1. Introduction
This privacy policy explains how ECUAYUTAH SERVICES, LLC, a limited liability company organized and located at Apt 58, 1801 N 950 W, Provo - 84604-1344, United States (US), collects, uses, stores, and protects personal information when you visit our website and use our Andean handicraft and cultural goods services. The services described on this site are developed and operated by the developer Ecuayutah on behalf of the company, and both the company and the developer are committed to responsible data stewardship.
We respect the trust you place in us when you share your details. This policy is written in clear language so that you can understand precisely what data we touch, why we touch it, and the choices you have. Please read every section carefully. By accessing our website, browsing our catalogue, submitting an enquiry, or completing an order, you acknowledge the practices described below.
Our business brings fair-trade alpaca wool textiles, painted ceramics, museum-quality replicas and cultural storytelling material from Ecuador, Peru and Bolivia to buyers in the United States. Because much of our work involves import, wholesale and museum transactions, the personal information we process can range from a simple email address to detailed shipping and payment records. We treat each category with the same care and the same commitment to minimal use.
Nothing in this policy grants us permission to use your data beyond what is necessary to serve you, to comply with law, or to protect the legitimate interests described later in this document.
2. Definitions
To keep this document precise, we use a small set of defined terms. Personal data means any information that relates to an identified or reasonably identifiable individual, such as a name, an email address, a phone number, or an order reference. Controller means the legal person that determines the purposes and means of processing; for this website the controller is ECUAYUTAH SERVICES, LLC. Processor means a party that handles personal data on behalf of the controller. Processing covers any operation applied to personal data, including collection, storage, use, disclosure, and deletion.
We refer to services broadly to include browsing the website, sending contact messages, requesting wholesale quotations, ordering goods, requesting provenance records, and receiving cultural storytelling content. We refer to you as the site visitor, the enquirer, or the customer depending on the stage of your relationship with us.
3. Information We Collect
We collect only the information that is genuinely necessary for the purpose at hand. The categories below describe the common types of data that may pass through our systems.
Identity and contact details
When you contact us, request a price list, register for an account, or place an order, we may collect your full name, email address, telephone number, company name and role. For museum or institution accounts we may also collect a valid purchase contact and accounts payable details.
Delivery and payment details
When you buy goods or arrange shipping, we collect shipping addresses, billing addresses, and order references. Payment card numbers are handled by payment providers and are never stored on our own servers; we may retain the last four digits and expiry date region only to identify a transaction.
Engagement and usage data
Our website logs standard technical data including your internet protocol address, browser type, device family, referring page, pages viewed, and the date and time of each visit. This information helps us keep the site stable and to understand which collections interest our audience.
Communication content
We store the subject and text of messages that you send through our contact form or directly to touch@ecuayutah.autos, together with any attachments that you provide. This content is retained for our legitimate interest in responding faithfully and maintaining a service history.
On rare occasions you may provide us with optional details such as the name of a referrer, a cultural community affiliation, or a preference for certain dyes or fiber types. We accept such details only because they help us serve you better; you are never obliged to share more than the minimum needed to complete the task at hand.
4. How Information Is Collected
We gather personal information through a few distinct channels. First, information that you provide directly, such as when you complete the contact form on our contact page, subscribe to a newsletter, register for an account, or correspond with us by email or telephone. Second, information collected automatically when you browse the website through cookies, server logs and similar technologies as described in the dedicated section on cookies below.
Third, information received from our partners, such as cooperatives that may forward a customer enquiry to us, translation or logistics partners who confirm delivery, and payment providers who supply transaction notifications. Where we receive data from a third party that you have engaged, we assume that the third party has obtained any necessary consent and has complied with its own privacy duties.
5. How We Use Information
We use personal data for clearly bounded purposes. We use contact details to answer enquiries, to provide quotations, to confirm orders, and to deliver updates about a shipment. We use delivery and payment data to arrange insurance, freight, customs clearance and invoicing. We use engagement data to improve the performance of the website and to understand which product ranges are popular.
With separate and affirmative consent, we may send you a newsletter or seasonal catalogue by email. You may withdraw such consent at any time by using the unsubscribe link or by writing to touch@ecuayutah.autos. We never sell or rent personal data to third parties for their own marketing. Where we process your information for our legitimate interests, we balance your rights and freedoms and ensure that the processing is proportionate.
As a practical example, when you ask us to source a custom alpaca blanket for a gift, we use your name and address to place the order, to keep the cooperatives informed of delivery needs, and to confirm arrival. We do not pass those details to unrelated brands, and we remove them from our active files as soon as the order is complete and the required record window has passed.
6. Legal Bases for Processing
Where data protection law requires us to identify a lawful ground, we rely on the following. For performing a contract, means we need the data to fulfil an order, to arrange delivery, or to provide a quotation that you have requested. For compliance with a legal obligation, means we may keep records required by customs, tax or consumer authorities.
For legitimate interests, we use certain data to keep the website secure, to prevent fraud, to maintain accurate business records, and to send service messages directly related to an existing transaction. For consent, we rely on your clear affirmative action where we seek to send marketing materials or to place non-essential cookies. Where consent applies, you always hold the freedom to withdraw it without penalty.
7. Sharing and Disclosure
We do not sell your personal information. We share data only with parties that help us deliver our services and only to the extent necessary. Logistics carriers receive addresses needed for delivery. Payment processors receive transaction data needed to authorize payments. Customs brokers receive shipping documentation required by law. Translation and content partners may see the material they need to complete a project for you.
