Privacy Policy

Who is responsible

Burrito Games is the controller of your personal data (the party that decides why and how it is used), Johan de Wittstraat 135 9716CD Groningen The Netherlands, KVK number 42075388. You can reach us at puchamongame@gmail.com or via the contact page.

1. What we collect

When you place an order or create an account, we collect your name, email address, shipping address and order details. If you contact us, we collect what you send us. We do not collect or store payment card details ourselves — payment is handled by Stripe (see below).

2. Why we collect it

To process and ship your order, manage pre-order allocations, send order confirmations and, if you have an account, show your order history. This is processed under the legal basis of contract performance (GDPR Art. 6(1)(b)).

3. Third parties

We use the following service providers, who process data on our behalf under their own privacy and security terms: Stripe (payments), Supabase (our database and account authentication), Resend (transactional and newsletter email), Google Cloud (hosting) and, where enabled, Cloudflare (bot protection on checkout and forms). We do not sell your personal data.

When you choose a password we check it against the public Have I Been Pwned breach list so you are not using one that criminals already know. Only the first five characters of a one-way hash of the password are sent; the password itself never leaves our server and Have I Been Pwned cannot work out what it was.

To keep the shop available to real customers, we briefly process your IP address to limit how often it can submit checkout, contact and signup requests. These counters are short-lived and are not used to identify or profile you.

4. Newsletter, alerts and reminders

We only email you our newsletter if you subscribe and then confirm via the link we send you (double opt-in). We record when you gave consent. Every email can be unsubscribed from in one step, and we stop mailing you immediately. Your consent is the legal basis, and you can withdraw it at any time.

Back-in-stock alerts. If you ask to be told when a sold-out product is available again, we keep your email address and the product until we have sent you that one email (or until you remove it with the link in the email); unconfirmed requests are deleted after a week. Cart reminders. If you tick the box for updates during checkout and do not finish paying, we may send you one reminder email with a link back to your checkout.

Reviews. Only customers who bought a product can write a review. We show the name you enter, your rating and your text on the product page once we have approved it. You can delete your review at any time. Withdrawals and order lookup. If you use the withdrawal form we keep your statement (name, email, order number, items and reason) as a record of the contract; the order lookup page only shows an order to someone who knows both its number and the email address it was placed with.

5. Cookies

We use a small number of essential cookies — to keep items in your cart and to hold your place in the checkout queue during payment. We don't use advertising or tracking cookies.

Your browser also keeps a few things on your own device (local storage), which we do not receive: the contents of your cart, the products you recently looked at, and display preferences such as the optional constellation background. They stay on your device until you clear your browser data. Your cart is only sent to us when you press Checkout.

6. Data retention

Order and invoice records are kept for 7 years, the period Dutch tax and accounting law requires. Account data is kept until you ask us to delete it, subject to the same retention requirement for past orders. Messages you send through the contact form are kept for as long as needed to answer you and for our records; ask us and we delete them.

7. Your rights

Under the GDPR you can request access to, correction of, or deletion of your personal data, and can object to or restrict certain processing. If you have an account you can download your data or delete your account yourself under Account → Privacy & Data; for anything else, contact us via the contact page to exercise any of these. You may also lodge a complaint with your national data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens).

8. Contact

For any privacy question, reach us via the contact page.