Privacy Policy

1. Identity and Contact Details of the Controller

Controller: Aurenox LLC

Registered address: WY Commercial Registered Agent LLC, 75 E 3rd Street, Suite 7, Sheridan, Wyoming 82801, United States

Contact for privacy matters: legal@aurenox.xyz

We conduct core contracting and data processing decisions through our Wyoming entity. We have no fixed establishment in the European Union. An EU Representative has been (or will be) designated in writing under GDPR Article 27 to serve as a contact point for supervisory authorities and data subjects on all processing-related matters (details available upon request). No Data Protection Officer is currently appointed, as our processing activities do not involve large-scale monitoring of special categories of data.

2. Categories of Personal Data We Process

We may collect:

• Contact & identification data: name, email address, phone number, company name, job title.
• Communication & service data: messages, inquiry details, sparring notes, briefing materials, engagement-related information.
• Technical data: IP address, browser type, device information, cookies (see Cookie section below).
• Usage data: pages visited, time spent, referral sources (if analytics implemented).

We do not intentionally collect sensitive/special category data unless you voluntarily provide it in the context of a specific assignment.

3. Purposes and Legal Bases for Processing (GDPR Art. 6)

We process personal data on the following bases:

• Contract performance (Art. 6(1)(b)): to deliver advisory services, respond to inquiries, and fulfil Engagement Letters.
• Legitimate interests (Art. 6(1)(f)): to operate and improve the website, communicate business information, market our services (where not overridden by your rights), and anonymously showcase past work examples.
• Consent (Art. 6(1)(a)): for non-essential cookies, marketing newsletters (if any), or other optional activities. Consent is freely given, granular, and withdrawable at any time.
• Legal obligation (Art. 6(1)(c)): where required by law (e.g., tax or anti-money laundering records).

4. Recipients / Categories of Recipients

We share data only with:

• Service providers and processors (e.g., hosting provider, Cal.com for bookings, email service providers, payment processors) bound by data processing agreements.
• Independent contractors and freelance professionals engaged on a project basis under strict confidentiality and data processing agreements to assist in delivering advisory services.
• Professional advisers (lawyers, accountants) where necessary.
• Public authorities where legally required.

We do not sell personal data.

5. International Transfers (Outside EEA / Paraguay)

As a US-based entity with a fully remote and international operational model, personal data may be processed in the United States or in other locations where our team members or contractors are temporarily located. All transfers outside the EEA or Paraguay are safeguarded by:

• Standard Contractual Clauses (2021 SCCs, appropriate modules) supplemented by technical and organisational measures.
• Adequacy decisions where available.

Client-specific Data Processing Addenda / SCCs will be included in Engagement Letters.

6. Retention Periods

We retain personal data only as long as necessary for the purposes set out above or as required by law:

• Service-related data: for the duration of the engagement plus a reasonable period thereafter (up to 7 years) for legal defence, accounting, or contractual purposes.
• Inquiry/contact data: up to 24 months unless you become a client.
• Cookies/technical data: see Cookie section.

Upon written request after completion of an assignment, we will delete or anonymise client-associated data (subject to applicable legal retention obligations and contractor agreements).

7. Your Data Subject Rights

Under GDPR and Paraguay Law 7593/25 you have the right to:

• Access, rectification, erasure (“right to be forgotten”), restriction, portability.
• Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent at any time (does not affect the lawfulness of prior processing).
• Lodge a complaint with your local supervisory authority (e.g., the Dutch Autoriteit Persoonsgegevens, Spanish AEPD, or Paraguay’s Agencia Nacional de Protección de Datos Personales once operational).

To exercise any of these rights, contact legal@aurenox.xyz. We will respond without undue delay and in any event within one month (extendable where permitted by law in complex cases).

8. Automated Decision-Making & Profiling

We do not engage in solely automated decision-making that produces legal or similarly significant effects.

9. Security

We implement appropriate technical and organisational measures (including encryption, access controls, and contractual safeguards with processors and contractors) to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage.

10. Children’s Data

Our services are not directed at children under 16. We do not knowingly process children’s personal data.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via the website and, where appropriate, by direct communication. Continued use of our Site or Services after such changes constitutes your acceptance of the updated Policy.

12. Governing Law & Contact

This Policy is governed by the same rules as our Terms of Use (Wyoming law with mandatory local consumer carve-outs for EU and Paraguay residents).

For any questions or to exercise your rights: legal@aurenox.xyz