The short version
- [Legal business name] runs Pacha Harvest and is responsible for your personal data.
- We collect what we need to sell and deliver your order, run your account and answer your messages.
- We share data only with the companies that help us do that, such as Izipay for card payments and Serpost for shipping. We never sell it.
- You can ask to see, correct or delete your data at any time by writing to hello@pachaharvest.com.
Who we are
Pacha Harvest (pachaharvest.com) is run by [Legal business name], RUC [RUC], [Registered address], Lima, Peru. We’re the controller of the personal data described in this policy. Contact: hello@pachaharvest.com, phone [Phone].
What we collect
- Order details: name, email, phone, shipping and billing address, the products you buy and your order history.
- Account details: your email and password (stored encrypted), and saved addresses.
- Payment details: card payments are handled by Izipay. We don’t see or store your full card number; we receive a confirmation and, sometimes, the card type and last four digits. If you pay by money transfer, we keep the sender’s name, the amount and the transfer reference to match the payment to your order.
- Messages: what you send us through the contact form or by email.
- Newsletter: your email address, if you subscribe.
- Reviews: the name and text you choose to publish.
- Technical data: IP address, browser, device and pages visited, collected through cookies. See our cookie policy.
Why we use it
| Purpose | Legal basis |
|---|---|
| Process, ship and support your order, including customs declarations | Performing our contract with you |
| Run your account | Performing our contract with you |
| Keep invoices and accounting records | Legal obligation |
| Prevent fraud and keep the site secure | Our legitimate interests |
| Answer your messages | Our legitimate interests, or steps before a contract |
| Handle claims in our Libro de Reclamaciones (complaints book) | Legal obligation under Peru’s Consumer Protection Code |
| Send the newsletter | Your consent, which you can withdraw at any time |
| Analytics cookies, if enabled | Your consent |
Who we share it with
We share personal data only with providers that help us run the shop, and only what each one needs:
- Payment provider (Izipay), to take card payments.
- Money transfer services (Western Union or Remitly), only if you choose to pay that way. You use their service directly, under their own terms and privacy policy; we receive the payment and its reference.
- Postal services: Serpost (Servicios Postales del Perú) and the postal service in your country, to deliver your parcel.
- Customs authorities: SUNAT in Peru, for the export declaration, and customs in your country, to clear the parcel.
- Hosting and email providers ([Hosting provider], [Email provider]), to run the website and send emails.
- Analytics provider ([Analytics provider, if used]), only if you accept analytics cookies.
- Authorities, when the law requires it, for example INDECOPI if it asks for a copy of a claim.
We never sell your personal data.
International transfers
We’re based in Peru, and some of our providers are in other countries. Your data may therefore be processed outside your country. When that happens, we use providers that protect it with appropriate safeguards, such as standard contractual clauses.
How long we keep it
- Orders and invoices: [number] years, as required by Peruvian tax law.
- Account: until you delete it, or after 3 years without activity.
- Messages: up to 2 years after the conversation ends.
- Complaints Book claims: at least 2 years, as Peruvian law requires.
- Newsletter: until you unsubscribe.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, limit or object to how we use it, or send it to another company. You can withdraw your consent at any time, for example by unsubscribing from the newsletter.
Write to hello@pachaharvest.com. We’ll reply within one month. If you’re not satisfied, you can complain to your data protection authority, for example the Information Commissioner’s Office (ICO) in the UK, or Peru’s Autoridad Nacional de Protección de Datos Personales under Law 29733.
Security
The site uses an encrypted connection (HTTPS), passwords are stored encrypted, and only the people who need your data to do their job can access it.
Children
Our shop is for adults. We don’t knowingly collect data from anyone under 18.
Changes to this policy
If we change this policy, we’ll update the date at the top of the page. If the change is important, we’ll also tell you by email or on the site.