Privacy policy

Privacy Policy

Last updated: 5 August 2026

This Privacy Policy explains what personal data we collect when you visit pleasuremalta.com or buy from us, why we collect it, how long we keep it, and what rights you have. We have tried to write it in plain language rather than legalese.

1. Who We Are (Data Controller)

The controller of your personal data is:

We are not required to appoint a Data Protection Officer, but privacy questions go to the email address above and are handled by the trader personally.

2. A Note on Sensitivity

We sell adult lifestyle products. We understand that the fact you shop with us, and what you buy, is private. We treat order contents as sensitive information. In practice that means:

  • All parcels are dispatched in plain, unbranded packaging with no reference to us or the contents.
  • The sender name on the label is a neutral shipping reference.
  • We do not sell your personal data, and we do not share order contents with anyone except the parties listed in section 6 who need it to fulfil your order.
  • We do not build advertising profiles based on the specific intimate products you view or buy beyond the standard advertising measurement described in section 5 and in our Cookie Policy, which you control through the cookie banner.

3. What We Collect

3.1 What we do NOT collect

  • We do not collect or store your full card number. Card payments are handled by our payment processors.
  • We do not collect your ID card or passport number.
  • We do not collect precise GPS location.
  • We do not ask for, or record, any information about your health, sexual orientation, or relationship status.
  • We do not buy personal data from data brokers.

3.2 What we do collect

Category Examples Where it comes from
Identity and contact Name, email, phone, billing and delivery address You, at checkout or when you contact us
Order data Items ordered, order value, order number, delivery method, order status Generated when you order
Payment data Payment method type, last four digits, authorisation result, transaction ID. Not the full card number. Our payment processors
Account data Email, password (stored hashed by Shopify), saved addresses, order history You, if you create an account
Communications Emails, WhatsApp messages, and any content you send us You
Marketing preferences Whether you opted in to our newsletter, and unsubscribes You
Technical data IP address, browser and device type, pages viewed, referring site, approximate country Automatically, via cookies and server logs
Age confirmation A record that you confirmed you are 18 or over The age verification gate on our site

4. Why We Use It, and Our Legal Basis

Under Article 6 of the GDPR we must have a lawful basis for every use of your data. Ours are:

Purpose Legal basis
Taking, processing, packing, and delivering your order; handling returns and refunds; customer support about your order Contract (Art. 6(1)(b))
Keeping VAT and accounting records Legal obligation (Art. 6(1)(c)), Maltese VAT and tax law
Verifying that you are 18 or over Legal obligation and legitimate interests (Art. 6(1)(c) and (f)), preventing sale of adult products to minors
Preventing fraud and securing the website Legitimate interests (Art. 6(1)(f)), protecting the business and customers
Essential cookies that make the site and cart work Legitimate interests (Art. 6(1)(f)); exempt from consent under the ePrivacy rules
Analytics, advertising, and conversion measurement cookies Consent (Art. 6(1)(a)), given through our cookie banner and withdrawable at any time
Marketing emails and newsletters Consent (Art. 6(1)(a)), withdrawable via the unsubscribe link in every email
Responding to general enquiries not related to an order Legitimate interests (Art. 6(1)(f)), answering people who contact us

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and you may object at any time (see section 8).

5. Advertising and Analytics

We use a Google Ads conversion tag (ID AW-926310312) to measure how well our advertising works. When you have consented to marketing cookies, it reports events such as page views, product views, adding to cart, starting checkout, and completed purchases, along with order value. This can include the product concerned.

We also use Shopify's built-in store analytics to understand aggregate traffic and sales.

These are only active if you accept marketing or analytics cookies. If you decline, or withdraw consent later, they do not run. See our Cookie Policy for the full list and controls.

We do not use Meta or TikTok pixels on this website.

6. Who We Share It With

We share personal data only with the parties below, and only as far as they need it. We do not sell personal data.

