Privacy Policy

This policy explains what personal information Mexi-Can Limited, trading as Hot Like a Mexican (“we”, “us”), collects through hotlikeamexican.com and our online catering orders, why we collect it, and what you can do about it. We follow the New Zealand Privacy Act 2020.

This policy covers the website and online orders. It does not cover our online shop at shop.hotlikeamexican.com, which is run on Shopify and has its own privacy policy, or the other sites we link to, such as Uber Eats, DoorDash, Instagram and Facebook.

The short version

• We only collect what we need to answer you, make your food and meet our tax obligations.
• We never see or store your card number. Card payments are handled by Stripe.
• We do not sell your information, and we do not send marketing emails.
• You can ask to see or correct what we hold about you at any time: [email protected].

Catering orders

When you order catering online, we collect:

• your name, email address and phone number
• your company name and purchase order number, if you give them
• your pickup date and time
• what you ordered, including any notes you add to an item

We use this to prepare your order, contact you about it, and send you a GST tax invoice. After your order has been collected, we may send you one email asking how it went or inviting you to leave a review. We will not add you to any mailing list.

Payment. When you continue to checkout, you are taken to a payment page run by Stripe. Stripe collects your card details directly, and we never see or store your full card number. Stripe tells us whether the payment succeeded and gives us the details above so we can fill the order. Stripe also uses payment information to prevent fraud. If you use Link, Stripe’s saved payment service, Stripe handles that under its own terms. See Stripe’s privacy policy.

Notes and dietary information. An item note might mention an allergy, a dietary need or the name of the person a meal is for. We use notes only to prepare and label your order. They are printed on the kitchen docket, and the printed docket is thrown away once the order has been collected.

Ordering for other people. If your order names other people (for example “label for Sam”), please let them know you have shared their name or dietary needs with us for this order.

How long we keep it. New Zealand tax law requires us to keep business records, including tax invoices, for seven years. We keep order records for that period and then delete them.

Contact form and catering enquiries

When you send us a message through the contact form, we collect your name, email address, the subject and your message.

When you send a catering order over $3,500 as an enquiry, we collect your name, email address, phone number, company and purchase order number if you give them, your preferred pickup date and time, and the order itself, including any item notes.

These arrive with us as an email, together with your IP address, which we use only to stop spam and abuse. They are not stored in a database. We use them only to reply to you and, for a catering enquiry, to confirm and arrange your order. We keep enquiries in our email so we can refer back to them if you get in touch again. If you would like yours deleted, just ask.

To keep the forms free of spam, each submission is checked by Cloudflare Turnstile, and your IP address is held for one hour to limit how many messages can be sent at once.

Analytics

We measure how the website is used so we can improve it. We use:

• Google Analytics, which records the pages you visit, how you arrived, the type of device and browser you use, your approximate location (city level), and actions such as opening a menu item or clicking a link. See Google’s privacy policy.
• Microsoft Clarity, which records how visitors scroll and tap on pages, including session replays and heatmaps. Text you type into forms is masked and is not recorded. See Microsoft’s privacy statement.
• Our own link counter on hotlikeamexican.com/links/, which records which links are clicked, the referring site, your approximate location (country, region and city), and your type of device, browser and operating system. It does not store your IP address. To count unique visitors, it stores a scrambled code made from your IP address and browser that changes every day, so it cannot be used to follow you from one day to the next.

These tools only run on hotlikeamexican.com itself. We use the results as totals and trends, not to identify individual people.

Cookies and storage in your browser

Google Analytics and Microsoft Clarity set cookies to tell one visit from another. Cloudflare Turnstile may set a cookie to check that a form was sent by a person, not a bot.

The menu and catering pages also save a few things in your own browser (not on our servers): your menu language, your dietary filters, any menu plan you build, and your catering cart, so it is still there if you come back. You can clear these at any time by clearing your browser’s site data.

You can block or delete cookies in your browser settings. The website still works, although the spam check on our forms needs Turnstile to run.

Other services the website loads

Some pages load content from other companies, which means your browser connects to them and they receive your IP address:

• Google Fonts, for the typefaces on every page
• Google Maps, for the map on the home and contact pages
• Cloudflare, which hosts the website and protects it from attacks

Who we share information with

We share personal information only with the service providers who help us run the website and orders, and only for that purpose:

• Stripe, for card payments and tax invoices
• Supabase, which stores our catering order records
• Google Workspace, which runs our email inbox, where orders and enquiries arrive
• Brevo, which delivers the emails from our forms and orders
• Cloudflare, which hosts the website, our forms and our link counter
• Google and Microsoft, for the analytics described above

These providers store information outside New Zealand. Our order records are held in Australia (Supabase, Sydney). Stripe, Google and Microsoft mainly store information in the United States, Brevo in Europe, and Cloudflare on servers around the world. We use providers that protect personal information in ways comparable to New Zealand law.

We do not sell or rent personal information, and we do not use it for advertising. We would only disclose it for another reason if the law requires us to.

Keeping it safe

Only the owners of the business and the person who manages the website can see order and enquiry records. Kitchen staff see the printed docket for the order they are preparing, and nothing else. Card details never reach our systems. If a privacy breach ever happens that is likely to cause someone serious harm, we will tell the people affected and the Privacy Commissioner, as the law requires.

Your rights

Under the Privacy Act 2020 you can:

• ask us for a copy of the personal information we hold about you
• ask us to correct it if it is wrong
• ask us to delete it, where we are not required by law to keep it

Email [email protected] and our Privacy Officer will reply within 20 working days. We may need to confirm who you are before we release anything.

If you are not happy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Office of the Privacy Commissioner at privacy.org.nz.

Changes to this policy

If we change how we handle personal information, we will update this page and the date at the top.

Contact

Privacy Officer Mexi-Can Limited, trading as Hot Like a Mexican Tenancy 1, 1 Willis Street, Wellington 6011 [email protected]