1.) Who we are

This website is operated by Attard & Co. Wines & Spirits, Canter House, P. Felicjan Bilocca Street, Marsa MRS 1524, Malta. In this policy “we”, “us” and “our” mean that company, and we are the controller of the personal data described below.

Company registration number: [to be confirmed]. Data protection representative: [to be confirmed].

You can reach us about anything in this policy at [email protected] or on +356 2123 7555.

2.) The information we collect

Information you give us. When you place an order, open an account, add something to a wishlist, sign up to our newsletter or write to us, we collect what you type in:

• your name, billing address and delivery address
• your email address and telephone number
• the contents of your order, and the date you placed it
• your account username, and a password we store only as a cryptographic hash
• anything you choose to tell us in a message

Information we collect automatically. Our website and its host record your IP address, the browser and device you are using, the pages you look at and the site or search that brought you to us. This is described in more detail under Cookies below.

What we do not collect. We do not ask for and do not want special category data — anything about your health, beliefs, politics or the like. We do not knowingly collect any information from people under 18.

3.) Why we use it, and on what legal basis

Under the GDPR we have to have a lawful basis for each thing we do with your data. These are ours:

• To take and deliver your order, handle returns and answer questions about it — because we need to in order to perform our contract with you.
• To run your account, including your order history and wishlist — performance of our contract with you.
• To check you are old enough to buy alcohol — to comply with a legal obligation.
• To keep accounting, VAT and excise records — to comply with a legal obligation.
• To send you our newsletter — only with your consent, which you can withdraw at any time.
• To reply to enquiries, to keep the site secure and to prevent fraud — our legitimate interest in running the business safely, balanced against your rights.

We do not use your data to make any decision about you by automated means, and we do not profile you.

4.) Who we share it with

We do not sell your personal data, and we never will. We share it only with the people who need it to deliver what you have asked for:

• Delivery partners, who receive the name, address and telephone number needed to bring you your order.
• Payment providers. Orders on this site are currently settled by cash on delivery, so no card details reach us at all. If a card payment option is added, your card details will go directly to that provider and will never be stored on our systems. [Provider to be confirmed before launch.]
• Our website host and IT suppliers, who may see personal data incidentally while keeping the site running, and who are bound to keep it confidential.
• Google. The site loads its typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), which discloses your IP address to Google, including in the United States.
• Our professional advisers, and public authorities, where we are required to by law.

5.) Cookies

A cookie is a small file the site asks your browser to keep. These are the ones this site sets, and what each is for:

• acw_age_verified — records that you have confirmed you are of legal drinking age, so the notice does not appear on every page.
• woocommerce_cart_hash, woocommerce_items_in_cart and wp_woocommerce_session_* — remember what is in your basket while you shop.
• woosw_key — remembers your wishlist.
• sbjs_* — record how you first reached the site and how you reached it this visit, so we can tell which of our own channels an order came from.
• wordpress_logged_in_* and wp-settings-* — keep you signed in to your account and remember your preferences.

None of these is an advertising cookie, and we do not run advertising or analytics trackers on this site. You can delete or block cookies in your browser settings, but the basket, the wishlist and signing in will stop working if you block the ones above.

6.) Age verification

We sell alcohol, and it is against the law to sell it to anyone under 18 in Malta. The notice shown when you first arrive asks you to confirm your age; all we record is the fact that you confirmed it, in the cookie named above. We may ask for proof of age on delivery.

7.) How long we keep it

• Orders, invoices and related correspondence — for [number] years, which is the period our tax and VAT obligations in Malta require. [To be confirmed with the company’s accountant.]
• Your account — for as long as you keep it. Ask us to close it and we will delete it, apart from anything we are obliged to keep under the line above.
• Newsletter subscription — until you unsubscribe, which you can do from the foot of any newsletter we send.
• Enquiries — for [number] months after the matter is closed.

8.) Your rights

You have the right to ask us for a copy of the personal data we hold about you; to have it corrected if it is wrong; to have it deleted; to ask us to restrict what we do with it; to receive it in a portable form; and to object to our using it where we rely on legitimate interests. Where we rely on your consent, you can withdraw it at any time, and doing so does not affect anything we did before you withdrew it.

To exercise any of these, write to [email protected]. We will respond within one month.

If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Information and Data Protection Commissioner, who is the supervisory authority in Malta: idpc.org.mt.

9.) Keeping it safe

The site is served over an encrypted connection, passwords are stored only as hashes, and access to order and customer data is limited to the people who need it. No system is perfectly secure, but we take the protection of your data seriously and will tell you and the Commissioner if something goes wrong in a way that puts you at risk.

10.) Sending data outside the EEA

We keep your data within the European Economic Area wherever we can. Where a supplier is outside it — as Google is, for the typefaces described above — that transfer is covered by the European Commission’s standard contractual clauses or by an adequacy decision.

11.) Changes to this policy

If we change this policy we will update the date shown at the top of this page, and if the change is significant we will say so on the site. Please look at it again from time to time.

12.) How to contact us

Attard & Co. Wines & Spirits
Canter House, P. Felicjan Bilocca Street, Marsa MRS 1524, Malta
Email: [email protected]
Telephone: +356 2123 7555