Free shipping over $50✦Printed in the USA, delivered in 5-10 days✦New sayings every day✦Free shipping over $50✦Printed in the USA, delivered in 5-10 days✦New sayings every day✦
buffo.
🛒 0

Privacy Policy

Last updated: September 18, 2026

This Privacy Policy describes how BertoProduction (Tax ID Y-4514/312-R, based in Alicante, Spain) collects, uses, and protects the personal data of users who visit and purchase on the website buffoshop.com (the "Site"), in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD), and other applicable laws.

1. Data controller

The data controller is BertoProduction – Tax ID Y-4514/312-R, with its registered office in Alicante, Spain. For any privacy-related request, you can write to privacy@buffoshop.com.

2. Types of data collected

  • Browsing data: IP addresses, browser type, operating system, pages visited, visit duration, traffic source (collected through analytics tools only after your consent).
  • Purchase data: first and last name, shipping address, email, phone number (optional), items ordered, amounts, order status, and shipment tracking.
  • Payment data: handled exclusively by Stripe Payments Europe Ltd. The Site never stores card numbers.
  • Support data: the content of messages sent via chat or email to customer support, including any product photos submitted with a claim.
  • Cookies: see the Cookie Policy for details.

3. Purposes of processing

  • Order management and fulfillment, including printing and shipping through our production partners.
  • Customer support, including handling returns, replacements, and refunds.
  • Compliance with legal, tax, and accounting obligations.
  • Fraud prevention and IT security.
  • Statistical analysis of Site usage (only with consent).
  • Sending marketing communications (only with explicit, revocable consent).

4. Legal basis

Processing is based on: (a) performance of the sales contract and pre-contractual measures; (b) legal obligations; (c) the user's explicit consent for analytics and marketing; (d) the controller's legitimate interest in ensuring the operation and security of the Site and in preventing fraud.

5. Automated customer support

Support requests may initially be handled by an automated assistant powered by artificial intelligence, which checks the order status and applies the terms of sale. Decisions with significant effects (refunds above a certain threshold, complex claims) are always reviewed by a human operator. You can ask to speak with a person at any time.

6. How data is processed

Data is processed using electronic tools, by authorized personnel, and with appropriate security measures (HTTPS encryption, restricted access, encrypted backups, servers located in the European Union).

7. Data retention

  • Order and billing data: 10 years, as required by tax regulations.
  • Support data: 24 months from the last interaction.
  • Analytics data: 14 months.
  • Marketing consent: until withdrawn.

8. Data sharing

Data may be shared with:

  • Printing and shipping partners (Printful Inc. and its European affiliates; alternatively, Gelato AS), limited to the name, address, email, and phone number required for delivery.
  • Stripe Payments Europe Ltd. for payment processing; PayPal (Europe) S.à r.l. if selected.
  • Postal carriers for delivery.
  • Technical service providers (hosting, transactional email, analytics), limited to technical purposes.
  • Competent authorities upon a justified request.

We do not sell or transfer data to third parties for marketing purposes.

9. Data transfers outside the EU

Some providers (Printful for orders shipped to the United States, Stripe, Google) may involve transfers to countries outside the EU. In all cases, an adequate level of protection is ensured through Standard Contractual Clauses approved by the European Commission or participation in the EU-US Data Privacy Framework.

10. Your rights

You have the right to:

  • Access your data and obtain a copy of it.
  • Request rectification, erasure, or restriction of processing.
  • Object to processing based on legitimate interest.
  • Request data portability.
  • Withdraw your consent at any time.
  • Lodge a complaint with a supervisory authority (Spain: AEPD, aepd.es; Italy: Garante Privacy, garanteprivacy.it).

To exercise your rights, write to privacy@buffoshop.com.

11. California residents

If you are a California resident, the California Consumer Privacy Act (CCPA/CPRA) and the California Online Privacy Protection Act (CalOPPA) grant you additional rights. We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising. You have the right to know what personal information we collect, use, and disclose, and the right to request deletion of your personal information, subject to legal exceptions (for example, records we must keep for tax or accounting purposes). We will not discriminate against you for exercising these rights. Our Site does not currently respond to "Do Not Track" browser signals. To submit a request, write to privacy@buffoshop.com; we will verify your identity before responding.

12. Changes to this privacy policy

We reserve the right to update this policy. Changes will be posted on this page with the updated date.