Recipient What for Their privacy information
Shopify (Shopify International Ltd, Ireland) Hosts our store, processes orders, stores customer accounts, provides store analytics shopify.com/legal/privacy
Shopify Payments and acquiring banks Processing card payments shopify.com/legal/privacy
MaltaPost Delivering your parcel. Receives name, address, phone, and parcel weight. Not the contents. maltapost.com
Bolt For orders placed via the Bolt app. Bolt is a separate controller for its own app and courier data, and processes your data under its own privacy policy. bolt.eu/legal
Google (Google Ireland Ltd) Advertising conversion measurement, only with your consent policies.google.com/privacy
Omega Age Verifier (Shopify app) The 18+ age gate on our site See the app listing on the Shopify App Store
Code Black Belt (Frequently Bought Together app) Product recommendations on product pages codeblackbelt.com
Shopiapps (WhatsApp share widget) The WhatsApp sharing button See the app listing on the Shopify App Store
Our accountant and tax authorities Bookkeeping, VAT returns, statutory filings Malta Tax and Customs Administration

We may also disclose data where we are legally required to, for example in response to a valid order from a court or authority, or where necessary to establish or defend legal claims.

7. How Long We Keep It

Data Retention
Order records, invoices, VAT documentation 10 years, as required by Maltese tax and VAT record-keeping rules
Customer account data Until you ask us to delete the account, then removed within 30 days, except records we must keep for tax
Customer support emails and WhatsApp messages 24 months from the last message, unless linked to an ongoing dispute
Marketing list membership Until you unsubscribe, plus a suppression record so we do not email you again
Website server logs Retained by Shopify under its own schedule, typically 30 days
Advertising and analytics data Held by Google under its retention settings, up to 14 months at event level
Age confirmation record Stored in your browser and cleared on the schedule set in the age gate, currently daily
Abandoned carts 30 days

8. Your Rights

Under the GDPR and the Maltese Data Protection Act (Chapter 586 of the Laws of Malta), you have the right to:

  • Access the personal data we hold about you, and receive a copy;
  • Rectify data that is inaccurate or incomplete;
  • Erasure of your data, where we no longer need it and no legal obligation requires us to keep it;
  • Restrict processing in certain circumstances;
  • Data portability, receiving the data you gave us in a machine-readable format;
  • Object to processing based on legitimate interests, and to direct marketing at any time;
  • Withdraw consent at any time, without affecting processing that already happened;
  • Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not carry out such automated decision-making or profiling.

To exercise any of these, email info@pleasuremalta.com. We will respond within one month. We may ask you to confirm your identity first, so that we do not disclose your data to someone else. Exercising your rights is free of charge.

Complaints

If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to lodge a complaint with the Maltese supervisory authority:

Office of the Information and Data Protection Commissioner (IDPC)
Floor 2, Airways House, High Street, Sliema SLM 1549, Malta
idpc.org.mt

If you live in another EEA country you may complain to your local data protection authority instead.

9. International Transfers

Our main processors (Shopify, Google) are established in Ireland but may transfer data outside the EEA, including to the United States, as part of their global infrastructure.

Where data leaves the EEA, those transfers are covered by the European Commission's Standard Contractual Clauses, by an adequacy decision (including the EU-US Data Privacy Framework where the recipient is certified), or by another lawful transfer mechanism. You can ask us for details of the safeguards that apply.

10. Children

This is an adult website. Our products and services are sold exclusively to people aged 18 or over, and the site carries an age verification gate. We do not knowingly collect personal data from anyone under 18.

If you believe a person under 18 has provided us with personal data, contact us at info@pleasuremalta.com and we will delete it promptly.

11. Security

  • The site runs over HTTPS, so data in transit is encrypted.
  • Customer data is held within Shopify's infrastructure, which maintains PCI DSS Level 1 certification for payment handling.
  • We do not store full card numbers anywhere.
  • Access to the store admin is limited to the trader and is protected by a password and two-factor authentication.
  • No system is perfectly secure. If a data breach occurs that is likely to result in a risk to your rights, we will notify the IDPC within 72 hours and inform you where the law requires it.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes to our practices, our tools, or the law. We will change the "Last updated" date at the top and, where the change is significant, tell you by email or a notice on the site.

13. Contact

For anything relating to your privacy or this policy:

  • Email: info@pleasuremalta.com
  • Post: Matthew Bartolo, trading as PleasureMalta, Flat 2, 10 Triq il-Qolla, Ħaż-Żebbuġ ZBG 1511, Malta
  • Response time: within one month

This Privacy Policy should be read together with our Cookie Policy, Legal Notice, Terms and Conditions, Shipping Policy, and Returns and Refunds Policy.

[time] minutes ago, from [location]
You have successfully subscribed!