Effective date: 6 November 2026
Version: 1.0
1. Who we are
Malta System LTD, trading as Maltazon, is the controller of the personal data described in this notice.
- Company registration number: C86361
- VAT number: MT25228615
- Registered office: Malta System LTD, GEL, Flat 7, Triq L-Ghadam, Mriehel, Birkirkara, Malta
- Operational, collection and returns address: Malta System LTD – Mriehel Business HUB, MBH – Level 3, Triq L-Arkata L-Baxxa, Central Business District, Zone 3, Mriehel, Birkirkara CBD 3110, Malta
- Email: info@maltazon.com
- Telephone: +356 20979742
- Website: https://maltazon.com
References to “Maltazon”, “we”, “us” or “our” mean Malta System LTD.
2. Scope
This notice explains how we process personal data when you visit maltazon.com, create or use an account, use guest checkout, place or attempt to place an order, use a shopping cart, contact us, subscribe to marketing communications, interact with our emails, request a return or refund, or otherwise interact with Maltazon.
3. Personal data we process
Depending on the interaction, we may process:
- account and identity data, such as a customer identifier, name and account details;
- contact data, such as email address, telephone number and delivery or billing address;
- order and transaction data, including products, quantities, prices, discounts, taxes, delivery charges, payment status, order status, returns and refunds;
- shopping-cart data, including product and variant identifiers, quantities, prices and last activity;
- marketing preference evidence, including the version and source of a request, confirmation, refusal or withdrawal;
- technical and security data, including IP address, browser information, device information, cookie identifiers, security logs and timestamps;
- customer-service communications and complaints; and
- email delivery information, including pending, subscribed, unsubscribed and non-deliverable status.
We do not need or intend to send special-category data, full payment-card numbers, passwords or identity-document numbers to Mailchimp.
4. Sources
We obtain data directly from you; automatically from website use subject to your cookie choices; from payment, delivery and other providers involved in a transaction; from Mailchimp when it reports confirmation, unsubscribe, bounce or cleaned status; and from lawful security or anti-fraud sources where necessary.
Where Article 14 GDPR applies because data was not obtained directly from you, we will provide the required information within the applicable period unless a lawful exception applies.
5. Purposes and legal bases
Accounts, checkout and orders
We process account, contact, cart and order data to take requested pre-contractual steps, enter into and perform a sales contract, collect payment, deliver products, provide customer support, process returns and refunds and administer warranties. The legal basis is Article 6(1)(b) GDPR.
Legal obligations
We retain and disclose information where necessary to comply with accounting, tax, consumer-protection, product-safety and other legal obligations. The legal basis is Article 6(1)(c) GDPR.
Security and fraud prevention
We process appropriate account, technical, transaction and communication data to protect customers, secure our systems, investigate misuse and establish, exercise or defend legal claims. The legal basis is Article 6(1)(f) GDPR. Our interests are the security, integrity and lawful operation of our services.
Ecommerce measurement and service improvement
Where enabled, we may use minimised customer identifiers, email addresses and ecommerce activity to understand sales performance, maintain accurate order attribution, improve the store and measure our services. The legal basis is Article 6(1)(f) GDPR only after a documented assessment shows the processing is necessary and does not override your rights. Where consent is required because non-essential tracking or electronic communications are used, we rely on Article 6(1)(a) instead.
Marketing
We send promotional email only where you have given specific, informed and unambiguous consent, or where the limited existing-customer exception under Maltese electronic-communications law lawfully applies. Marketing consent is optional. Refusal or withdrawal does not affect your account or purchases.
Every marketing email identifies Maltazon and offers a free, simple unsubscribe method. We do not treat an order, account, login, cart or address update as marketing consent.
The legal basis is Article 6(1)(a) where we rely on consent. If the existing-customer exception is used, we rely on Article 6(1)(f) together with every applicable electronic-marketing condition.
Abandoned-cart reminders
We may retain an identifiable cart for a limited period. We send an abandoned-cart reminder only where we have a lawful basis for that electronic communication. For a guest or prospective customer, we normally require prior consent. For an existing customer, we use the existing-customer exception only where every legal condition is satisfied, including an opportunity to object when the address is collected and in every message. Creating a cart or starting checkout never makes a person a marketing subscriber.
Transactional communications
We may send strictly operational messages concerning an order, payment, delivery, refund, security matter or customer-service request where necessary to perform a contract or comply with law. Transactional messages are not used to disguise promotional marketing.
6. Mailchimp ecommerce processing
We use Mailchimp, provided by The Rocket Science Group LLC, an Intuit company, as an ecommerce and email service provider.
Subject to the privacy controls and legal bases in this notice, Mailchimp may process a deterministic ecommerce customer identifier, email address, ecommerce opt-in status, product and variant identifiers, cart lines, quantities, unit prices, currency and totals, a secure cart-recovery URL, order lines, taxes, discounts, delivery charges and order status, and subscription or deliverability status.
