 Tallinn, Estonia
Phone: +372 5368 6337
Email: support@aurafem.eu

For the purposes of applicable data protection laws, including the GDPR, Hollmann OÜ is the data controller responsible for the personal information described in this Privacy Policy.