Privacy Policy

This Policy applies to personal information collected through this Website, including information submitted via our contact form. It does not apply to information collected offline or through other channels unless otherwise stated. By using this Website, you consent to the practices described in this Policy.

2.1 Information You Provide. We collect information you voluntarily submit through our contact form:

• Full name
• Email address
• Project type (selected from a predefined list)
• Message content describing your project or inquiry

We do not collect payment card numbers, Social Security numbers, government-issued identification, or other sensitive financial information through this Website.

2.2 Automatically Collected Technical Data. Our server infrastructure may process basic technical information when you visit the Website: IP address, browser type and version, operating system, referring URL, and pages visited. This data is used solely for operational and security purposes and is not linked to personally identifiable information beyond what is strictly necessary.

2.3 Cookies. This Website does not deploy advertising cookies, tracking pixels, or third-party analytics trackers. Functional cookies may be set by our infrastructure to ensure proper Website operation. By using this Website, you consent to this limited functional use. You may disable cookies in your browser; doing so may affect certain Website functionality.

We use the information you provide for the following purposes:

• To respond to your inquiry and communicate about potential or ongoing projects
• To provide, manage, and deliver the services you request
• To send project-related updates, invoices, and operational communications
• To maintain records of business communications and transactions
• To improve our services and Website
• To comply with applicable legal and regulatory obligations
• To detect, investigate, and prevent fraudulent or unauthorized activity

We do not sell, rent, lease, or trade your personal information to third parties for their own marketing or commercial purposes.

Where applicable law requires a legal basis for processing personal information, we rely on the following:

• Performance of a contract: processing necessary to respond to a pre-contractual inquiry or to fulfill a project agreement.
• Legitimate interests: operating and securing our business, preventing fraud, and improving our services.
• Legal obligation: complying with applicable federal and New Mexico state law.

We do not share your personal information with third parties except as described below:

5.1 Service Providers. We may engage third-party service providers (e.g., messaging infrastructure, notification services) to assist in operating our business. These providers access your information only to perform services on our behalf and are bound by confidentiality obligations.

5.2 Legal Compliance. We may disclose your information when required by law, court order, or governmental authority, including requests from the New Mexico Attorney General under the New Mexico Unfair Practices Act (NMSA 1978, § 57-12-22) or applicable federal agencies.

5.3 Business Transfers. In the event of a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will provide reasonable notice before your information becomes subject to a different privacy policy.

5.4 With Your Consent. We may share your information for other purposes with your explicit prior consent.

We retain contact form submissions and project-related communications for as long as necessary to respond to your inquiry and for legitimate business record-keeping, generally not exceeding three (3) years from the date of last contact, unless a longer period is required by applicable law or by an ongoing contractual relationship.

You may request deletion of your personal information at any time, subject to our obligations to retain certain records under applicable law (see Section 9).

We implement reasonable and appropriate technical and organizational security measures to protect your personal information from unauthorized access, disclosure, alteration, loss, or destruction. These measures include encrypted communications (HTTPS/TLS), access controls, and secure server infrastructure.

No method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security. However, in the event of a security breach that affects the confidentiality of your personal information, we will comply with our notification obligations under applicable law, including the New Mexico Data Breach Notification Act described in Section 8.

In the event of a security breach affecting New Mexico residents' personal information, Bustus Digital will comply with the New Mexico Data Breach Notification Act (NMSA 1978, §§ 57-12C-1 et seq.):

• Individual notification: Affected New Mexico residents will be notified in the most expedient time possible, and no later than 45 calendar days after discovery of the breach (NMSA 1978, § 57-12C-6).
• Attorney General notification: If the breach affects more than 1,000 New Mexico residents, we will notify the New Mexico Attorney General and major consumer reporting agencies within the same 45-day window (NMSA 1978, § 57-12C-10).
• Notification content: Notifications will include the information required under NMSA 1978, § 57-12C-7, including a description of the breach, the type of personal information affected, and steps you can take to protect yourself.

This obligation may be delayed if a law enforcement agency determines that notification would impede a criminal investigation, for the duration of such investigation.

Because Bustus Digital serves customers nationwide, California residents have the following rights under the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.) as amended by the California Privacy Rights Act:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we share it.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions (e.g., completing a transaction, legal obligations).
• Right to Correct: Request correction of inaccurate personal information we hold about you.
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising. No opt-out action is required.
• Right to Non-Discrimination: We will not deny service, charge different prices, or provide a lower quality of service because you exercised your privacy rights.

To submit a CCPA/CPRA request, contact us at [email protected]. We will respond within 45 days as required by law.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, you may have rights under the General Data Protection Regulation (GDPR) or equivalent local laws, including the right to: access your personal data; rectify inaccurate data; request erasure ("right to be forgotten"); restrict or object to processing; and data portability.

To exercise these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

This Website is operated from the United States. If you access it from outside the United States, your personal information will be transferred to and processed in the United States. By using this Website and submitting information, you acknowledge and consent to this transfer. We take appropriate steps to ensure that transfers are handled in accordance with applicable legal requirements.

This Website is not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13 in accordance with the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. § 6501 et seq.). If you believe a child under 13 has submitted personal information through this Website, please contact us immediately at [email protected] and we will take prompt steps to delete such information.

Any commercial emails we send comply with the CAN-SPAM Act (15 U.S.C. § 7701 et seq.). Each commercial email will clearly identify the sender, include a valid physical mailing address, and provide a clear and simple method to opt out of future commercial messages. We honor opt-out requests promptly, within 10 business days.

This Website may contain links to third-party websites. We are not responsible for the privacy practices, content, or security of any external sites and encourage you to review their privacy policies before providing any personal information.

We may update this Policy from time to time to reflect changes in our practices or applicable law. We will post the revised Policy on this page with an updated effective date. Your continued use of this Website after changes constitutes acceptance of the updated Policy. We encourage you to review this page periodically.

For privacy-related inquiries, to exercise your rights, or to report a potential data breach, please contact:

We aim to respond to all privacy inquiries within 30 days (45 days for CCPA requests). For data breach notifications, we comply with the 45-day requirement under NMSA 1978, § 57-12C-6.