[DRAFT – to be reviewed by a professional before the shop opens. Replace every item in square brackets.]
Privacy Policy
1. Data controller
The controller of your personal data is [FULL NAME / COMPANY NAME], [ADDRESS], Msida, Malta. Email: [CONTACT EMAIL].
2. What data we collect
- Orders: name, billing and shipping address, email, phone number (optional), products purchased.
- Customer account: the data above, plus your login details, if you create an account.
- Contact form and emails: the data you choose to send us.
- Payments: handled directly by our payment providers ([STRIPE / PAYPAL]); we never see or store your full card details.
- Technical data: IP address and browser information in server logs, for security.
3. Why we use it (legal basis)
- To process and ship your orders (performance of a contract).
- To keep invoices and accounting records (legal obligation).
- To answer your questions (legitimate interest / pre-contractual steps).
- To send newsletters or offers, only if you ask for them (consent).
4. Who we share it with
- Shipping carriers (MaltaPost, DHL) – to deliver your order.
- Payment providers ([STRIPE / PAYPAL]) – to process payments.
- Our hosting provider (Hostinger, servers in the EU) – to run the website.
- [ACCOUNTANT / OTHER PROVIDERS]
We do not sell your personal data.
5. How long we keep it
Order and invoice data are kept for [X] years as required by tax law. Other data is kept only as long as needed for the purpose it was collected for.
6. Your rights
You have the right to access, correct, delete or port your data, to restrict or object to its processing and to withdraw consent at any time. Write to [CONTACT EMAIL]. You can also lodge a complaint with the Maltese Information and Data Protection Commissioner (IDPC) or with the authority of your country.
7. Cookies
For information about cookies, please see our Cookie Policy.
Last update: [DATE]