Privacy notice

This notice explains what we do with your personal data when you order from us or get in touch. We have tried to write it in plain English rather than legal boilerplate.

1. Who we are

opAurea Ltd, 61 Bridge Street, Kington HR5 3DJ, United Kingdom, is the data controller for personal data collected through this website. If you have any question about this notice, or want to exercise any of the rights in section 8, email hello@opaurea.com.

2. What we collect

We only collect what we need to sell you parts and get them to you.

• Order details — your name, email address, delivery address, and optionally a company name, purchase order number and any order notes you write.
• Order contents — the items, quantities and prices, and the reference we assign so we can match your bank transfer to your order.
• Correspondence — emails you send us and our replies.
• Payment confirmation— that a transfer arrived, and the reference quoted. Your bank details reach us only through your own bank’s transfer, and we do not store them.

3. What we deliberately do not collect

This is a short list, and we intend to keep it short:

• No accounts. There is no login, no password and no stored purchase history tied to a profile.
• No analytics or tracking. We run no Google Analytics, no advertising pixels, no session recording and no third-party scripts. Nothing on this site reports your browsing back to anyone.
• No access logs. Our web server is configured without request logging, so we do not keep a record of the pages you view or the IP address you view them from.
• No card details. We never see or store them.

4. Cookies and browser storage

We set no cookies. Your basket is held in your own browser using a single local storage entry called opaurea.cart.v1, which contains only the items you have added. It never leaves your device until you place an order, is not used for tracking, and is not shared with anyone. Clearing your browser data removes it.

Because we use no non-essential cookies, you will not find a cookie consent banner here. That is deliberate.

5. Why we use your data, and our legal basis

We do not send marketing email, so we do not rely on consent for it. If we ever introduce a newsletter it will be opt-in, and unsubscribing will be one click.

6. Who we share it with

We do not sell your data, and we do not share it for anyone else’s marketing. We use a small number of service providers who process data on our behalf:

• Resend — sends your order confirmation and invoice. Receives your name, email address, order contents and delivery address.
• Delivery carriers — receive your name, delivery address and, where the service needs it, your email address for tracking notifications.
• Hetzner Online GmbH — hosts our server, located in Germany.
• Our accountant — sees invoices as part of preparing our accounts.
• Stripe — only if you choose to pay by card, where that option is offered. Stripe handles the payment directly and we receive only confirmation.

We may also disclose data where the law requires it, or to establish or defend a legal claim.

7. Transfers outside the UK

Our server is in Germany. Resend and Stripe are US-based providers, so sending your order confirmation involves a transfer of your name, email address and order details to the United States. These transfers are covered by the providers’ standard data protection terms, which incorporate the UK International Data Transfer Addendum and EU Standard Contractual Clauses.

8. How long we keep it

• Orders and invoices — six years after the end of the relevant accounting period. We are required to keep these and cannot delete them earlier, even on request.
• General correspondence — two years, unless it relates to an order or a dispute, in which case it is kept with the order record.
• Unpaid, cancelled orders — 12 months, then deleted.

9. Your rights

Under UK GDPR you have the right to:

• ask what data we hold about you, and get a copy of it;
• have inaccurate data corrected;
• have data erased, where we are not legally required to keep it;
• restrict or object to how we use it, including objecting to any processing we do on the basis of legitimate interests;
• receive data you gave us in a portable format; and
• not be subject to automated decision-making — we do not do any.

Email hello@opaurea.com and we will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113. We would appreciate the chance to put it right first.

10. Keeping your data secure

The site is served over HTTPS. Order records are held on our server with access restricted to the application and to us. Only the people who need to see an order in order to fulfil it have access to it.

No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will tell you and report it to the ICO within 72 hours, as required.

11. A note on payment fraud

We will never email, text or telephone you to say our bank details have changed. If you receive such a message, treat it as fraudulent and contact us at hello@opaurea.com to verify before sending any money.

12. Children

This site is intended for adults. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this notice

If we change how we handle personal data we will update this page and the date at the top. Material changes affecting existing customers will be notified by email.