Last updated: 18 July 2026
At We Are Aurea we take the protection of your personal data seriously. This Privacy Policy explains what data we collect, for what purpose, on what legal basis we process it, with whom we share it and what rights you have. Please read it carefully.
1. Data controller
In accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE), the data controller is:
- Owner: Lorena Salas Villarreal (trading under the brand “We Are Aurea”)
- Tax ID (NIF): [TO BE COMPLETED]
- Address: Carrer de Pere IV, 240, 08005 Barcelona, Spain
- Email: hello@weareaurea.com
- Website: https://weareaurea.com
- Activity: Online and in-person education in vegan pastry and plant-based cooking, and the sale of courses and masterclasses through our online store.
2. Data we process
Depending on your relationship with us, we may process the following categories of data:
- Registration and account data: first name, last name, email address, username and password.
- Order and billing data: name, billing address, country, email and the tax details needed to issue an invoice. Card and payment details are processed directly by our payment providers (Stripe, PayPal, Klarna); We Are Aurea does not store full card numbers.
- Course data: products purchased and your access progress to the course content.
- Contact data: the information you provide through the contact form or by email (name, email, subject and message).
- Newsletter data: email address and, where applicable, name and preferred language.
- Browsing data: IP address, device and browser type, pages visited and cookie identifiers, where you have given your consent (see the Cookies section).
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Managing your registration and user account | Performance of a contract |
| Processing orders, granting course access and providing support | Performance of a contract |
| Issuing invoices and meeting tax and accounting obligations | Legal obligation |
| Sending the newsletter and marketing communications | Consent |
| Responding to your contact-form enquiries | Consent / legitimate interest |
| Measurement, analytics and advertising (e.g. Google Analytics, Meta) | Consent (via the cookie banner) |
| Fraud prevention and site security | Legitimate interest |
You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
4. Recipients and processors
To provide our services we work with providers that act as data processors and with whom we have signed the corresponding agreements under Art. 28 GDPR:
- Web hosting: cdmon (servers located in the European Union).
- Payment gateways: Stripe, PayPal and Klarna.
- Email marketing: Brevo (Sendinblue).
- Web analytics: Google (Google Analytics 4) via Google Tag Manager.
- Advertising and measurement: Meta Platforms (Facebook/Instagram pixel and Conversions API).
We do not disclose your data to third parties except where legally required or where necessary to provide the service you have requested.
5. International transfers
Some providers (such as Google and Meta) may process data outside the European Economic Area, mainly in the United States. Such transfers are covered by the safeguards provided for in the GDPR, such as the European Commission’s Standard Contractual Clauses and/or these providers’ certification under the EU–U.S. Data Privacy Framework.
6. Retention periods
- Account data: for as long as your account remains active; if you request deletion, it will be removed unless we are legally required to retain it.
- Order and invoice data: for the legally required retention periods (up to 6 years under the Spanish Commercial Code and applicable tax rules).
- Newsletter data: until you unsubscribe or withdraw your consent.
- Contact enquiries: for as long as needed to handle your request and, thereafter, the limitation period for any potential liabilities.
7. Your rights
You may exercise the following rights at any time: access, rectification, erasure (“right to be forgotten”), restriction of processing, portability, objection, and withdrawal of consent.
To exercise them, email hello@weareaurea.com stating the right you wish to exercise and attaching a copy of a document proving your identity. If you believe we have not handled your request properly, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es.
8. Security
We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption of communications (HTTPS/TLS), access control and backups, in order to protect your data against loss, misuse or unauthorised access.
9. Cookies
Our site uses first-party and third-party cookies. You can accept, reject or configure their use through the consent banner and see the details in our Cookie Policy. Analytics and advertising cookies are only activated if you give your consent.
10. Minors
Our products and services are intended for people aged 18 and over. We do not knowingly collect data from minors; if we detect that such data has been provided, we will delete it.
11. Changes to this policy
We may update this Privacy Policy to reflect legislative developments or changes to our services. The version in force will always be the one published on this page, with its “last updated” date.
If you have any questions about how we process your data, email us at hello@weareaurea.com.