PRIVACY POLICY

When you request a quote or contact us

Name, email address, phone number, company or organisation name, and whatever you tell us about your project.

Why: to answer you, prepare your quote and, if you order, fulfil it.

Lawful basis: taking steps at your request before entering a contract, and performing that contract (Article 6(1)(b) GDPR).

When you place an order

The above, plus delivery addresses, order history, artwork files you supply, and invoicing details.

Why: to produce and deliver your order, invoice you and keep the accounting records Maltese law requires us to keep.

Lawful basis: contract performance, and legal obligation for tax and accounting records (Article 6(1)(b) and (c)).

When you create an account

Login email and password (stored hashed — we cannot read it), plus your saved details and order history.

Why: so you don't retype everything each time.

Lawful basis: contract performance.

When you subscribe to our newsletter

Your email address, and your subscription date as proof of consent.

Why: to send you our newsletter — six times a year, on the considered side of useful. Never daily promotions.

Lawful basis: your consent, which you can withdraw any time via the unsubscribe link in every email or by contacting us. Withdrawal takes effect immediately.

When you browse the site

Technical data — IP address, browser type, pages visited — via cookies and similar technologies.

Why: to keep the site working, secure, and to understand how it's used.

Lawful basis: legitimate interest for strictly necessary cookies; your consent for analytics and any marketing cookies, requested via the cookie banner. See section 6.

Business contact information we research

As a B2B company we sometimes hold professional contact details of people at organisations we believe may be interested in working with us (name, role, business email), gathered from public professional sources.

Why: business development — contacting the right person at an organisation, professionally and sparingly.

Lawful basis: legitimate interest in B2B marketing. You can object at any time and we will stop and remove your details. Any direct marketing email we send tells you where we got your details and how to opt out.

We do not sell personal data. We do not share it with third parties for their own marketing. We do not use automated decision-making or profiling that produces legal or similarly significant effects.

Only where necessary to run the business:

• Delivery partners — name and delivery address, to deliver your order.
• Payment providers — payment data is processed by the secure payment providers shown at checkout; we do not store full card details ourselves.
• IT and hosting providers — the website, email and order systems that hold our data run on third-party infrastructure bound by data-processing agreements.
• Professional advisers and authorities — accountants, auditors, and public authorities where the law requires it.

Where any provider processes data outside the European Economic Area, we rely on an adequacy decision or standard contractual clauses.

• Quotes that don't become orders: 12 months, then deleted.
• Orders, invoices and accounting records: the retention period required by Maltese tax law.
• Artwork files: for the duration of our relationship, so reorders are easy — deleted on request.
• Newsletter data: until you unsubscribe.
• Account data: until you close the account, then deleted except what invoicing law requires us to keep.

You have the right to access the personal data we hold about you, correct it, have it deleted, restrict or object to its processing (including objecting to direct marketing at any time, which we will always honour), receive it in a portable format, and withdraw any consent you've given.

To exercise any of these, email info@mrchxv.mt. We respond within one month. There's no fee, no form, and no fuss.

If you're unhappy with how we've handled your data, you can complain to the Information and Data Protection Commissioner (IDPC), Malta's supervisory authority — idpc.org.mt — though we'd appreciate the chance to fix it first.

The site uses:

• Strictly necessary cookies — session, cart and login functionality. These don't require consent and can't be switched off without breaking the site.
• Analytics cookies — help us understand how the site is used. Set only with your consent via the cookie banner.
• Payment-provider cookies — set by our payment partners during checkout for fraud prevention and processing.

You can change your cookie preferences at any time via your cookie settings and through your browser settings.

Personal data is stored on access-controlled systems, transmitted over encrypted connections, and accessible only to the people who need it to do their jobs. No system is perfectly secure, but if a breach ever puts your rights at risk, we will notify the IDPC within 72 hours and affected individuals without undue delay, as the GDPR requires.

Our services are for businesses and organisations. We do not knowingly collect data from anyone under 16, and the site is not directed at children.

We'll post any updates here with a revised date. Material changes affecting how we use your data will be flagged to account holders and newsletter subscribers directly.

Questions about your data? Email info@mrchxv.mt. A person reads it, and a person answers.