Aura will acknowledge receipt of the request, verify the requester’s identity using proportionate and secure methods, locate data associated with verified identifiers, determine whether Aura acts as data controller or data processor, delete or anonymise eligible data, instruct applicable service providers and subprocessors to delete eligible copies where required, and confirm completion or explain any lawful reason that prevents full deletion. Where Aura processes data on behalf of a salon, clinic, or other business, that business is normally the data controller. Aura may forward the request to the relevant business or assist it in completing the request.