Privacy Policy

This Privacy Policy explains personal-data handling in connection with Aurora's website and advertising services, including enquiries, accounts, campaign tools, funding and client verification. It covers auroragroup.com, agency-aurora.com, platform.auroragroup.com and associated services that reference this notice. "Aurora Group" is the collective name for:

• 

  Aurora Global Holdings Limited
  Hong Kong

• 

  Aurora Global Limited
  Bulgaria

• 

  Aurora Group Platforms LLC
  Wyoming, United States

Aurora Global Holdings Limited is the controller of the personal data described in this notice, as set out below, including where it is handled for the group by the other companies listed. This notice provides information; merely using a website is not consent to every type of processing or optional tracking.

The data controller responsible for your personal data is:

Aurora Global Holdings Limited decides why and how personal data is used for website enquiries, customer-account administration, billing and client verification. The other group companies listed above may handle that data on its behalf.

Use support@auroragroup.com for any data-protection enquiry, request to exercise your rights, or complaint.

Where Aurora handles an advertiser's customer, audience or conversion data solely on that advertiser's documented instructions, the advertiser may be the controller and Aurora a processor. The applicable data-processing agreement, including any distinct independent-controller activities, must reflect the actual arrangement.

2.1 Information you provide

Depending on the service, this may include contact details, business registration information, account users and permissions, enquiries, support messages, advertising content, campaign settings and transaction records. Do not send identity documents through a general website enquiry form; use the verification route we specify when documentation is requested.

2.2 Client and advertiser verification

For KYC, KYB, fraud prevention and sanctions checks, we may request relevant identity, address, registration, ownership, control, authority, licensing and funding-source evidence. Checks may concern the customer, underlying advertiser, beneficial owners, directors, authorised users and payers. We may obtain relevant information from company registries, sanctions lists, lawful public sources, specialist providers and payment counterparties.

We may record screening results, risk indicators, supporting evidence and review decisions. Requests and use must be necessary and proportionate. Some information is required to provide a service or satisfy a legal requirement; we will explain this when requesting it. Refusal or incomplete information can prevent onboarding, a transaction or continued access.

2.3 Payments and transactions

We may handle billing contacts, invoices, payment references, account balances, currency and funding records. Payment providers handle the payment details required by their service. Where cryptocurrency funding is used, wallet addresses, transaction hashes, amounts, timestamps and relevant screening results may be processed. Public blockchain entries cannot be erased by Aurora; our ability to remove an internal link to an individual is subject to lawful retention requirements.

2.4 Advertising and platform use

Depending on the tools used and permissions granted, we may process connected account identifiers, campaigns, creative assets, instructions, prompts, reports, audience or conversion events and integration records. The relevant service documentation and data-processing terms must explain the roles and permitted use of advertiser or end-user data.

2.5 Website connections and cookies

Page delivery and security can involve technical connection information, such as IP address, browser information and request logs. With your consent, we use Google Analytics to measure visits and engagement, and Meta Pixel for advertising measurement and, where enabled, audiences. These optional purposes have separate consent choices. See the Cookie Policy for technologies, retention information and how to manage your choices. Separate application or service notices apply to technologies used in the signed-in product.

The lawful basis depends on the purpose, the relevant person and the applicable law; these are not interchangeable permissions to use data for any purpose.

3.1 Services and enquiries

We use information needed to take requested steps or perform a contract with an individual. For business representatives and contacts who are not personally party to the contract, our legitimate interests may support administering the business relationship, answering enquiries and providing services, subject to their rights.

3.2 Legal requirements and compliance

We rely on a legal obligation where a specific applicable law requires processing, such as certain sanctions, accounting or regulatory duties. Risk-based verification or fraud prevention that is not legally mandated may instead rely on our legitimate interests, after considering necessity and the effect on individuals. An advertising platform's contractual requirement is not automatically a statutory legal obligation.

3.3 Security and legitimate interests

Our relevant interests include protecting accounts and funds, preventing fraud and misuse, maintaining services, resolving disputes and establishing or defending legal claims. We assess necessity and balance those interests against individual rights. You may object where applicable.

3.4 Consent and restricted data

Where consent is required for marketing, tracking or another purpose, we request it separately and allow withdrawal without affecting earlier lawful use. We will identify any additional legal condition required for special-category or criminal-offence data before processing it; a general verification clause does not itself supply that condition.

We use relevant information to answer enquiries; administer authorised accounts and workspaces; deliver requested advertising tools; process funding and billing; investigate errors; verify businesses, identities and authority; screen applicable sanctions risks; prevent fraud and policy breaches; and meet legal obligations.

Account, campaign and transaction records can be used to investigate non-compliant advertising and explain a restriction or billing decision. We may send necessary security, account and compliance notices. Marketing communications have their own applicable permissions and opt-out options. We do not treat acceptance of the Terms as blanket marketing consent.

Information may be shared on a need-to-know basis with the relevant Aurora entities; hosting, communications and support providers; payment and wallet providers; verification and screening services; and advertising platforms involved in your requested service or a compliance review. Sharing must have a lawful basis and be limited to what is needed.

Some recipients act as processors under our instructions; others, including certain advertising platforms, payment providers and authorities, determine their own purposes as independent controllers. Their role must be assessed rather than describing every provider as our processor.

We may disclose relevant advertiser, ownership, campaign, payment or verification information to a platform when necessary and lawful for verification, fraud prevention or enforcement of its policies. We may respond to lawful authority requests and make required reports; notice may be restricted by law. Business transfers may involve necessary disclosures with appropriate safeguards.

Website recipients include Google for analytics and Meta for advertising measurement, subject to your choices described in the Cookie Policy. Contact support@auroragroup.com for information about recipients, their roles and processing locations relevant to your data.

Aurora's entities are in Hong Kong, Bulgaria and the United States. The services you use and their providers determine where data is processed; location outside your country may involve different legal protections.

Where a restricted international transfer occurs, the responsible controller or processor must establish the applicable lawful mechanism, such as an applicable adequacy decision or appropriate contractual safeguards, and any required assessment or supplementary measures. General acceptance of this notice is not a substitute for those requirements.

You can ask support@auroragroup.com about the countries and safeguards relevant to your data and request a copy of the applicable safeguards, subject to lawful redactions.

We retain data only for a justified purpose and period. The period depends on the category, service, contracting entity, applicable record-keeping rules and any live dispute or investigation:

• Enquiries and support records: for handling the request and a justified follow-up or dispute period.
• Account and access records: while needed to administer the relationship, security and closure.
• Invoices, funding and transaction records: for the applicable accounting, tax and legal record-keeping period.
• Verification and screening evidence: for the applicable legal requirement or documented fraud-prevention and claims period, with unnecessary identity evidence removed when no longer needed.
• Advertiser data handled as processor: under the agreed instructions and deletion or return terms.
• Marketing preferences: while relevant, including a minimal suppression record where needed to honour an opt-out.

A legal hold may extend retention of relevant records, with access restricted and the reason reviewed. We delete or anonymise data when the justified period ends, subject to backup cycles and legal requirements. A single assumed six-year minimum does not apply automatically to every category in every jurisdiction.

We are responsible for appropriate technical and organisational measures reflecting the nature and risk of processing. These should cover access controls, secure transmission, provider oversight, incident handling and review of permissions. No service can promise absolute security; this does not remove applicable security obligations.

Protect your account credentials and notify support@auroragroup.com promptly if you suspect a security issue. Do not include identity documents, payment credentials or unnecessary personal data in an initial report.

Depending on the applicable law and processing, you may have the following rights:

• Right of access. Obtain confirmation of whether we process your personal data and request a copy of it.

• Right to rectification. Request correction of inaccurate or incomplete personal data.

• Right to erasure. Request deletion of your personal data, subject to our legal retention obligations.

• Right to restriction. Request that we restrict the processing of your personal data in certain circumstances.

• Right to portability. Receive your personal data in a structured, commonly used, machine-readable format.

• Right to object. Object to the processing of your personal data where we rely on legitimate interests as the lawful basis.

• Right to withdraw consent. Where processing is based on consent, withdraw that consent at any time.

• Right to lodge a complaint. Lodge a complaint with the relevant supervisory authority in your jurisdiction.

Contact support@auroragroup.com to exercise rights, object to processing, withdraw consent or request human review where applicable. We may request proportionate information to establish identity, but will not automatically require an identity-document copy for every request. We respond within the applicable legal deadline and explain any permitted extension or limitation.

You may complain to the competent data-protection authority, including an authority in your place of residence or work where applicable. Relevant authorities can include Bulgaria's Commission for Personal Data Protection, Hong Kong's Privacy Commissioner for Personal Data and the UK Information Commissioner where their jurisdiction applies. You do not have to complete our complaints process before exercising a statutory complaint right.

Automated screening and risk indicators may assist with verification, transaction review and fraud prevention. They can flag an account, payment or advertiser for investigation. False matches are possible, so supporting information and the context of a match matter.

Where an activity involves a solely automated decision with legal or similarly significant effects, the applicable notice must explain that decision, its lawful basis, its significance and the safeguards required by law. Contact support@auroragroup.com to request an explanation, provide information, contest a result or seek human review where applicable. An advertising platform may make its own decisions under its separate policies.

Our platform and services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children under 18. If you become aware that a child has provided us with personal information, please contact us and we will take steps to delete that information and terminate the associated account.

The platform may contain links to third-party websites, services, or platforms (including advertising networks, social media platforms, and payment processors). Aurora Group is not responsible for the privacy practices or content of these third-party services. We encourage you to review the privacy policies of any third-party service you interact with.

Our platform may include links and features connected to social media platforms. We recommend reviewing the privacy policies of each platform:

• Meta (Facebook/Instagram)facebook.com/privacy/explanation (opens in a new tab)
• Googlepolicies.google.com/privacy (opens in a new tab)
• TikToktiktok.com/legal/privacy-policy (opens in a new tab)
• Snapchatsnap.com/en-US/privacy/privacy-policy (opens in a new tab)
• X (formerly Twitter)twitter.com/en/privacy (opens in a new tab)

We will assess personal-data incidents and notify the relevant authority and affected people where required by applicable law, within its applicable deadlines. Where acting as a processor, we must notify the relevant controller without undue delay under the agreed data-processing terms. A notification will explain the incident and appropriate protective steps as required.

Where Aurora is a processor for an advertiser, its data-processing agreement must address instructions, confidentiality, security, authorised subprocessors, assistance with rights and incidents, international transfers, and deletion or return of data. The current subprocessor list must identify the actual providers, functions and locations and reflect the agreed change-notification process.

Where a group company acts as controller, it is responsible for the relevant processor contracts and any required record of processing activities. This privacy notice does not replace those agreements or establish that every group company has the same role.

We may update this notice to reflect changes to services, practices or law. Material changes will be brought to your attention through appropriate notices. A revised notice does not itself create consent for a new purpose; we will obtain fresh consent or establish another lawful basis where required. The date above records the latest revision.

For privacy requests concerning any of the listed entities, contact support@auroragroup.com. Identify the service or account involved so the request can be directed to the responsible company. Our website is auroragroup.com.