Data Protection &
Security Policy

This policy applies to all personal data processed through the Aulax platform, including data processed through:

• Aulax mobile applications
• merchant interface systems
• automated checkout infrastructure
• sensor-enabled retail technologies
• platform APIs and backend systems
• cloud-hosted infrastructure.

Aulax processes personal data in accordance with the principles set out in Article 5 of the UK GDPR.

• Lawfulness, Fairness & Transparency — Data processing is clearly communicated to users.
• Purpose Limitation — Data is collected for specific operational purposes.
• Data Minimisation — Only necessary data is processed.
• Accuracy — Data is maintained accurately and updated where necessary.
• Storage Limitation — Data is retained only for necessary periods.
• Integrity & Confidentiality — Security measures protect data from unauthorised access.
• Accountability — Aulax maintains internal records demonstrating compliance.

To operate the platform infrastructure, Aulax may process the following categories of data:

• Identity Data — for example, name, date of birth.
• Contact Data — for example, email address, phone number.
• Account Data — for example, login credentials.
• Transaction Data — for example, purchase history and receipts.
• Device Data — for example, device identifiers and IP address.
• Location Data — for example, GPS or proximity signals where enabled.
• Infrastructure Interaction Data — for example, automated checkout interaction logs.
• Engagement Data — for example, ratings, reviews, and interaction behaviour.

These data categories support:

• transaction processing
• identity verification
• fraud detection
• personalised discovery
• infrastructure optimisation.

Personal data is processed under the lawful bases permitted by UK GDPR.

• Contractual Necessity — enabling platform services.
• Legitimate Interests — platform security and service optimisation.
• Legal Obligation — regulatory compliance and record keeping.
• Explicit Consent — location services and biometric authentication.

Where processing relies on consent, users may withdraw consent at any time.

Certain infrastructure features may utilise biometric technologies for authentication purposes.

Examples may include:

• facial recognition
• biometric identity verification.

Where such processing occurs:

• biometric data will only be processed with explicit user consent
• biometric templates will be encrypted and securely stored
• raw biometric images will not be retained unnecessarily
• biometric authentication can be disabled by the user at any time.

Biometric processing is limited to identity verification and security purposes only.

Because Aulax integrates physical and digital systems, certain infrastructure components may record interaction events occurring within merchant environments.

Examples include:

• automated checkout logs
• QR scanning events
• sensor-based transaction verification.

This data is processed only for:

• transaction verification
• fraud detection
• system integrity monitoring.

Aulax does not conduct continuous physical surveillance or behavioural monitoring of individuals within merchant premises.

Aulax implements layered security measures designed to protect platform infrastructure and personal data.

Security controls include:

• encryption of data in transit using secure protocols
• encryption of sensitive data at rest where applicable
• secure cloud infrastructure
• multi-factor authentication for administrative access
• role-based access control for internal systems
• network monitoring and intrusion detection
• vulnerability scanning and penetration testing
• secure API authentication and validation
• system access logging and audit trails.

Certain Aulax systems process data locally before transmission to central infrastructure.

Examples include:

• automated checkout devices
• scanning terminals
• sensor-enabled infrastructure.

To protect data processed at the edge, Aulax implements:

• device-level encryption
• secure device authentication
• encrypted communication between edge devices and central servers
• tamper detection where supported.

Local data storage on edge devices is minimised wherever possible.

Certain Aulax infrastructure components may be installed within merchant premises.

Merchants are responsible for ensuring that installed hardware is:

• properly installed
• protected from tampering or unauthorised access
• maintained in accordance with platform guidelines.

Aulax is not responsible for security incidents resulting from:

• physical interference with merchant hardware
• unauthorised device manipulation
• improper installation or maintenance.

Aulax may engage trusted third-party providers for services such as:

• payment processing
• cloud hosting
• security monitoring.

Where third parties process personal data on behalf of Aulax:

• contractual safeguards are implemented
• data processing agreements are maintained
• providers are required to comply with recognised security standards.

In certain circumstances, Aulax and participating merchants may jointly determine how certain customer engagement data is used, particularly in relation to:

• marketing communications
• loyalty programs
• promotional campaigns.

Where such processing occurs, Aulax and the relevant merchant may act as Joint Controllers under UK GDPR.

Responsibilities for compliance may be allocated through contractual arrangements.

Personal data is retained only for as long as necessary to fulfil operational or legal obligations.

Typical retention periods include:

• Account Data — duration of account.
• Transaction Records — up to 6 years.
• Security Logs — retained for investigation purposes.
• Marketing Preferences — until consent withdrawal.

Where possible, data may be anonymised for analytical purposes.

Aulax maintains procedures for responding to personal data breaches.

In the event of a breach:

• The incident will be assessed and contained.
• Risk to affected individuals will be evaluated.
• Where legally required, the UK Information Commissioner’s Office (ICO) will be notified within 72 hours.
• Affected individuals will be notified where a high risk to their rights and freedoms exists.
• The incident will be documented and reviewed.

Users and merchants share responsibility for maintaining account security.

Participants must:

• maintain the confidentiality of login credentials
• use strong passwords
• avoid sharing account access
• report suspicious activity.

Aulax is not responsible for security incidents resulting from:

• compromised user devices
• credential sharing
• failure to follow security practices.

Aulax regularly reviews and improves its security controls to address:

• emerging cybersecurity threats
• evolving infrastructure systems
• regulatory developments.

Security measures may be updated as necessary to maintain appropriate protection of personal data.