Privacy Policy

Last updated: __________________

This Privacy Policy explains how personal data is collected, used, stored and shared when you visit, interact with or make a purchase through this website (the “Site”). The Site will be operated by a company incorporated in Malta. The company name, Malta Business Registry number, registered office and contact details will be inserted once incorporation and operational details are confirmed.

1. Who Is the Data Controller?

For the purposes of Regulation (EU) 2016/679 (the “GDPR”) and the Data Protection Act, Chapter 586 of the Laws of Malta, the operator of the Site will act as the data controller in respect of personal data for which it determines the purposes and means of processing.

Controller details will be completed after incorporation:

  • Company name: ______________________________
  • Malta Business Registry number: ______________________________
  • Registered office: ______________________________
  • Privacy contact email: ______________________________
  • Data Protection Officer, if appointed/required: ______________________________

2. Personal Data We Collect

Depending on how you use the Site, we may collect the following categories of personal data:

  • Identity and contact data, such as name, billing address, delivery address, email address and telephone number.
  • Order and transaction data, such as products ordered, order value, refunds, delivery status and transaction references.
  • Payment-related data. Payments may be processed by third-party payment service providers. We may receive limited payment information such as payment status, card type, masked card digits or transaction identifiers; full card credentials may be processed directly by the payment provider.
  • Account data, such as username, encrypted credentials, saved preferences and account history.
  • Device and technical data, such as IP address, browser type, device type, operating system, time zone, language, identifiers, log data and security information.
  • Usage data, such as pages viewed, products viewed, searches, clicks, referral source and interaction with the Site.
  • Communications data, including enquiries, customer service messages, complaints, reviews and correspondence.
  • Marketing and preference data, including consent choices and communication preferences.
  • Fraud prevention and compliance data where reasonably required to protect transactions, prevent abuse or comply with legal obligations.

3. How We Collect Personal Data

We collect personal data directly from you when you create an account, place an order, contact us, subscribe to communications or otherwise provide information.

We may also collect data automatically through cookies, pixels, server logs and similar technologies, and receive relevant information from payment providers, delivery partners, fraud-prevention providers, analytics providers and other service providers involved in completing or securing transactions.

4. Purposes and Legal Bases for Processing

We process personal data only where we have an appropriate legal basis under the GDPR. Depending on the activity, this may include:

  • Performance of a contract: to process orders, take payment, arrange delivery, provide order confirmations, manage returns and refunds, and provide customer support.
  • Compliance with a legal obligation: to meet accounting, tax, consumer protection, fraud prevention, regulatory, record-keeping and lawful disclosure requirements.
  • Legitimate interests: to operate and secure the Site, prevent fraud, improve services, manage business operations, defend legal claims and understand how customers use the Site, where those interests are not overridden by your rights.
  • Consent: where consent is required, including for certain cookies, tracking technologies or electronic marketing activities. You may withdraw consent at any time without affecting processing that occurred before withdrawal.

5. Cookies and Similar Technologies

The Site may use strictly necessary cookies and, subject to applicable consent requirements, analytics, functionality and advertising cookies or similar technologies.

Where consent is legally required, non-essential cookies will not be activated until the appropriate consent has been obtained. You will be able to manage relevant preferences through the Site’s cookie consent mechanism.

A separate Cookie Policy may be provided with further information about individual cookies, providers, purposes and retention periods.

6. How We Share Personal Data

We may share personal data only where necessary and lawful, including with:

  • Payment processors, acquiring banks and payment service providers.
  • Suppliers, fulfilment centres, distributors and delivery/courier providers.
  • Website hosting, cloud, IT, cybersecurity and customer-support providers.
  • Analytics, advertising and marketing providers, subject to applicable consent and privacy requirements.
  • Professional advisers, auditors, insurers, banks and corporate service providers.
  • Fraud prevention, identity verification and security providers where appropriate.
  • Public authorities, regulators, courts, law-enforcement bodies or other parties where disclosure is required or permitted by law.
  • A purchaser, investor or successor in connection with a genuine corporate transaction, subject to appropriate confidentiality and data-protection safeguards.

We do not sell personal data as a commodity.

7. International Transfers

Some service providers, suppliers or technology systems may process personal data outside Malta or outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA to a country not recognized as providing an adequate level of protection, we will use an appropriate transfer mechanism where required, such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where appropriate.

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including to fulfil orders, maintain business and accounting records, comply with tax and legal obligations, resolve disputes, prevent fraud and enforce agreements.

Different categories of data may be retained for different periods. Retention periods will be determined by the nature of the data, the purpose of processing, contractual requirements, applicable limitation periods and legal or regulatory obligations.

When personal data is no longer required, it will be deleted, anonymised or securely retained only where required by law.

9. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

No internet transmission or storage system can be guaranteed to be completely secure. Where a personal data breach occurs, we will assess and address it in accordance with applicable GDPR and Maltese data-protection requirements.

10. Your Data Protection Rights

Subject to the conditions and limitations in the GDPR, you may have the right to:

  • Request access to your personal data.
  • Request correction of inaccurate or incomplete personal data.
  • Request erasure of personal data.
  • Request restriction of processing.
  • Object to processing based on legitimate interests and, where applicable, object to direct marketing.
  • Request data portability for qualifying processing.
  • Withdraw consent at any time where processing is based on consent.
  • Request information about safeguards used for qualifying international transfers.
  • Lodge a complaint with a competent supervisory authority.

Requests may be submitted using the privacy contact details to be published on the Site. We may need to verify your identity before acting on a request.

11. Complaints to the Maltese Supervisory Authority

If you have concerns about the way we process personal data, you are encouraged to contact us first so that we can investigate.

You also have the right to lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC) in Malta, or, where applicable, with another competent supervisory authority in the EEA.

12. Direct Marketing

Where permitted by law, we may send marketing communications about products, services or offers. Where consent is required, such communications will be sent only after the required consent has been obtained.

You can opt out of electronic marketing at any time by using the unsubscribe mechanism in the communication or by contacting us. Opting out of marketing does not affect essential transactional or service communications.

13. Automated Decision-Making and Profiling

We may use automated tools to support fraud prevention, transaction security, personalization or marketing. If we carry out solely automated decision-making that produces legal or similarly significant effects and is regulated by Article 22 GDPR, we will provide the additional information and safeguards required by law.

14. Children

The Site is not intentionally directed at children for independent purchasing. Where the processing of a child’s personal data requires parental authorization under applicable law, we will take reasonable steps to obtain appropriate authorization.

15. Third-Party Websites and Services

The Site may contain links to third-party websites or services. Those third parties operate under their own privacy policies, and we are not responsible for their independent processing activities.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our business, technology, legal requirements or processing activities. The updated version will be published on the Site with a revised “Last updated” date. Where required, we will provide additional notice or seek renewed consent.

17. Contact Us

The following details will be completed once the Maltese company and operating structure are finalized:

  • Company name: ______________________________
  • Malta Business Registry number: ______________________________
  • Registered office: ______________________________
  • Privacy/contact email: ______________________________
  • Telephone (if applicable): ______________________________
  • Website/domain: ______________________________