Here at Artesano de México your privacy is our priority. We are committed to protecting your personal information, and we only collect and use your personal details in accordance with UK data protection law (UK GDPR and the Data Protection Act 2018).
Who we are. Artesano de México is operated by Andras Logistics Ltd, a company registered in England and Wales under company number 10667276, with its registered office at 21 Sandover, Northampton, Northamptonshire, NN4 0TS, United Kingdom. Andras Logistics Ltd is the controller of the personal data described on this page. You can contact us about your data at info@artesanodemexico.com.
What we collect and why
We only collect the personal data we need. The law requires us to have a lawful basis for each use; the table shows which one applies.
| What we use | Why | Lawful basis |
|---|---|---|
| Name, postal address, email address and phone number you give at checkout; what you ordered and paid | To process, pack and deliver your order, keep you informed about it and handle returns, refunds and complaints | Contract: we need it to fulfil your order |
| Your account details and order history, if you create an account | To let you sign in, see your orders and check out faster | Contract |
| Order and payment records | To keep the accounting and tax records the law requires | Legal obligation |
| Your name, email address, order number and message, if you contact us | To answer your question | Legitimate interests: replying to the people who write to us |
| Your email address, if you sign up for our newsletter | To send you our newsletter | Consent, which you can withdraw at any time by unsubscribing |
| Statistics and marketing cookies (see Cookies below) | To understand how the shop is used and how visitors find us | Consent, which you can change at any time under “Cookie settings” |
| Payment and device data handled by Stripe and PayPal | To take your payment securely and prevent fraud | Contract, and legitimate interests in preventing fraud |
| A record of your cookie choice (see Record of your consent) | To be able to show what you agreed to | Legal obligation: we must be able to demonstrate consent |
You need to give us your name, address, email address and phone number to place an order — without them we cannot deliver it. Signing up for the newsletter and accepting optional cookies are always your choice. We do not use your data for automated decisions or profiling that affect you; the only automated check is the fraud screening our payment providers carry out when you pay.
Who we share it with
We never sell your personal data or share it with anyone for their own marketing. We share it only with the following, and only as far as each needs it:
- Our couriers, Yodel and DPD, and for orders outside the UK their partners in the destination country, to deliver your order. They receive your name, delivery address, email address and phone number.
- Stripe and PayPal, to take your payment. They act as independent controllers of the payment data and process it under their own privacy policies (stripe.com/gb/privacy, paypal.com). Stripe uses hCaptcha (Intuition Machines) to protect card payments from bots. We never see or store your full card details.
- Google, for our visitor statistics (Google Analytics), only if you accept statistics cookies.
- Bitsquad, which develops and runs our website on our behalf, and its hosting provider Rackforest in Budapest, Hungary, where the website, its database and our email server are located. They process the data only on our instructions.
- Our accountant, who keeps our accounting records.
- Public authorities such as HMRC, where the law requires it.
International transfers
Our website and database are hosted in the European Economic Area (Hungary), which the UK recognises as giving adequate protection to personal data. Google, Stripe and PayPal may process data in the United States; these transfers are covered by the UK Extension to the EU–US Data Privacy Framework or by the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses. If you order from outside the UK, your delivery details are passed to the courier handling the parcel in your country.
How long we keep it
- Orders, invoices and payment records: 6 years from the end of the financial year in which you ordered, as UK tax law requires.
- Your account: until you close it, or ask us to close it.
- Newsletter: until you unsubscribe.
- Messages you send us (contact form and email): 2 years from our last reply.
- The record of your cookie choice: 2 years (730 days).
- Google Analytics statistics: 2 months for the detailed data on individual visits; after that only aggregated reports are kept.
After these periods we delete the data or make it anonymous.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data, unless we must keep it (for example for tax records);
- ask us to restrict how we use your data;
- object to our use of your data where we rely on legitimate interests;
- receive the data you gave us in a common electronic format, or have it sent to another organisation;
- withdraw your consent at any time where we rely on it — unsubscribe from the newsletter, or change your choice under “Cookie settings”. This does not affect anything we did before you withdrew it.
To use any of these rights, email us at info@artesanodemexico.com. It is free, and we will reply within one month. We may ask you to confirm your identity first.
Complaints
If you are unhappy with how we handle your personal data, please contact us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
Cookies and similar technologies
Cookies are small text files that a website stores in your browser. Our shop also uses your browser’s local storage, which works in a similar way. Some cookies are necessary for the shop to work and are always on. We only use statistics and marketing cookies if you agree to them.
