Privacy Policy

AYA 🌺 Pacha Cacao ®

Privacy Policy

Last updated: 16 October 2026

At AYA 🌺 Pacha Cacao ®, we believe that trust, transparency, and reciprocity are essential to every relationship.

This Privacy Policy explains how we collect, use, store, and share personal information when you visit https://ayapachacacao.com, purchase our products, subscribe to our newsletter, or contact us.

We are committed to treating your personal information responsibly and using it only for legitimate, clearly explained purposes.

1. Who We Are

This online store is operated by:

• Legal business name: [INSERT FULL UK-REGISTERED LEGAL ENTITY NAME]

• Trading name: AYA 🌺 Pacha Cacao ®

• Company registration number: [INSERT NUMBER, IF APPLICABLE]

• Registered office: [INSERT FULL REGISTERED ADDRESS]

• Privacy contact email: [INSERT PRIVACY CONTACT EMAIL]

• Website: https://ayapachacacao.com

In this policy, “AYA Pacha Cacao”, “we”, “us”, and “our” refer to the legal entity identified above.

We act as the data controller for personal information processed for our own business purposes, such as managing orders, customer relationships, and marketing communications.

2. Personal Information We Collect

The information we collect depends on how you interact with our website.

Information you provide

This may include:

• Name and surname.

• Email address and telephone number.

• Billing and delivery addresses.

• Order details, purchase history, and transaction references.

• Messages, enquiries, feedback, and customer service correspondence.

• Newsletter subscriptions and communication preferences.

Payment information

Payments are processed through the payment provider selected at checkout. That provider may collect payment card details and other information needed to authorise transactions and prevent fraud.

We do not intend to store full payment card details on our own systems. The information we receive depends on the payment provider and checkout configuration.

Technical and website information

When you visit our website, we may collect technical information such as:

• IP address and approximate location.

• Browser type, device information, and operating system.

• Pages visited and interactions with the website.

• Referral sources and website usage information.

• Cookie identifiers and analytics information, where enabled.

Newsletter information

If you subscribe to our newsletter, we may collect your name, email address, subscription status, communication preferences, and information about engagement with our emails where available.

We use Flodesk to manage newsletter communications.

3. How We Use Your Information

We use personal information for the following purposes.

Order processing and fulfilment

• Process purchases and payments.

• Prepare, pack, and dispatch orders.

• Arrange delivery and provide tracking information.

• Respond to customer enquiries and manage returns or complaints.

International shipping and customs

• Prepare shipping labels and customs declarations.

• Provide necessary information to carriers, customs brokers, and relevant authorities.

• Facilitate customs clearance and delivery.

Website operation and security

• Maintain and improve website functionality.

• Protect against fraud, misuse, and unauthorised access.

• Diagnose technical issues and monitor website performance.

Newsletter and marketing

• Send newsletters, product updates, educational resources, and information about events or conservation initiatives, where permitted by law.

• Manage subscriptions and unsubscribe requests.

• Understand newsletter engagement where appropriate.

Analytics

• Use Google Analytics, where enabled and configured, to understand website traffic and how visitors interact with our online store.

Legal and administrative obligations

• Maintain financial and business records.

• Comply with applicable tax, accounting, customs, and other legal requirements.

• Establish, exercise, or defend legal claims when necessary.

We will not use your personal information for materially different purposes without providing any additional information and obtaining consent where required.

4. Our Legal Basis for Processing

Where the UK GDPR or other applicable data protection legislation applies, we rely on the appropriate lawful basis for each processing activity.

These may include:

Contract: Processing information needed to fulfil your order or provide a service you request.

Legal obligation: Keeping records and meeting applicable tax, accounting, customs, and legal requirements.

Consent: Sending certain marketing communications and using non-essential cookies or analytics technologies where consent is required.

Legitimate interests: Maintaining website security, preventing fraud, responding to enquiries, and managing our business, provided these interests do not override your rights and freedoms.

Where processing relies on consent, you may withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.

5. Who We Share Your Information With

We share personal information only where necessary for the purposes described in this policy or where legally required.

Depending on the services used to operate our store, recipients may include:

• Website hosting: Hostinger and relevant technical service providers.

• Store and checkout services: Hostinger - Stripe

• Payment providers: The provider processing your chosen payment method.

• Shipping and logistics providers: Companies responsible for delivery, tracking, and international transport.

• Customs authorities and brokers: Where information is required for international shipments.

• Newsletter services: Flodesk, which supports our email communications.

• Analytics services: Google Analytics, where enabled.

• Professional advisers and public authorities: Where disclosure is necessary to comply with legal obligations or protect our rights.

Some providers process information on our behalf, while others may process information under their own privacy responsibilities. The applicable roles depend on the service and processing activity.

We do not sell your personal information to third parties for their own direct marketing purposes.

6. International Transfers

AYA 🌺 Pacha Cacao ® serves customers internationally. Some of our service providers may store or process personal information outside the United Kingdom, including in countries where their systems or operational teams are located.

