01. Who we are

The controller of your personal data is Tessera Ltd, a company registered in Malta (Company Reg. No. [C XXXXX]), Canon Road, St. Venera, SVR 9034, Malta. For any question about this policy or your personal data, contact us at [email protected] or +356 2749 0100. [Tessera to confirm a dedicated privacy contact / DPO if appointed.]

02. What data we collect

Data you give us

• Account details: email address and password when you register.
• Order details: name, company name, billing and delivery address, phone number, email address, VAT number (optional, for business customers), order notes and the products you buy.
• Payment information: card payments are entered directly into the secure fields of our payment provider, Viva Wallet. We receive the payment status and a transaction reference, but not your full card details.
• Enquiries: your name, email address and message when you contact us by form, email, phone or social media.

Data collected automatically

• Technical data: IP address, browser and device type, and pages requested, recorded in server and security logs.
• Cookies: necessary cookies that make the shop work, and – only with your consent – functional and analytics cookies, including how you arrived at our website (order attribution). See our Cookie Policy.

We do not collect special categories of personal data.

03. Why we use your data and our legal basis

Where we rely on consent, you can withdraw it at any time without affecting processing carried out before withdrawal. Cookie consent can be changed through the Cookie Settings link at the bottom of every page.

04. Who we share your data with

We only share your personal data where necessary, with service providers acting on our instructions under appropriate agreements:

• Viva Wallet – payment processing.
• Born – our website development and maintenance agency.
• Website hosting provider [name and location] – hosts our website and its database.
• Cloudflare – content delivery and website security.
• Email delivery provider [name] – sends order and account emails.
• Couriers [names] – deliver your orders.
• Shireburn – our accounting/ERP system [only if customer data is synchronised].
• Our professional advisers, auditors and public authorities where required by law.

We do not sell your personal data.

05. Transfers outside the EU

Most of your data is processed within the European Union. Some providers, such as Cloudflare and Google (which delivers the fonts used on our website), are based in the United States and may process technical data such as your IP address outside the EU. Where this happens, the transfer is protected by an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses. [Tessera/Born to confirm the list of providers and safeguards.]

06. How long we keep your data

• Order and invoice records: [X] years after the order, as required by accounting and tax law.
• Customer accounts: while your account is active; inactive accounts are deleted after [X] months/years.
• Unpaid, failed or cancelled orders: deleted after [X] days.
• Enquiries: [X] months after the enquiry is closed.
• Cookie consent records: up to 1 year. Other cookies: see the Cookie Policy.
• Security logs: [X] days.

07. Your rights

Under the GDPR you have the right to:

• be informed about how we use your personal data;
• access your personal data and receive a copy of it;
• have inaccurate data corrected;
• have your data erased, where there is no legal reason for us to keep it;
• restrict how we use your data;
• receive your data in a portable format, or have it transferred to another provider;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• withdraw your consent at any time, where processing is based on consent;
• not be subject to decisions based solely on automated processing that significantly affect you (we do not make such decisions).

To exercise your rights, email [email protected]. We will respond within one month. We may ask you to confirm your identity before acting on your request.

08. Complaints

If you are unhappy with how we handle your personal data, please contact us first. You also have the right to lodge a complaint with the supervisory authority in Malta, the Information and Data Protection Commissioner (IDPC), Floor 2, Airways House, Triq Il-Kbira, Tas-Sliema, SLM 1549, Malta – idpc.org.mt – or with the authority in the EU country where you live or work.

09. Security

We use appropriate technical and organisational measures to protect your personal data, including encrypted (HTTPS) connections, a website firewall, access controls and regular backups. No transmission over the internet is completely secure; if you believe your data may have been compromised, please contact us immediately.

10. Changes to this policy

We may update this policy from time to time. The latest version will always be available on this page. Last updated: 2026

11. Contact Information