Privacy Policy

1. Who we are

For the purposes of applicable data protection law, the controller of personal data described in this policy is Spiteri Catering.

2. Scope of this policy

This policy applies to personal data collected through this website and during related enquiries, quotations, account administration, sales, delivery, installation, after-sales service and technical-support communications.

It does not apply to third-party websites or services that have their own privacy notices.

3. Personal data we collect

Information you provide

• Identity and contact details, such as your name, business name, email address, telephone number and postal or installation address.
• Enquiry and support details, including the subject and content of your message, equipment information, service history and any files or photographs you choose to provide.
• Commercial information, such as quotation requests, products or services of interest, order details, delivery requirements, invoices and payment status.
• Account and correspondence information where an account or support record is created.
• Any other information you voluntarily provide to us.

Information collected automatically

• Technical data, such as IP address, browser type, device type, operating system, referring page and approximate location derived from network information.
• Usage data, such as pages viewed, links or buttons selected, visit dates and times, and website interactions.
• Cookie and consent preferences stored or read by the website.

Please do not send special-category or highly sensitive personal data unless we specifically request it and there is a clear need.

4. How and why we use personal data

Responding to enquiries and preparing quotations

Typical data: Contact, enquiry and project details.
Legal basis: Steps requested before entering a contract and our legitimate interest in answering business enquiries.

Supplying products, services and support

Typical data: Contact, order, location, equipment and service details.
Legal basis: Performance of a contract and steps requested before a contract.

Managing accounts, invoices and records

Typical data: Identity, commercial, transaction and correspondence data.
Legal basis: Contract, legal obligation and legitimate interests in administration and record-keeping.

Operating and improving the website

Typical data: Technical, usage and security data.
Legal basis: Legitimate interests in providing a secure and effective website.

Using non-essential cookies or similar technologies

Typical data: Cookie identifiers, preferences and usage data.
Legal basis: Your consent, where required.

Protecting our rights and handling disputes

Typical data: Relevant account, order, support and correspondence records.
Legal basis: Legitimate interests in establishing, exercising or defending legal claims.

Where we rely on legitimate interests, we consider the need for the processing and its impact on your rights. Where processing is based on consent, you may withdraw consent at any time without affecting earlier lawful processing.

5. Cookies and website analytics

The website may use cookies and similar technologies needed for core functions, security, form operation, preferences, performance measurement and understanding how visitors interact with pages and links.

Essential cookies may operate because they are necessary to provide the website or a service you request. Where required, optional analytics or similar technologies are used only after you give consent through the cookie controls.

You can use the website's cookie controls to accept, reject or change optional-cookie preferences. You can also manage cookies in your browser, although blocking essential cookies may affect website functionality.

6. When we share personal data

We may share personal data only as reasonably necessary with:

• Hosting, website, email, communications, IT-security, backup and technical service providers acting on our instructions.
• Professional advisers, insurers, auditors and finance or payment service providers where relevant.
• Manufacturers, suppliers, delivery partners, installers or service technicians where needed to fulfil a request, order, warranty or support case.
• Public authorities, regulators, courts or other parties where disclosure is required by law or necessary to protect legal rights.
• A purchaser, successor or adviser in connection with a genuine business reorganisation, subject to appropriate safeguards.

We do not sell personal data.

International transfers

If a service provider processes personal data outside the European Economic Area, we will use an available lawful transfer mechanism and appropriate safeguards, such as an adequacy decision or approved contractual protections, where required.

7. Retention and security

How long we keep data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including providing services, maintaining support and warranty records, meeting tax, accounting and other legal obligations, resolving disputes and enforcing agreements.

Retention periods vary according to the type of record, the relationship with you and applicable legal requirements. When data is no longer needed, we delete it, anonymise it or securely restrict it until deletion is possible.

How we protect data

We use reasonable technical and organisational measures intended to protect personal data against accidental or unlawful loss, misuse, alteration, disclosure or access. No internet or storage system is completely secure, so absolute security cannot be guaranteed.

8. Your data protection rights

Subject to applicable law and any relevant exceptions, you may have the right to:

• Request access to your personal data and information about its use.
• Ask us to correct inaccurate or incomplete personal data.
• Ask us to erase personal data in certain circumstances.
• Ask us to restrict processing in certain circumstances.
• Object to processing based on legitimate interests and object at any time to direct marketing.
• Receive certain personal data in a portable format.
• Withdraw consent where processing relies on consent.
• Complain to a supervisory authority.

To exercise a right, contact us using the details below. We may request information reasonably necessary to confirm your identity. You may also lodge a complaint with Malta's Information and Data Protection Commissioner at idpc.org.mt. We encourage you to contact us first so we can try to resolve the concern.

9. Children's privacy

This website is directed to businesses and adults seeking commercial catering equipment and related services. It is not intended for children, and we do not knowingly collect personal data from children through the website.

10. Third-party links

The website may link to third-party sites or services. We are not responsible for their privacy practices. Please read the privacy notice provided by the relevant third party.

11. Changes to this policy

We may update this policy to reflect changes in our services, website or legal obligations. The date at the top shows when it was last updated. Material changes may also be highlighted on the website where appropriate.

12. Contact us

For questions, requests or complaints about this policy or our use of personal data, contact Spiteri Catering: