Privacy Policy

Aurora Hikma Marketing Management LLC

Last updated: July 19, 2026 · Effective date: July 19, 2026

1. Introduction

Aurora Hikma Marketing Management LLC ("Aurora Hikma," "we," "us," or "our") is committed to protecting the privacy of everyone who visits our website at https://www.aurorahikma.com (the "Website"), purchases our digital products, or registers for our online and in-person workshops (together, our "Services").

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the rights you have over it. It applies to personal data processed in connection with our Website and Services.

We are the data controller responsible for your personal data. For any privacy questions, contact us using the details in Section 15.

2. Legal framework

We process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and its implementing regulations, as the UAE's federal data protection law applicable to our business.

Where you access our Services from outside the UAE, we aim to handle your personal data to a standard consistent with the rights described in this Policy. If you are located in a jurisdiction with its own data protection law (for example, the EU/UK under the GDPR), you may hold additional rights under that law; contact us and we will do our best to honor them.

3. The personal data we collect

We collect the following categories of personal data, depending on how you interact with us:

Information you give us directly

• Identity and contact data: name, email address, phone number, country/city, company or organization name, and job title.
• Account and enrollment data: the digital products you purchase, the workshops you register for, and any preferences you set.
• Payment data: billing name, billing address, and transaction records. Card and bank details are collected and processed directly by our payment provider — we do not store full card numbers on our own systems (see Section 7).
• Workshop participation data: for in-person workshops, any information you choose to share about accessibility needs or dietary requirements; for online workshops, your display name and any questions or contributions you submit during the session.
• Communications: the content of messages you send us through contact forms, email, WhatsApp, or social channels, and our correspondence with you.
• Marketing preferences: your consent to, or opt-out from, our newsletters and marketing communications.

Information we collect automatically

• Usage and device data: IP address, browser type, device type, operating system, referring URLs, pages viewed, time spent, and similar analytics data, collected through cookies and comparable technologies (see Section 6).

Information we receive from third parties

• Analytics, advertising, and social media platforms; payment providers; and email/marketing platforms may share limited data with us in connection with the Services described above.

We do not intentionally collect sensitive personal data (such as data revealing health, religious belief, or political opinion). Please do not send us sensitive data unless it is strictly necessary — for example, an accessibility requirement for an in-person workshop — in which case we process it only to accommodate your request and with your consent.

4. How and why we use your personal data

We use your personal data for the following purposes, each with a lawful basis under the PDPL:

We will not use your personal data for a new, incompatible purpose without informing you and, where required, obtaining fresh consent.

5. Marketing communications and consent

We send marketing emails (including our newsletter and information about digital products and workshops) only where you have opted in.

You can withdraw consent and unsubscribe at any time by clicking the unsubscribe link in any marketing email, or by contacting us at hello@aurorahikma.com. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it, and does not stop us from sending you non-marketing service messages (for example, a workshop joining link or a purchase receipt).

6. Cookies and similar technologies

Our Website uses cookies and similar technologies to make the site work, remember your preferences, and understand how the site is used.

Essential cookies. These are necessary for the Website to function — for example, to keep you signed in or to remember your cookie preferences. They cannot be switched off.

Analytics and performance cookies. These help us understand how visitors find and use the Website so we can improve it. We use:

• Google Analytics 4 (Google LLC) — measures Website traffic and usage.
• Microsoft Clarity (Microsoft Corporation) — heatmaps and session replays that show us how visitors interact with pages.

Advertising and campaign measurement cookies. These allow us and the platforms listed below to measure the performance of our campaigns and to show you relevant advertising on those platforms. We use:

• Meta Pixel (Meta Platforms) — for Facebook and Instagram campaign measurement and audiences.
• TikTok Pixel (TikTok) — for TikTok campaign measurement and audiences.
• LinkedIn Insight Tag (LinkedIn Corporation) — for LinkedIn campaign measurement and audiences.

Please note that the advertising platforms above do not act solely on our instructions. They also use the data collected through these technologies for their own purposes, including ad targeting and audience building across their services, and they determine those purposes independently of us. This means they are responsible in their own right for that processing, and we recommend reviewing their privacy policies to understand it and to use the controls they offer.

We ask for your consent before setting any analytics or advertising cookies, and none of them are set unless you agree. You can change or withdraw your preferences at any time through our cookie banner or your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.

7. Sharing your personal data

We do not sell your personal data. We share it only with the following categories of recipients, and only as needed to run our Services:

• Payment provider — Stripe, to process your payments securely and to help detect and prevent fraud. Stripe collects your card details directly; we receive only a transaction record and limited billing information.
• Email and marketing platform — Brevo, to send our newsletters and service emails and to manage your subscription preferences.
• Website hosting and infrastructure — Vercel (hosting and delivery of the Website and digital products) and Supabase (database and asset storage).
• Analytics and advertising platforms — as described in Section 6.
• Online workshop platform — Google Workspace (Google Meet), to host our virtual sessions and to share workshop materials and correspondence.
• Appointment scheduling — Cal.com, when you book a consultation through our booking links.
• Professional advisors — accountants, auditors, and lawyers, where necessary.
• Authorities — where we are legally required to disclose data to comply with UAE law or a valid legal request.

Where these parties act as our data processors — including Stripe, Brevo, our hosting providers, and Google Workspace — we require them by contract to protect your personal data and to process it only on our instructions and in line with the PDPL. The advertising platforms named in Section 6 are not processors in this sense, for the reasons explained there.

8. International data transfers

Some of the providers listed in Sections 6 and 7 are located outside the UAE, including in the United States and the European Union — Stripe, Google, Microsoft, Meta, TikTok, LinkedIn, Vercel, Supabase, and Cal.com all process data outside the UAE, and Brevo is established in the European Union. Where we transfer your personal data outside the UAE, we do so in accordance with the PDPL's cross-border transfer rules — for example, where the destination country provides an adequate level of protection, under contractual safeguards requiring PDPL-consistent protection, or with your explicit consent where applicable.

9. How long we keep your personal data

We keep your personal data only for as long as necessary for the purposes set out in this Policy, including to satisfy any legal, accounting, or reporting requirements. In general:

• Purchase and payment records are kept for 7 years, to satisfy UAE tax and accounting record-keeping requirements.
• Workshop registration records are kept for 24 months after the workshop.
• Marketing contacts are kept until you unsubscribe or ask us to delete your data, after which we may retain a minimal suppression record so we do not contact you again.
• Website analytics data is retained for 14 months.

When personal data is no longer needed, we securely delete or anonymize it.

10. How we protect your personal data

We apply appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, misuse, or alteration — including encryption in transit, access controls, and limiting access to those who need it. No method of transmission or storage is completely secure, but we work to protect your data and to review our safeguards regularly. In the event of a personal data breach that poses a risk to your rights, we will notify the competent UAE authority and, where required, affected individuals.

11. Your rights

Under the PDPL, you have the following rights over your personal data, subject to the conditions and exceptions in the law:

• Right to be informed about how your data is processed.
• Right of access to the personal data we hold about you.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure of your personal data in certain circumstances.
• Right to restrict or stop processing in certain circumstances.
• Right to data portability — to receive your data in a structured, machine-readable format.
• Right to object to certain processing, including direct marketing.
• Right to withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at hello@aurorahikma.com. We will respond within the period required by law. There is normally no charge, and we may need to verify your identity before acting on your request.

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the UAE data protection authority (the UAE Data Office).

12. Children's privacy

Our Services are intended for adults and are not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

13. Third-party links

Our Website may contain links to third-party websites, platforms, or communities (including social media and messaging groups). This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policy of any third-party service you use.

14. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Please review this Policy periodically.

15. Contact us

If you have questions about this Policy or how we handle your personal data, or if you wish to exercise your rights, contact us:

• Aurora Hikma Marketing Management LLC
• Email: hello@aurorahikma.com
• Address: Office 20, 4th Floor, Rasis Business Center, Al Barsha 1, Dubai, United Arab Emirates

16. Governing law

This Policy is governed by the laws of the United Arab Emirates, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its implementing regulations.