For international orders, relevant information may also be transferred to the destination country to facilitate shipping and customs clearance.

Where applicable law requires safeguards for international transfers, we will implement an appropriate mechanism, such as an applicable adequacy decision or approved contractual safeguards.

Further information about relevant safeguards may be requested using the privacy contact details provided in Section 1.

7. Cookies and Google Analytics

Our website may use cookies and similar technologies to operate the store, maintain security, remember preferences, and understand website usage.

These may include:

• Essential cookies: Support core functions such as shopping cart operation, checkout, and security.

• Preference cookies: Remember settings where this functionality is enabled.

• Analytics cookies: Help us understand how visitors use our website through Google Analytics, where enabled.

We will obtain consent before setting non-essential analytics cookies where required by applicable law. You should be able to reject non-essential cookies as easily as you can accept them.

You may change your preferences through the website's cookie settings, where available. You can also manage cookies through your browser, although blocking essential cookies may affect store functionality.

Google Analytics may process information such as online identifiers, device and browser details, pages visited, and interactions with the website. Its actual data collection depends on our configuration and consent settings.

Google may process information in accordance with its own privacy terms. For more information, see Google's Privacy Policy.

Before publication: Verify that Google Analytics is configured to respect applicable consent choices, that the cookie banner accurately reflects the technologies used, and that non-essential tracking does not start prematurely.

8. How Long We Keep Your Information

We retain personal information only for as long as necessary to fulfil the purposes described in this policy, including applicable legal, accounting, reporting, and dispute-resolution requirements.

Our retention approach includes:

• Order and financial records: Retained for the periods required by applicable law.

• Customer service correspondence: Retained for as long as needed to resolve enquiries and maintain appropriate business records.

• Newsletter information: Retained while you remain subscribed, subject to applicable retention requirements and the need to maintain limited suppression records to respect unsubscribe requests.

• Website and security logs: Retained for periods appropriate to security and technical needs.

• Analytics data: Retained according to the configured Google Analytics retention settings and applicable requirements.

When information is no longer required, we will delete it or anonymise it where appropriate, unless the law requires continued retention.

Detailed retention schedule: [INSERT OR APPROVE THE RETENTION PERIODS USED FOR EACH DATA CATEGORY.]

9. How We Protect Your Information

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration, and disclosure.

Measures may include access controls, secure service providers, appropriate system safeguards, and limiting access to people who need the information for legitimate business purposes.

No method of electronic transmission or storage is completely secure. Please avoid sending payment card details or unnecessary sensitive information through ordinary email or messaging services.

10. Your Privacy Rights

Depending on the applicable law and the circumstances of processing, you may have the right to:

• Access personal information we hold about you.

• Rectify inaccurate or incomplete information.

• Request erasure where the legal conditions are met.

• Restrict certain processing.

• Object to processing based on legitimate interests.

• Object to direct marketing at any time.

• Withdraw consent where processing relies on consent.

• Request data portability where the legal conditions are met.

• Challenge certain automated decisions, where applicable.

• Complain to a relevant supervisory authority.

These rights are subject to applicable legal conditions and exceptions. For example, we may need to retain certain financial records to comply with legal obligations.

To exercise your rights, contact:

[INSERT PRIVACY CONTACT EMAIL]

Please describe your request and provide enough information for us to identify the relevant records. We may need to verify your identity before responding.

We will respond within the timeframe required by applicable law.

If you are in the United Kingdom, you may complain to the Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint/.

If you are in another jurisdiction, you may also have the right to contact the relevant data protection authority.

11. Newsletter and Marketing Communications

If you subscribe to our newsletter, we may send you communications about AYA 🌺 Pacha Cacao ®, our Cacao offerings, educational resources, events, and conservation initiatives.

You may unsubscribe at any time by using the unsubscribe link included in our emails or by contacting us directly.

Where consent is required, newsletter subscription will not be treated as consent to unrelated uses of your personal information.

Transactional messages relating to purchases, deliveries, or customer service may still be sent when necessary, even if you unsubscribe from marketing communications.

We use Flodesk to manage newsletter subscriptions and communications. Flodesk may process personal information on our behalf under its applicable service and data processing terms.

For more information, see Flodesk's Privacy Policy.

12. Third-Party Websites

Our website may contain links to external websites or services.

These third parties operate under their own privacy policies. We encourage you to review those policies before sharing information directly with them.

We are not responsible for the privacy practices of independent websites that we do not operate.

13. Children's Privacy

Our online store is intended for adults making purchases for themselves or others.

We do not knowingly collect children's personal information through the store for purposes that are not permitted by applicable law. If we become aware that personal information has been collected unlawfully from a child, we will take appropriate steps to address the situation.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes in our business, website functionality, service providers, or legal obligations.

The latest version will be published on https://ayapachacacao.com, with the updated date displayed at the beginning of the policy.

Where legally required, we will notify affected individuals of material changes before introducing new processing activities.

15. Contact Us

For questions about this policy, requests relating to your personal information, or concerns about how your information is handled, please contact: psychomagichealing@ayapachacacao.com.