Privacy & data protection

Privacy Policy

Before publishing: replace every highlighted placeholder with confirmed business, contact, vendor and retention details. This template is not a substitute for legal advice.

Last updated: [INSERT DATE]

1. Who is responsible for your data?

[INSERT LEGAL BUSINESS NAME] of [INSERT REGISTERED/OPERATING ADDRESS] is the controller for personal data processed through this website.

Contact: [INSERT PRIVACY EMAIL ADDRESS] · Telephone: +356 9944 0449 · Data protection contact/DPO, if appointed: [INSERT DETAILS OR “NOT APPOINTED”].

2. Data we process

Reservation requests: name, requested date/time, party size and optional message sent through WhatsApp.
Technical data: IP address, browser/device data and request logs processed by our hosting/DNS providers when you visit the website.
Cookie preferences: your choice for optional analytics and marketing technologies is stored locally on your device.
Third-party resource data: your browser may request fonts from Google Fonts. Social-media and map providers receive data only if you choose to open their link.

3. Why we use it and legal basis

We use reservation details to take steps at your request before entering a reservation/service arrangement ([CONFIRM ARTICLE 6(1)(b) GDPR]). We use strictly necessary technical logs to operate, secure and troubleshoot the site ([CONFIRM LEGITIMATE INTERESTS / OTHER BASIS]). We do not use reservation details for marketing unless you separately opt in.

4. Who receives your data?

Data may be processed by: [INSERT HOSTING/DNS PROVIDER], [INSERT EMAIL PROVIDER IF USED], Google Fonts, and WhatsApp/Meta when you submit a booking request. List every actual provider, their role (processor/independent controller where applicable), and a link to their privacy information here.

5. International transfers

Some suppliers may process personal data outside the EEA. Before publication, document each transfer, country, and the safeguard used (for example, an adequacy decision or Standard Contractual Clauses): [INSERT TRANSFER ASSESSMENT AND SAFEGUARDS].

6. How long we keep data

Reservation requests: [INSERT RETENTION PERIOD AND DELETION METHOD]. Technical logs: [INSERT HOST LOG RETENTION]. We retain data longer only where required to establish, exercise or defend legal claims or meet a legal obligation.

7. Your rights

Subject to the GDPR, you may request access, correction, erasure, restriction, portability or object to certain processing. Contact us at [INSERT PRIVACY EMAIL ADDRESS]. You may also complain to Malta’s Information and Data Protection Commissioner (IDPC).

8. Changes and contact

We may update this policy when our services or suppliers change. The latest version will appear on this page. Questions can be sent to [INSERT PRIVACY EMAIL ADDRESS].