Privacy Policy

This Privacy Policy describes how Figari S.A.C. (RUC 20615803708) ("we", "us", or "our") collects, uses, and protects your personal data when you browse or place an order on the site https://chasqui.store. We comply with Peruvian Personal Data Protection Law (Ley N° 29733) and its Regulation (D.S. 003-2013-JUS).

1. Information We Collect

We collect only the data you voluntarily provide when placing an order, contacting us, or filing a Libro de Reclamaciones entry:

• Identification data: first and last name of the parent or guardian placing the order, document type and number (DNI or RUC)
• Contact data: email address and phone or WhatsApp number
• Order data: student name and grade, school division (EC/ES/MS/HS), selected products, and pickup point
• Billing data: fiscal name and tax address (only when you request a Factura instead of a Boleta)
• Payment data: your card details are collected and processed directly by Openpay (a PCI-DSS certified processor). Chasqui Store never sees, stores, or transmits your full card number, CVV, or expiry date.

2. How We Use Your Information

• Process, produce, and deliver your Roosevelt yearbook and photo package orders
• Issue electronic receipts (Boleta or Factura) and, when applicable, credit notes, as required by SUNAT
• Communicate order status, pickup instructions at school, and delivery-related notices
• Respond to inquiries received through the contact form or by email
• Handle complaints through the Libro de Reclamaciones, in accordance with Ley N° 29571
• Comply with our legal, tax, and consumer-protection obligations

3. Legal Basis for Processing

We process your data based on: (a) performance of the purchase contract you initiate by placing the order; (b) compliance with legal obligations — particularly Ley N° 29571 (Consumer Code) regarding the Libro de Reclamaciones and SUNAT rules on electronic receipts; (c) your explicit consent when submitting the contact form; and (d) our legitimate interest in maintaining site security and minimal records of commercial communication. We do not use your data for advertising profiling, mass communications, or commercial transfer to third parties.

4. Third-Party Service Providers

Some providers act as data processors on behalf of Chasqui Store and under our instructions, accessing only the minimum data needed to deliver their service and contractually bound by the same confidentiality:

• Openpay — Card payment processor (PCI-DSS certified) for credit and debit card transactions. Receives your card data directly to authorize the transaction and returns to us only the result (approved/declined), a transaction identifier, and the last four digits for your receipt. Chasqui Store has no access to your full card number at any point.
• Google LLC — Gmail SMTP / Google Workspace for transactional email (order confirmation, receipts, pickup instructions) and, optionally, Google Sheets API for internal order export.
• Linode (a subsidiary of Akamai Technologies, Inc.) — Cloud hosting infrastructure where the website and database run. The international transfer is covered by the contractual and security guarantees offered by the provider.
• CyberPanel / LiteSpeed — Web server software managing HTTPS, TLS certificates, and request handling.
• SUNAT — National Tax Administration Superintendence. Receives the minimum information required to validate and register the electronic receipts (Boleta or Factura) we issue for each order, in accordance with Peruvian regulations.
• Indecopi — Receives the Libro de Reclamaciones entries when a consumer chooses to escalate a complaint, in accordance with Ley N° 29571 and D.S. 011-2011-PCM.

We do not sell, rent, or share your data with third parties for advertising, marketing, or profiling purposes. Nor do we share data beyond what we collect, or with third parties not strictly necessary to deliver the service you requested.

5. Data Retention

We retain your data only for as long as necessary to fulfill the stated purposes: order and electronic-receipt data for the period required by Peruvian Tax Code (active relationship + 10 years); Libro de Reclamaciones entries for 24 months (legal minimum — D.S. 011-2011-PCM); contact-form messages for 12 months from the last interaction; server logs (IPs, accesses) for 90 days; and analytics cookies, if you accept them, for up to 14 months. Once the period expires, data is securely deleted or anonymized.

6. Cookies & Local Storage

We use the minimum cookies and local storage necessary for the site to function:

• PHPSESSID — first-party session cookie required for cart, checkout, and CSRF protection. Expires when you close your browser.
• localStorage["theme"] and language cookie (chasqui_lang) — stored in your browser only to remember your theme (dark/light) and language (ES/EN) preferences. Never sent to our servers for tracking purposes.
• Google Analytics 4 — aggregate traffic analytics (page views, device, browser). Your IP is anonymized before being sent to Google, and user-level data is automatically deleted after 14 months. You can opt out via the Google Analytics Opt-out Browser Add-on or your browser settings.

We do not use advertising cookies, retargeting pixels, or social-media tracking.

7. Your Rights (ARCO + revocation)

Under Ley N° 29733, you have the right to: Access your personal data, Rectify inaccurate or incomplete data, Cancel data when no longer needed or when you withdraw your consent, Oppose processing on legitimate grounds, receive Information about the processing, and Revoke any consent at any time. To exercise any of these rights, email us at sales@chasqui.store stating which right you wish to exercise and attaching a simple copy of your DNI. We respond within the legal timeframes: 20 business days for the right of access (art. 19, Ley N° 29733) and 10 business days for rectification, cancellation, or opposition. Exercising these rights is free of charge. If you find our response unsatisfactory, you may file a complaint with the National Data Protection Authority (ANPDP), part of the Peruvian Ministry of Justice and Human Rights.

9. Storage & Security

We adopt reasonable technical and organizational safeguards to protect your data: encrypted transport (HTTPS/TLS), hashed admin passwords, access restricted to authorized personnel, audit logs, and periodic backups. Data is stored on Linode/Akamai servers with infrastructure located outside Peru, covered by the provider's contractual guarantees. That said, no system is absolutely invulnerable and we cannot guarantee absolute protection against all risks.

10. Changes to This Policy

This policy may be amended to adapt to new legal requirements or operational changes. The version in force will always be the one published on this page, with the date shown at the top. Continued use of the site after changes are published constitutes acceptance.

11. Data Controller