Privacy Policy

Last updated: September 2026

1. Controller
The controller responsible for data processing on this website is:

Sebastian Alexis Valdivia Riveros, trading as PeruvianCultures
Lima 120, Vallecito
04001 Arequipa
Peru
Email: peruvianculturesperu@gmail.com
Phone: +49 157 75556451

Our offering is directed at customers in the European Union. We are therefore subject to the General Data Protection Regulation (GDPR) under the marketplace principle (Art. 3(2) GDPR).

2. General information
We process personal data exclusively within the scope of legal provisions. Personal data means any information that can be used to identify you personally.

3. Transfer to a third country (Peru)
Our business is based in Peru. There is no adequacy decision by the European Commission for Peru under Art. 45 GDPR. The transfer of your data to Peru therefore takes place on the basis of appropriate safeguards pursuant to Art. 46 GDPR, in particular the European Commission's Standard Contractual Clauses, and — where necessary for the performance of the contract — on the basis of Art. 49(1)(b) GDPR.

Only the data required to process your order is transferred: name, delivery address, email address, telephone number and order details.

4. Hosting and shop system (Shopify)
This website is operated on the platform of Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes order, customer and usage data on our behalf. A data processing agreement under Art. 28 GDPR is in place. Transfers to Shopify Inc. in Canada and the United States may occur, based on the Standard Contractual Clauses.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in a secure and efficient online service).

5. Server log files
When you access our website, the following information is automatically recorded: IP address, date and time of access, page accessed, browser type and operating system, referrer URL. This data serves the technical provision and security of the website and is not merged with other data sources.

Legal basis: Art. 6(1)(f) GDPR.

6. Cookies and consent
Our website uses cookies. Technically necessary cookies (e.g. shopping cart, language setting, security functions) are used on the basis of Section 25(2) TDDDG and Art. 6(1)(f) GDPR.

All other cookies and technologies — in particular for analytics and marketing — are only used after your express consent via our cookie banner. Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future by reopening the cookie settings on our website.

7. Order processing
To process your order we handle: first and last name, billing and delivery address, email address, telephone number, order and payment data. We pass this data on to the payment provider and the shipping provider insofar as this is necessary to perform the contract.

Legal basis: Art. 6(1)(b) GDPR. Retention in accordance with commercial and tax law (Section 257 HGB, Section 147 AO) for six and ten years respectively.

8. Payment provider (PayPal)
If you pay via PayPal, your payment data is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg. PayPal's privacy policy applies additionally: https://www.paypal.com/en/webapps/mpp/ua/privacy-full

Legal basis: Art. 6(1)(b) GDPR.

9. Shipping (DHL)
To deliver your order we transmit your name, delivery address and — where provided — email address and telephone number to our shipping provider DHL and to the customs and postal authorities involved.

Legal basis: Art. 6(1)(b) GDPR.

10. Contacting us
If you contact us via the contact form, by email or via WhatsApp, we process the data you provide in order to handle your enquiry.

For communication via WhatsApp, the privacy policy of WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland applies additionally: https://www.whatsapp.com/legal/privacy-policy-eea. Please note that WhatsApp processes metadata and that data may be transferred to the United States. If you wish to avoid this, please contact us by email.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR.

11. Newsletter
We use the double opt-in procedure for our newsletter: after signing up you will receive a confirmation email. Only after you confirm do we add you to the mailing list. We store your email address and the time of sign-up and confirmation.

You can unsubscribe at any time via the unsubscribe link in every email or by messaging us.

Legal basis: Art. 6(1)(a) GDPR.

12. Google Analytics 4
Subject to your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and processes usage data such as pages viewed, time on site and truncated IP address. IP anonymisation is enabled. Transfers to Google LLC in the United States may occur, based on the Standard Contractual Clauses and the EU-US Data Privacy Framework.

Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time via our cookie settings.

Further information: https://policies.google.com/privacy

13. Google Search Console
We use Google Search Console to analyse the visibility of our website in Google Search. Only aggregated, non-personal data is processed.

Legal basis: Art. 6(1)(f) GDPR.

14. Customer reviews (Judge.me)
To collect and display product reviews we use Judge.me (Judge.me Ltd., 128 City Road, London, EC1V 2NX, United Kingdom). When you submit a review we process your name or pseudonym, your email address and the content of the review. An adequacy decision by the European Commission exists for the United Kingdom.

Legal basis: Art. 6(1)(a) GDPR or Art. 6(1)(f) GDPR.

15. Shop extensions in use
To display and operate our shop we use applications acting on our behalf, including PageFly (page design), Dondy (WhatsApp contact function), Avada and Webrex (search engine optimisation), as well as applications for currency display and product import. These process technical usage data insofar as this is necessary for their function.

Legal basis: Art. 6(1)(f) GDPR; for functions requiring consent, Art. 6(1)(a) GDPR.

16. SSL/TLS encryption
For security reasons this website uses SSL/TLS encryption. You can recognise an encrypted connection by the "https://" in your browser's address bar.

17. Your rights
You have the right at any time to:
- Access the data stored about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Withdraw consent given, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, a message to peruvianculturesperu@gmail.com is sufficient.

18. Right to object (Art. 21 GDPR)
You have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data carried out on the basis of Art. 6(1)(f) GDPR. Where your data is processed for direct marketing purposes, you may object at any time without giving reasons.

19. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.

20. Retention period
We store personal data only for as long as is necessary for the purposes stated or as required by statutory retention periods. The data is then deleted.

21. Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy so that it always complies with current legal requirements or to implement changes to our services.