Privacy Policy

Who is responsible

This notice concerns the Pasteca website. The legal entity operating Pasteca, its registered address and a dedicated privacy contact must be confirmed before this draft is published as the final notice.

For now, you can find our business location and social contact channels on the Contact page. Please avoid sending sensitive personal information through social media.

Information we process

Website requests can include your IP address, browser details, pages requested and technical error information. Hosting providers may process this information to deliver and protect the website.

Application diagnostics report failures using a timestamp, an error reference, a general page category and limited technical error codes. Browser reports do not include form contents, error messages, full URLs or persistent visitor identifiers. Server diagnostics omit passwords, cookies, authorisation headers, message contents and raw error messages. Hosting infrastructure may separately keep request and security logs.

If you use an enabled sign-in service, Supabase processes account and authentication information. Public account access is currently hidden; administration still requires sign-in.

The contact form requests your name, email address and message. Email delivery is not currently enabled. Once enabled, these details will be sent to the configured recipient through the selected email provider. Messages are not written to the website’s Supabase database, but copies may be retained in email systems and provider records.

Why we use information

Information is used to operate and secure the website, manage authorised access and respond to enquiries. Depending on the request, the relevant legal basis may be legitimate interests in running a secure website and handling correspondence, or steps requested before entering a contract. Legal obligations may also require processing.

Sending an enquiry does not subscribe you to marketing. Any future optional marketing or tracking would need its own appropriate information and legal basis.

Services and external links

Supabase supplies authentication, database and image storage. Google Fonts delivers the website’s fonts, so your browser connects to Google when requesting them. The public outlet map uses map files served by this website; the admin location picker requests OpenStreetMap tiles. Directions and social links take you to external services, whose own privacy notices apply.

The final notice must name the selected website host and email provider, explain their roles and processing locations, and identify any applicable safeguards for transfers outside the EEA. These arrangements are still being reviewed.

How long information is kept

Information should be kept only for as long as needed for its purpose and any applicable legal obligations or claims. The final retention schedule for enquiries, accounts, hosting logs and service-provider records must be confirmed before the corresponding services are launched. “Not stored in our database” does not mean that an email or technical record is never retained elsewhere.

Contact-form abuse protection uses short-lived, in-memory counters based on a hashed IP address, expiring after five minutes. Duplicate-send protection keeps a request reference and hashed message fingerprint in memory for up to 15 minutes, without retaining your message text in that record. Hashing is a protective measure; it does not make all associated processing anonymous.

Your choices and rights

Depending on the circumstances, you may request access, correction, deletion, restriction or portability of your personal data, and object to certain processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Some rights have legal limits.

You may also complain to Malta’s Information and Data Protection Commissioner. The final notice will provide the business’s dedicated contact for privacy requests.

Changes to this notice

We will update this notice when website features or providers change. The review date appears at the top. See our Cookie Policy for information about browser storage.