When you first visit the shop, we ask for your choice. You can accept or reject all optional cookies, or choose by category. You can change or withdraw your choice at any time using “Cookie settings” at the bottom of every page. Withdrawing your consent deletes the statistics and marketing cookies from your browser. Your choice is kept for 6 months. After that, or when this list changes, we ask you again.
Necessary cookies
These cookies are needed for your basket, checkout, account and secure payment, and to remember your cookie choices. They cannot be turned off. The payment providers’ cookies are only set on the checkout page.
| Name | Provider | Expiry | Purpose |
|---|---|---|---|
| cc_cookie | Andras Logistics Ltd | 6 months | Stores your cookie choices. |
| wp_consent_functional, wp_consent_statistics, wp_consent_statistics-anonymous, wp_consent_marketing | Andras Logistics Ltd | 30 days | Passes your cookie choices on to the shop’s plugins (for example WooCommerce). |
| wp_woocommerce_session_* | Andras Logistics Ltd (WooCommerce) | 2 days | Keeps your basket and checkout session. |
| woocommerce_cart_hash, woocommerce_items_in_cart | Andras Logistics Ltd (WooCommerce) | End of session | Tracks changes to your basket. |
| wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie | Andras Logistics Ltd (WordPress) | End of session, or 14 days if you tick “Keep me signed in on this device” | Keeps you signed in to your account. Only set if you sign in. |
| __stripe_mid | Stripe | 1 year | Fraud prevention for card payments. Checkout page only. |
| __stripe_sid | Stripe | 30 minutes | Fraud prevention for card payments. Checkout page only. |
| m (set on m.stripe.com) | Stripe | 400 days | Fraud prevention for card payments. Checkout page only. |
| __cf_bm, __cflb, hmt_id (set on hcaptcha.com) | hCaptcha (Intuition Machines), on behalf of Stripe | 30 minutes, 30 minutes, 30 days | Bot and fraud protection during card payment. Checkout page only. |
| sc_f, KHcl0EuY7AKSMgfvHl7J5E7hPtK, l7_az (set on paypal.com), __cf_bm (set on c.paypal.com) | PayPal | 400 days, 400 days, 30 minutes, 30 minutes | Shows the PayPal payment button and protects PayPal payments from fraud. Checkout page only. |
Your browser’s local storage also keeps a copy of your basket while you shop (storeApiCartData, storeApiCartHash, storeApiNonce and wc-blocks_dismissed_incompatible_extensions_notices, set by WooCommerce on the basket and checkout pages). This is also necessary for the shop to work.
Statistics cookies
With your consent, we use Google Analytics, through Google Tag Manager, to understand how visitors use the shop: which pages and products are viewed, and how visits lead to orders.
| Name | Provider | Expiry | Purpose |
|---|---|---|---|
| _ga | Google (Google Analytics) | 2 years | Distinguishes visitors for our visitor statistics. |
| _ga_* | Google (Google Analytics) | 2 years | Keeps the state of your visit for our visitor statistics. |
If you reject statistics cookies, no cookies are set and no identifier is stored about you. The shop still sends Google a signal without cookies when you view a page or use the shop (for example when you view a product or place an order). These signals carry no identifier that could recognise you on your next visit, and Google uses them only to estimate visitor numbers in aggregate.
Marketing cookies
With your consent, the shop records how you found us, so that we can see which channels lead to orders. We do not run advertising and do not share this information with advertising networks.
| Name | Provider | Expiry | Purpose |
|---|---|---|---|
| sbjs_migrations, sbjs_current_add, sbjs_first_add, sbjs_current, sbjs_first, sbjs_udata | Andras Logistics Ltd (WooCommerce) | End of session | Records how you found our shop (for example a search engine or a link), so we can see which channels lead to orders. |
| sbjs_session | Andras Logistics Ltd (WooCommerce) | 30 minutes | Marks the current visit for the source tracking above. |
Record of your consent
When you make or change your choice, we keep a record of it so that we can show what you agreed to. The record contains a random identifier (also stored in the cc_cookie), the date and time, the categories you chose, the language and the version of this cookie list. It does not contain your IP address or any details of your browser. We keep these records for two years (730 days), then delete them automatically.
If you have any questions about how we protect your personal information, please contact us at info@artesanodemexico.com.