Privacy policy

Effective Date: November 2025

At Flick & Puff, we value your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information in accordance with the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

3. Purpose & Legal Basis for Processing

Your personal data is processed for the following purposes and legal bases:

4. Sharing & Disclosure of Data

We only share your personal data when necessary for the purposes stated above. We work with trusted partners who process data on our behalf, ensuring your data remains protected:

• Shopify – our e-commerce platform and data host. Some data may be stored outside the European Union;
• Printful – for print-on-demand order fulfillment, with GDPR-compliant processing;
• Payment processors – to securely handle payments; payment card data is processed only by the provider and is never stored by us;
• Google Analytics – for website traffic analysis. Data is anonymized or aggregated to prevent identification of individuals;
• Social media and advertising platforms – we may use marketing cookies, tracking pixels, and other tracking technologies from third-party advertising networks (e.g., Meta, TikTok, Pinterest, YouTube, and others) to measure campaign effectiveness and deliver personalized ads. These cookies are only activated after you give explicit consent through our cookie banner;
• Carriers and logistics partners – your name, shipping address, email, and phone number are shared strictly for the purpose of delivering your order and related delivery inquiries. These partners process personal data in compliance with GDPR and do not use it for marketing purposes. Where data is transferred outside the European Union, appropriate safeguards such as Standard Contractual Clauses are applied.

Important: All partners act strictly as Data Processors under our instructions, except where a partner acts as an independent Data Controller (such as some social media and advertising networks). In such cases, their data processing practices are governed by their respective privacy policies available on their official websites.

We do not share marketing data without your prior explicit consent.

5. International Data Transfers

Some of our service providers may process your data outside the European Union. In such cases, transfers are protected by:

• Standard Contractual Clauses (SCCs) approved by the European Commission, or
• Adequacy decisions where applicable.

These mechanisms ensure your personal data receives an equivalent level of protection required by GDPR.

6. Cookies & Similar Technologies

Our website uses cookies to ensure proper functionality, enhance your browsing experience, and analyze website traffic:

• Essential cookies are necessary for site operation (e.g., to remember items in your cart);
• Analytics cookies (e.g., Google Analytics) are used only after you give your explicit consent through the cookie banner;
• Marketing cookies (e.g., social media advertising and tracking pixels) are only activated after you give your explicit consent and are used to deliver personalized ads and measure campaign effectiveness.

7. Your Data Protection Rights

Under GDPR and Spanish data protection law, you have the right to:

• Access your personal data (Art. 15 GDPR);
• Rectify inaccurate or incomplete data (Art. 16 GDPR);
• Erase your data ("right to be forgotten") (Art. 17 GDPR);
• Restrict processing of your data (Art. 18 GDPR);
• Object to certain processing activities, including marketing (Art. 21 GDPR);
• Port your data to another service provider (Art. 20 GDPR).

You can exercise these rights by contacting us at team@flickandpuff.com. We will respond to all legitimate requests within 1 month of receipt, in accordance with applicable data protection laws. If your request is particularly complex or if we have received multiple requests, this period may be extended by up to 2 additional months. In such cases, we will notify you of the extension and explain the reasons for the delay.

8. Data Security

We take appropriate technical and organizational measures to ensure your personal data is protected from loss, misuse, unauthorized access, or disclosure.

This includes:

• Encrypted connections (SSL/TLS) for all transactions;
• Secure servers hosted in the European Union.

We regularly review our security measures and update them as necessary to mitigate risks.

9. Data Retention

We retain your personal data only for as long as necessary for the purposes stated in this policy or as required by law:

• Order and billing data: retained for 7 years (for tax and accounting);
• Account data: retained while your account remains active;
• Marketing data: retained until you withdraw consent;
• Consent logs: retained for 5 years to demonstrate GDPR compliance;
• Data shared with carriers and logistics partners for order delivery: retained only as long as necessary for the delivery process and related inquiries, after which it is securely deleted or anonymized.

Aggregated or anonymized analytics data may be retained indefinitely for reporting, research, and business improvement purposes, as it cannot be linked to identified individuals.

After these periods, data will be securely deleted or anonymized.

10. Updates to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Significant changes will be announced via our website or email notice. The latest version will always be available on this page, with the date of the last update shown above.

11. Contact Us

For any questions or to exercise your rights under data protection law, please contact:

Last updated: November 2025