Privacy Policy

This Privacy Policy explains how Magic Bites Ltd ("we", "us") collects and uses your personal data when you visit magicbites.mt or place an order. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Maltese Data Protection Act (Cap. 586).

1. Data controller

Magic Bites Ltd
114 Zerniq, Triq is-Saghtar, Mellieha, Malta
VAT number: MT2308-4716
Email: info@magicbites.mt
Phone: +356 7978 5578

2. What data we collect

• Account data: name, email address, password (stored encrypted), phone number, date of birth and preferred language, if you create an account.
• Order data: name, email, phone, delivery address, city and postal code, preferred delivery time, order notes, ordered products and amounts. Guest checkout collects the same data without creating an account.
• Payment data: payments are processed by Stripe. We never see or store your full card details; we only keep a payment reference and payment status.
• Contact form: name, email, phone (optional) and your message, used only to reply to you.
• Reviews and wishlist: product reviews you publish and products you save to your wishlist.
• Technical data: IP address, browser type and session data needed for the site to work (e.g. login, cart, language).
• Analytics data: only if you accept analytics cookies — information on how you use the site (pages visited, approximate location, device type), collected by Google Analytics.

3. Why we use your data and the legal basis

• Processing and delivering your order, issuing invoices and customer support — performance of a contract (Art. 6(1)(b) GDPR).
• Keeping accounting and tax records — legal obligation (Art. 6(1)(c) GDPR).
• Site security and fraud prevention — our legitimate interest (Art. 6(1)(f) GDPR).
• Website analytics — your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

4. Cookies

We use essential cookies that are necessary for the site to work (session, login, cart, language and security/CSRF). These do not require consent.

With your consent, we use Google Analytics cookies (_ga, _ga_*) to understand how visitors use the site. Until you click "Accept", analytics cookies are not set. You can change your choice at any time using the "Cookie Settings" link in the footer or the button at the bottom of this page.

The map on our Contact page is provided by Google Maps and is loaded only when you click "Show map"; Google may then set its own cookies.

5. Who we share data with

We do not sell your personal data. We share it only with service providers who help us run the shop:

• Stripe — payment processing;
• Google (Google Ireland Ltd.) — website analytics, only with your consent;
• Hosting and email providers — servers located in the EU on which the site and emails run;
• Delivery staff — name, address and phone number needed to deliver your order;
• Authorities — when required by law.

Some providers (e.g. Stripe, Google) may transfer data outside the EU. Such transfers are protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

6. How long we keep data

• Order and invoice data — for as long as required by Maltese tax and accounting law.
• Account data — until you delete your account or ask us to delete it.
• Analytics data — up to 14 months (Google Analytics retention setting).

7. Your rights

You have the right to access, correct or delete your data, to restrict or object to processing, to data portability, and to withdraw consent at any time. To exercise these rights, contact us at info@magicbites.mt.

You also have the right to lodge a complaint with the Maltese supervisory authority, the Information and Data Protection Commissioner (IDPC) — idpc.org.mt.

8. Security

The site uses an encrypted (HTTPS) connection, passwords are stored encrypted, and access to personal data is limited to authorised staff.

9. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always published on this page, with the date of the last update.