We apply data minimisation. Names, postal addresses, telephone numbers, dates of birth and full payment information are not required for the Maltazon ecommerce integration and will not be sent unless a separate documented necessity and legal basis is established.
A Mailchimp ecommerce customer is not automatically a marketing subscriber. A customer without marketing consent may only be represented as non-subscribed or transactional. An unsubscribed or cleaned status will not be overwritten by an order, cart, login or account update.
7. Cookies and similar technologies
Essential technologies are used where necessary to operate the website, maintain security, remember a cart and provide requested services. Analytics and marketing technologies are disabled by default unless you make an affirmative choice through our consent interface.
You may accept all optional technologies, reject them, or manage analytics and marketing separately. You may later change your choice through the website privacy-preferences control. Cookie consent is separate from newsletter or direct-marketing consent.
Details of individual cookies, their provider, purpose and duration are available through the cookie-preferences interface.
8. Recipients
Where necessary, data may be disclosed to payment providers, banks and payment networks, delivery and returns providers, hosting and cybersecurity providers, customer-support and communication providers, professional advisers, competent authorities, and Mailchimp/Intuit and its authorised sub-processors for the limited purposes described above.
Processors must follow documented instructions, protect the data and comply with applicable data-protection obligations. Some providers may act as independent controllers for limited activities governed by their own legal obligations, such as payment processing or fraud prevention.
9. International transfers
Mailchimp and authorised sub-processors may process personal data in the United States and other countries outside the EEA. Where the recipient participates in the EU-US Data Privacy Framework, transfers may rely on the European Commission adequacy decision while the decision and certification remain valid. Where adequacy does not apply, transfers will rely on safeguards such as the European Commission Standard Contractual Clauses and supplementary measures where necessary.
Mailchimp information is available at:
You may contact us for information about safeguards applicable to a transfer.
10. Retention
We retain data only as long as necessary for the relevant purpose.
- Account data is retained while the account is active and afterwards as needed to resolve transactions, comply with law and handle claims.
- Invoices, orders, payments, refunds and related records are retained for applicable Maltese accounting, tax, consumer-law and limitation periods.
- An unconverted cart transferred to Mailchimp is deleted no later than 30 days after its last activity and is removed after confirmed conversion to an order.
- Mailchimp ecommerce order data is normally retained for no longer than 365 days after completion or cancellation unless a shorter period is sufficient or a longer period is legally justified.
- Mailchimp ecommerce customer data is removed when no longer required for the approved ecommerce purpose.
- Consent and withdrawal evidence is retained as needed to demonstrate compliance and handle claims.
- Minimal suppression information may be retained to ensure marketing is not sent against a person’s choice.
- Cleaned status may be retained where necessary to prevent sending to a non-deliverable address.
- Security information is retained only as long as necessary to investigate incidents, protect systems and comply with law.
Deletion from an operational system may not immediately remove data from protected backups. Backup data remains isolated and is deleted or overwritten under the applicable backup schedule.
11. Marketing choices and objections
You may withdraw marketing consent or unsubscribe at any time without affecting earlier lawful processing. Use the link in a marketing email or contact info@maltazon.com.
Under Article 21 GDPR, you may object at any time to direct-marketing processing, including related profiling. If you object, we will stop it.
Unsubscribe does not require erasure of transaction records retained for contractual, legal or claims purposes. Ecommerce history and marketing permission are separate. An unsubscribed or cleaned contact is not automatically resubscribed. Resubscription requires a new explicit action and, where used, double-opt-in confirmation.
12. Your rights
Subject to applicable conditions and exceptions, you may request access, correction, deletion, restriction, portability, withdrawal of consent, objection to legitimate-interest processing, objection to direct marketing, and information about international-transfer safeguards.
Contact info@maltazon.com. We may verify identity before completing a request.
You may complain to:
Office of the Information and Data Protection Commissioner
Floor 2, Airways House
Triq Il-Kbira
Tas-Sliema SLM 1549, Malta
Telephone: +356 2328 7100
Website: https://idpc.org.mt/
13. Automated processing and recommendations
Where legal and privacy requirements have been met, order and product-interaction data may be used for segments or product recommendations. We do not use the Mailchimp ecommerce integration to make solely automated decisions producing legal or similarly significant effects about you.
14. Security
We use technical and organisational measures designed to protect data against unauthorised access, loss, alteration, disclosure or destruction. These include access controls, restricted administration, secure transport, minimised logs, queue controls and procedures for incidents and deletion requests. No internet service can be guaranteed completely secure.
15. Children
Our services are not intended to collect data from children who cannot lawfully enter into a purchase or provide the relevant consent. Where parental or guardian authorisation is legally required, the service must not be used without it.
16. Changes
We may update this notice to reflect changes in services, providers or law. The effective date and version appear at the beginning. Material changes will not expand an existing consent beyond the purposes originally agreed.
17. Contact
Malta System LTD, trading as Maltazon
Email: info@maltazon.com
Telephone: +356 20979742