We may disclose personal data where we believe in good faith that disclosure is required by a court order, a warrant, or other valid legal process, or where disclosure is necessary to protect the rights, property or safety of the company, its customers, or the public. Should we ever transfer ownership of the business, personal data may be included in that transfer, with appropriate notice to affected individuals where feasible.
We also share limited supplier-facing details with artisan cooperatives when needed to complete a delivery, such as the destination town for a commissioned textile. These partners see no more of your data than they need, and they are bound by record-keeping customs that protect the maker relationship as carefully as we protect your personal circle.
8. Third-Party Services
Our website relies on a small number of trusted providers for hosting, analytics and payment. Where these providers act as processors, we seek contractual clauses that require them to protect data and to use it only on our instructions. We encourage you to read the privacy policies of any service that you reach from our site, because we cannot control how a provider treats your data once it leaves our application.
9. Data Retention
We keep personal data only for as long as needed to fulfil the purpose for which it was collected. Enquiry correspondence is retained for the practical period needed to finish a service conversation, typically up to two years. Transaction records are retained for at least the period required by tax and customs law, which may be several years. Technical logs are retained for a limited rolling window measured in months.
When data is no longer needed, we delete it or anonymize it so that it can no longer identify you. Retention periods are reviewed regularly and applied consistently across our systems.
10. Security Measures
We protect personal data with appropriate technical and organizational measures. These include encrypted connections during transmission, restricted access to systems based on role, routine software updates, secure password and two-factor practices for staff accounts, and physical protections for our equipment. We regularly test our controls and require our processors to document their own safeguards.
No method of electronic storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security. You can help by keeping your account credentials private, using a strong password, and reporting any suspected unauthorized use of your account to us promptly.
Our response plan calls for prompt containment, careful assessment of what was at risk, and honest notification to any affected individuals so that they can act to protect themselves. Where we can learn a lesson that makes the service safer, we apply it permanently rather than papering over the symptom.
11. Privacy for Children
Our website and services are intended for adults and for organizations. We do not knowingly collect personal information from children. If you are a parent or guardian and you believe that a child under your care has provided us with personal data, please contact us so that we can remove the information. Where a museum, school or classroom engages with our educational content, we expect the responsible adult organization to manage any data of minors under its own consent rules.
12. Cookies
A cookie is a small text file stored by your browser. We use strictly necessary cookies to keep the website functioning, functional cookies that remember preferences, and, with your consent, analytics cookies that help us measure use of the site. We do not use advertising cookies that build cross-site profiles.
You can control cookies through your browser settings. Blocking certain cookies may reduce the quality of your experience or make some features unavailable. Our cookie banner, where shown, gives you clear choices before non-essential cookies are placed.
13. Your Rights
Depending on where you live, you may have rights over your personal data. These typically include the right to access a copy of the data we hold about you, to correct inaccurate data, to request deletion, to restrict or object to processing in certain circumstances, to ask for portability of data you have provided, and to withdraw consent at any time.
To exercise any of these rights, contact our data officer using the details in the contact section below. We will respond within the time required by law, usually within thirty days. We may ask you to verify your identity before acting so that we do not disclose data to an unauthorized person.
14. Rights under GDPR
If you are located within the European Economic Area or the United Kingdom, the General Data Protection Regulation may apply to some of our processing. You have the rights described in the relevant chapter plus the right to lodge a complaint with your supervisory authority. Where our legal basis is legitimate interest, you may object on grounds relating to your particular situation, and we will stop processing unless we demonstrate compelling legitimate grounds that override your interests.
15. International Transfers
Because our company is in Provo, United States (US), and our artisan partners are in Ecuador, Peru and Bolivia, your data may be stored or accessed across national borders. When we transfer personal data out of the European Economic Area or the United Kingdom, we rely on approved transfer mechanisms, appropriate safeguards, or derogations for the transfer where law requires. We take reasonable steps to extend our protective standards wherever your data travels.
16. External Links
Our website may link to partner cooperative pages, logistics portals, social networks, or other sites. Once you leave our website, this privacy policy no longer applies. We recommend that you review the privacy practices of any third-party site before you share personal information with it. We are not responsible for the content or data handling of external resources.
17. Do Not Track
Some browsers offer a do not track preference. Because industry standards for honoring this signal are still evolving, our site does not currently change its behavior based on a do not track signal. We do, however, limit third-party analytics to aggregate and non-identifying figures, and we give you granular control over cookies through your browser.
18. Contact and Data Officer
Questions, complaints and data requests are welcome and are handled by our named data contact. You may write to the data officer of ECUAYUTAH SERVICES, LLC at Apt 58, 1801 N 950 W, Provo - 84604-1344, United States (US) or by email to touch@ecuayutah.autos. For faster service by telephone, call +17159998373 during business hours.
19. Policy Changes
We may update this privacy policy from time to time to reflect changes in our services, technology or legal obligations. When material changes are made, we will post a revised version on this page with a new effective date. We encourage you to review this page periodically so that you remain informed of how we protect the information we hold.
20. Governing Law
This privacy policy is governed by the laws applicable in the state of Utah and the United States (US), without regard to conflict of law principles. To the extent permitted by law, any dispute relating to privacy matters shall be resolved under the governing law described in our terms of service. By continuing to use our website you acknowledge your acceptance of this policy as it stands at that time.
Last revised 1 January 2026 by ECUAYUTAH SERVICES, LLC.