Privacy Policy

1. Who we are

Calffa is a brand of Megaprint Transfers Ltd (UIC (EIK) 148051297, VAT number BG148051297), registered office: Gustav Vaigand 9, 9000 Varna, Bulgaria. Office and production: Bivsh Stopanski Dvor, 9140 Topoli, Bulgaria. Megaprint Transfers Ltd is the controller of the personal data processed through calffa.com (“we”, “us”).

Questions about your data or this policy: info@calffa.com, phone +359 878 965 865, or by post to the registered office above.

2. Which data we process

• Customer account: name, e-mail address, phone, password (stored encrypted), company name, VAT and registration number, invoice and delivery addresses, preferred language, saved favourites and any agreed personal discount.
• Quote requests and orders: the account data above, the products, quantities and branding you choose, your comments, the artwork files you upload and the result of the EU VAT number check (VIES).
• Contact form: name, company, e-mail address, phone, your message and language, plus the IP address and browser type used to send it (to protect the form against abuse).
• Technical data: IP address, browser and device information, pages visited and the security check on our forms (Cloudflare Turnstile).
• Analytics and marketing data — only with your consent: see our Cookie Policy (footer, “GDPR – Information”).

We do not collect special categories of personal data. Our services are aimed at businesses and are not directed at children.

3. Why we process it and on what legal basis

• Quote requests, orders, delivery and your customer account — to take steps before and to perform a contract with you (Art. 6(1)(b) GDPR).
• Invoicing, accounting and tax — legal obligation (Art. 6(1)(c) GDPR).
• Answering contact-form messages — steps at your request before a contract, or our legitimate interest in answering business enquiries (Art. 6(1)(b) and (f) GDPR).
• Website security, preventing spam and fraud — our legitimate interest (Art. 6(1)(f) GDPR).
• Analytics (Google Analytics, Hotjar) and advertising (Meta Pixel, Google Ads) — your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Information about similar products and services for existing customers — our legitimate interest; you can object at any time, free of charge, using the unsubscribe link in every such e-mail or by writing to us. Other marketing e-mails are only sent with your consent.

4. Who receives your data

We do not sell personal data. We share it only as far as needed with:

• our hosting and e-mail providers and Amazon Web Services (file and image storage in the EU, Stockholm region);
• Cloudflare (bot protection on our forms);
• courier companies delivering your order (Speedy, DPD);
• the European Commission’s VIES service, to verify EU VAT numbers;
• our accountants, legal advisers, banks and public authorities where the law requires it;
• with your consent: Google (Analytics, Ads), Hotjar and Meta Platforms (see the Cookie Policy).

Some of these providers (e.g. Google, Meta, Cloudflare) may process data outside the EU. Such transfers rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

5. How long we keep it

• Orders, invoices and accounting records: 10 years, as required by Bulgarian accounting law.
• Quote requests that did not lead to an order: up to 3 years.
• Customer account: until you ask us to delete it (order records are kept as above).
• Contact-form messages: up to 1 year, unless they become part of an order.
• Uploaded artwork: together with the related quote or order; deleted earlier on request when no longer needed.
• Analytics and advertising data: as described in the Cookie Policy.

6. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to data portability and to withdraw consent at any time (without affecting processing before the withdrawal). Write to info@calffa.com; we answer within one month.

You may also complain to the Bulgarian supervisory authority: Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg — or to the authority in your own EU country.

7. Security

We protect personal data with technical and organisational measures: encrypted connections (HTTPS), encrypted passwords, access only for authorised staff, bot protection on forms and regular backups. We make no decisions about you based solely on automated processing.

8. Changes

We may update this policy when our services or the law change. The current version is always published here, with its date at the top.