Privacy Policy

Aura Peptide is responsible for all personal information under its control. We have designated a Privacy Officer who is accountable for our compliance with PIPEDA and this Privacy Policy.

Privacy inquiries and complaints may be directed to our Privacy Officer at: [email protected]. We will acknowledge receipt of your inquiry within 5 business days and respond substantively within 30 calendar days.

Third-party service providers who handle personal information on our behalf are required by contract to maintain privacy protections consistent with this policy.

We identify the purposes for which personal information is collected before or at the time of collection. Personal information is collected solely for the following purposes:

• Order processing and fulfillment: to process your purchase, confirm payment, arrange shipping, and send order-related communications. • Customer support: to respond to your inquiries, complaints, and requests. • Legal compliance: to meet our obligations under applicable Canadian laws, including tax and record-keeping requirements. • Fraud prevention and security: to detect, investigate, and prevent fraudulent transactions and other illegal activity. • Website operation: to maintain and improve the technical performance of aurapeptide.ca.

We do not use personal information for marketing, profiling, or any purpose beyond those listed above without obtaining your express consent.

We obtain your knowledge and consent before or at the time we collect, use, or disclose your personal information, except where the law permits or requires otherwise.

By placing an order on aurapeptide.ca, you expressly consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy for the purposes of processing your order and fulfilling our contractual obligations to you.

You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may affect our ability to provide products or services to you. To withdraw consent, contact us at [email protected].

We do not collect personal information from individuals we know to be under the age of 18. If you are under 18, please do not submit personal information to us.

We limit the collection of personal information to what is necessary for the identified purposes. We collect information by fair and lawful means.

Information collected when you place an order includes: full name, email address, shipping address, and order details (products ordered, quantities, and amounts).

For Interac e-Transfer payments, we collect only the information necessary to confirm receipt of payment (sender name and transaction reference).

Credit card payments are processed entirely by GoDaddy Payments. We do not collect, store, or have access to your full credit card number, CVV, or other sensitive payment card data. Payment card data is handled by GoDaddy Payments in accordance with PCI-DSS standards.

We automatically collect limited technical data when you visit our website, including IP address, browser type and version, operating system, referring URL, and pages visited. This data is used solely for website security and performance purposes and is not linked to your identity.

We do not use or disclose personal information for purposes other than those for which it was collected, except with your consent or as required or permitted by law.

We do not sell, rent, trade, or otherwise transfer your personal information to third parties for commercial purposes.

We may share personal information with the following categories of service providers, solely to fulfill the purposes described in this policy: • Payment processors (GoDaddy Payments) for credit card transaction processing. • Shipping and logistics carriers for order delivery. • IT and hosting service providers for website infrastructure.

All third-party service providers are bound by confidentiality obligations and are prohibited from using your personal information for any purpose other than providing services to us.

We may disclose personal information without consent where required by law, court order, or governmental authority, or where necessary to protect the safety of any person.

Retention: We retain personal information only as long as necessary to fulfill the identified purposes or as required by law. Order records are retained for a minimum of seven (7) years in accordance with the Canada Revenue Agency's record-keeping requirements. Personal information no longer required is securely destroyed or anonymized.

We take reasonable steps to ensure that personal information is accurate, complete, and up-to-date as necessary for the purposes for which it is used.

If you believe that personal information we hold about you is inaccurate or incomplete, please contact us at [email protected] and we will correct it promptly.

We protect personal information with security safeguards appropriate to the sensitivity of the information. These safeguards include physical, organizational, and technological measures designed to prevent unauthorized access, collection, use, disclosure, copying, modification, or disposal.

Our website uses Transport Layer Security (TLS/HTTPS) encryption for all data transmitted between your browser and our servers.

Access to personal information is restricted to employees and contractors who require it to perform their job functions and who are bound by confidentiality obligations.

No method of electronic transmission or storage is 100% secure. While we implement commercially reasonable safeguards, we cannot guarantee absolute security of your personal information.

We make information about our privacy policies and practices readily available to individuals. This Privacy Policy is publicly accessible at aurapeptide.ca/privacy.

Upon request, we will inform you of the existence, use, and disclosure of your personal information and provide access to that information, subject to applicable legal exceptions.

Upon written request, you have the right to: (a) be informed of the existence, use, and disclosure of your personal information; (b) access your personal information; (c) challenge the accuracy and completeness of your personal information and have it amended as appropriate; and (d) request deletion of your personal information, subject to legal retention obligations.

To submit an access or correction request, contact our Privacy Officer at [email protected] with sufficient detail to identify yourself and the information requested. We will respond within 30 calendar days. In some cases, we may need to verify your identity before processing your request.

We may decline access requests in limited circumstances permitted by PIPEDA, such as where disclosure would reveal personal information about a third party, or where the information is subject to solicitor-client privilege. We will explain the reason for any refusal.

You have the right to challenge our compliance with PIPEDA. To do so, please contact our Privacy Officer at [email protected]. We will investigate all complaints and respond within 30 calendar days.

If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or by calling 1-800-282-1376.

In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm to individuals, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required under PIPEDA and the Breach of Security Safeguards Regulations.

We maintain a record of all security breaches involving personal information, regardless of whether notification is required.

Our website uses only essential session cookies necessary for the website to function (e.g., maintaining your shopping session). We do not use advertising cookies, tracking pixels, or third-party analytics tools.

We do not track your activity across third-party websites. We do not use Google Analytics, Meta Pixel, or any other behavioural tracking technology.

You may disable cookies through your browser settings. Disabling essential cookies may affect the functionality of the website.

Some of our service providers (including GoDaddy Payments) may process or store personal information outside of Canada, including in the United States. When personal information is transferred outside Canada, it may be subject to the laws of the receiving jurisdiction.

We require all third-party service providers to maintain privacy protections substantially similar to those described in this policy, regardless of where they are located.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be indicated by updating the "Last Updated" date at the top of this page. We encourage you to review this policy periodically.

Your continued use of aurapeptide.ca following the posting of changes constitutes your acceptance of the revised policy.

For any questions, concerns, or requests regarding this Privacy Policy or our personal information practices, please contact:

Privacy Officer — Aura Peptide Email: [email protected] Website: aurapeptide.ca

We are committed to resolving privacy concerns promptly and in accordance with PIPEDA.