Privacy policy

1. Information we collect

1.1 Directly provided data

We collect the following minimum information necessary to manage your account and provide our services:

• Email: Used as the primary identifier for your account and for essential communications.
• Password: Stored securely using advanced encryption and hash techniques.
• Profile picture (optional): If you choose to upload an image to customize your account.

1.2 Data associated with your activity

To provide functionality and improve security, we also collect:

• Login records: Date, time and device used to access your account.
• Order data: Information related to your orders and transactions to associate them with your profile.
• Preference information: Settings and adjustments you make to your account.

1.3 Automatically collected data

We collect certain technical information when you use our services:

• IP address: For security and fraud prevention.
• Device information: Device type, operating system and browser.
• Cookies and similar technologies: To keep your session active and improve the user experience.
• Usage data: Patterns of interaction with our platform to improve functionality.

2. How we use your information

We use your personal information exclusively for the following purposes:

2.1 Essential purposes

• Account management: Create and maintain your account, allow login and verify your identity.
• Order processing: Associate your orders with your profile and facilitate tracking.
• Service communications: Send you important notifications about your account, orders or changes in our services.
• Security: Protect your account against unauthorized access and detect suspicious activities.

2.2 Improving the service

• Personalization: Adapt and personalize aspects of our service according to your preferences.
• Analysis and statistics: Perform internal analysis to improve the functionality and usability of our platform.
• Technical support: Help you resolve technical problems or questions about your account.

2.3 Legal compliance

• Legal obligations: Comply with our legal obligations and regulations.
• Dispute resolution: Resolve disputes and enforce our legal agreements.
• Fraud prevention: Protect against fraudulent or abusive activities.

3. Legal basis for processing

We process your personal data based on the following legal bases:

• Contract execution: The processing is necessary for the management of your account and the provision of our services.
• Consentimiento: When you explicitly consent to specific processing.
• Legitimate interests: When the processing is necessary for our legitimate interests, such as improving our services or ensuring security.
• Legal obligation: When we are legally obligated to process your information.

4. Information sharing

We commit to not sell, rent, or commercialize your personal data. We share your information only in the following circumstances:

4.1 Service providers

We may share your information with service providers that help us operate our platform:

• Service providers of hosting and servers.
• Authentication and security services.
• Payment processors (without sharing login credentials).
• Analysis services to improve our performance.

All these providers are contractually obligated to protect your information and use it exclusively for the specific purposes agreed upon.

4.2 Legal requirements

We may disclose your information when required by law:

• In response to legal requests from public authorities.
• To protect our legal rights or defend against legal claims.
• To investigate, prevent, or take measures regarding illegal activities.
• In exceptional circumstances to protect the personal security of users or the public.

5. Data security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption: We use encryption technology to protect your sensitive data, especially your password.
• Restricted access: We limit access to your personal information to employees who need to know it.
• Security monitoring: We monitor our systems to detect vulnerabilities and possible breaches.
• Regular updates: We keep our systems updated with the latest security patches.
• Audits: We conduct periodic evaluations of our security practices.

Although we implement reasonable safeguards, no security system is completely impenetrable. We cannot guarantee absolute security of your information.

6. Data retention

We keep your personal information only for as long as necessary for the purposes set forth in this Privacy Policy:

• We maintain your account information while your account remains active.
• Order data is retained for the period required by applicable tax and commercial laws.
• Login records are retained for a limited period for security purposes.
• After deleting your account, some data may be retained in an anonymous form for statistical analysis.

7. Your rights

Depending on your location, you may have various rights regarding your personal data:

• Access: Right to request a copy of your personal information.
• Rectification: Right to request the correction of inaccurate or incomplete information.
• Elimination: Right to request the deletion of your personal information in certain circumstances.
• Restriction: Right to request the limitation of the processing of your information.
• Portability: Right to receive your personal information in a structured and transferable format.
• Objection: Right to object to the processing of your personal information.
• Revocation of consent: Right to withdraw your consent at any time.

To exercise any of these rights, contact us using the information provided at the end of this policy.

8. Cookies and similar technologies

We use cookies and similar technologies for various purposes related to the functionality of our platform:

• Essential cookies: Necessary for the basic operation of the site and the login system.
• Session cookies: Maintain your active session while using our services.
• Security cookies: Help detect fraudulent activities and protect your account.
• Analytics cookies: Allow us to understand how users interact with our platform.

You can manage your cookie preferences through your browser settings, although disabling certain cookies may affect the functionality of our services.

9. Children's privacy

Our services are not directed to persons under the age of 18. We do not knowingly collect personal information from minors. If we discover that we have collected personal information from a minor without parental consent, we will take measures to delete that information as soon as possible.

If you are a parent or guardian and believe that your child has provided personal information to us, please contact us so that we can take the appropriate measures.

10. International data transfers

Your personal data may be transferred and processed in countries different from the one in which you reside. These countries may have different data protection laws than those of your country.

When we transfer your data to other countries, we implement appropriate safeguards to ensure that your information remains protected in accordance with this Privacy Policy, such as:

• Transfers to countries with adequacy decisions.
• Use of approved standard contractual clauses.
• Implementation of additional technical and organizational measures when necessary.

11. Changes to this policy

We may periodically update this Privacy Policy to reflect changes in our practices or for other operational, legal, or regulatory reasons.

• Modifications will take effect once the updated Privacy Policy is published.
• For significant changes, we will notify you through a visible notice on our platform or by sending an email.
• We recommend reviewing this policy periodically to stay informed about how we protect your information.

12. Contact

If you have questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, you can contact us through:

• Email: info@handmadeart.store
• Contact form on our platform
• Commercial operation registered in Costa Rica.

We commit to responding to any inquiries or requests within a reasonable time frame and, in any case, within the time limits established by applicable law.