Privacy Policy & GDPR

Last updated: 31 October 2026

1. Introduction

PUFATI SRL ("PUFATI", "we", "us", or "our") respects the privacy of customers, suppliers, business partners, and visitors to our website, pufati.com.

This Privacy Policy explains how we collect, use, store, and protect personal information in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Romanian legislation.

2. Data Controller

PUFATI SRL

CUI: 5044386

Strada Principală nr. 758, Tulca, județul Bihor, România

Email: contact.kisvardai.attila@gmail.com

Website: https://pufati.com

3. Personal Information We Collect

Depending on how you interact with us, we may collect:

• Full name and company name.
• Email address and telephone number.
• Billing and shipping addresses.
• Order details, purchased products, and transaction information.
• Customer account information, when an account is created.
• Communications, customer service inquiries, and return requests.
• Information necessary to process refunds or investigate delivery problems.
• Technical information, such as IP address, browser information, and cookie preferences.
• Marketing subscription preferences.

We do not require customers to create an account to place an order.

Payment transactions are handled through Shopify and the relevant payment service providers. PUFATI processes payment-related information as necessary to administer purchases and refunds.

4. How We Use Personal Information

We process personal information to:

• Receive, confirm, and fulfill orders.
• Arrange payments, shipping, and delivery.
• Provide customer support.
• Process cancellations, returns, refunds, and warranty claims.
• Manage customer accounts.
• Maintain required financial, accounting, and transaction records.
• Prevent fraud, investigate repeated delivery problems, and protect legitimate business interests.
• Respond to supplier and wholesale inquiries.
• Send marketing communications where valid consent has been provided.
• Comply with applicable legal obligations.

5. Legal Basis for Processing

Depending on the circumstances, we rely on:

Contractual necessity: To process purchases, deliveries, refunds, and other contractual obligations.

Pre-contractual steps: To respond to inquiries and prepare potential business transactions.

Legal obligations: To comply with applicable accounting, tax, consumer protection, and other legal requirements.

Legitimate interests: To respond to business communications, protect our operations, prevent abuse, and maintain appropriate commercial records, subject to applicable safeguards.

Consent: For optional email marketing and non-essential cookies or tracking where consent is legally required.

6. Supplier Inquiries and Business Communications

PUFATI SRL purchases and processes raw goose feathers and down and welcomes inquiries from potential suppliers in Romania and international markets.

When you submit an inquiry through our Sell Us form or contact us directly, we may collect your name, company name, email address, telephone number, location, material type, available quantity, and additional information you voluntarily provide.

This information is used to evaluate supplier offers, respond to inquiries, discuss potential purchases, and maintain relevant business correspondence.

Supplier information remains within PUFATI except where necessary website, hosting, or email service providers process it on our behalf.

Unsuccessful or unanswered supplier inquiries are generally retained for 12 months, unless further retention is necessary for a lawful purpose.

Information relating to ongoing supplier relationships or completed transactions may be retained for longer where justified by contractual requirements or legal obligations.

7. Customer Data Retention

We retain personal information only for as long as necessary for the purposes for which it was collected.

General customer service communications unrelated to orders or legal obligations are reviewed periodically, normally every 24 months.

Personal information that is no longer required will be securely deleted or anonymized where appropriate.

Order records, invoices, accounting documents, and information required for legal claims may be retained for the periods prescribed or permitted by applicable law.

Requests to exercise GDPR rights are handled when received, without waiting for scheduled data reviews.

8. Repeated Uncollected Orders

Where a customer has unjustifiably failed to collect deliveries on more than three occasions, PUFATI may flag the account for manual review of future orders.

The customer will be notified by email and informed of the reason for the restriction.

Any future order will require manual approval before dispatch.

Such restrictions are reviewed after 12 months and may be reconsidered earlier upon request.

PUFATI will consider the circumstances, including potential courier errors, before applying restrictions. Decisions are subject to human review.

9. Email Marketing

PUFATI sends promotional emails and special offers only to customers who have voluntarily subscribed through the optional marketing checkbox at Shopify checkout.

We use Shopify Email for marketing communications.

Marketing consent is optional and separate from communications necessary to process orders.

Customers can withdraw their consent at any time through the unsubscribe link included in promotional emails.

Withdrawal of marketing consent does not affect transactional emails relating to purchases, deliveries, refunds, or customer service.

10. Cookies and Website Analytics

Our website uses cookies and similar technologies to support website functionality, shopping cart operations, customer preferences, security, and, where applicable, analytics.

Visitors are presented with a cookie consent banner offering:

• Accept All
• Reject All
• Manage Preferences

Non-essential cookies requiring consent should not be activated before that consent is provided.

Visitors have the right to change or withdraw cookie consent. PUFATI will provide an accessible method for doing so and can be contacted for privacy assistance.

The exact categories of cookies and third-party tracking services depend on the services active on the website.

11. Sharing Personal Information

We share personal information only where necessary for legitimate business operations or where legally required.

Recipients may include:

• Shopify and essential website service providers.
• Payment processors.
• Courier and delivery companies.
• Email and communications providers.
• Authorized service providers supporting business administration.
• Public authorities where disclosure is legally required.

We do not sell customer personal information.

Service providers are expected to handle personal information in accordance with applicable data protection requirements.

Where personal data is transferred outside the European Economic Area, applicable lawful transfer safeguards must be used.

12. Data Security

PUFATI takes reasonable technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, or loss.

Access to personal information is limited to individuals and service providers who require it for legitimate business purposes.

Although reasonable precautions are taken, no electronic system can guarantee absolute security.

13. Your GDPR Rights

Subject to applicable legal conditions, individuals may exercise the following rights:

• Access to their personal information.
• Correction of inaccurate information.
• Erasure of personal information.
• Restriction of processing.
• Data portability where applicable.
• Objection to processing based on legitimate interests.
• Withdrawal of consent where processing is based on consent.
• Rights concerning applicable automated decision-making.

Requests can be submitted by email or through the website contact form.

For identity verification, we may request confirmation using the email address and relevant order information. Additional information will be requested only when necessary.

We respond without undue delay and generally within one month, subject to extensions permitted by the GDPR.

Individuals may also lodge a complaint with the Romanian Data Protection Authority, ANSPDCP, or another competent supervisory authority.

14. Changes to This Policy

We may update this Privacy Policy when our services, business practices, or applicable legal requirements change.

The latest version will be published on our website with its updated effective date.

15. Contact

For privacy questions or requests concerning personal information, contact:

PUFATI SRL

Strada Principală nr. 758, Tulca, județul Bihor, România

CUI: 5044386

Email: contact.kisvardai.attila@gmail.com

Last updated: 31 October 2026