Effective Date: 28 July 2025
Controller: Riccardo Lopez – NIF ESY1954519Q
Address: Carrer de Joan d’Austria 116, 3/1 – 08018 Barcelona, Spain

1. Who We Are

We are Graffi Factory, a creative studio producing and selling goods from Spain across Europe. This Privacy Policy explains how we collect, use, and protect your personal data.

2. What Data We Collect

• Name, email, address, phone

• Payment and billing data (never stored directly)

• Order history

• IP address and browsing behavior

• Account login info (if registered)

3. How We Use Your Data

• To process and ship orders

• To manage your account

• To improve website performance

• For legal compliance

• For marketing communications (if you opt in)

4. Legal Basis

We process your data based on:

• Contractual necessity (to fulfill orders)

• Legal obligation

• Consent (for marketing)

• Legitimate interest (fraud prevention, analytics)

5. Data Retention

Data is kept only as long as necessary:

• Orders: up to 6 years (legal obligation)

• Marketing data: until you unsubscribe

• Accounts: until deletion is requested

6. Sharing Your Data

We may share data with:

• Payment gateways (e.g., Stripe, PayPal)

• Shipping providers (e.g., Correos, DHL)

• Analytics and marketing tools

• Legal authorities, when required

7. Your Rights

Under the GDPR, you have the right to:

• Access, correct, or delete your data

• Object to or restrict processing

• Withdraw consent

• File a complaint with a Data Protection Authority (AEPD in Spain)

Contact: [privacy@graffifactory.com]