Privacy Policy

1. Who we are

This policy explains how TRiBE Malta looks after your personal data when you use the TRiBE Malta website, order from us, book a table or sign up for an account. TRiBE Malta is the data controller for that information.

You can reach us about anything in this policy at joinus@tribemalta.com. Our full company details are at the bottom of this page.

2. Data we collect

We collect, use, store and transfer the following kinds of personal data:

• Identity data: first name, last name, username and an encrypted password
• Contact data: email address, telephone number, billing address and delivery address
• Transaction data: order history, purchase amounts, deposits and invoice information. Card details are handled by Stripe and never reach our servers
• Booking data: the date, time, party size and seating preference of any table you book, plus any notes you give us such as an allergy or an occasion
• Technical data: IP address, browser type, device information, time zone and operating system
• Usage data: how you move around the site — pages visited, time on page and session length — collected through Google Analytics, and only if you have accepted analytics cookies
• Marketing data: your newsletter subscription and your preferences about receiving marketing from us

If you tell us about a food allergy or intolerance so that we can serve you safely, that is health data. We use it only to prepare and serve your order, we share it only with the kitchen and service team who need it, and we delete it once your visit is complete.

3. Why we use it, and our legal basis

Data protection law lets us use personal data only where we have a lawful basis for it. Ours are:

• To take and fulfil your order or booking — including taking payment, handling a deposit and contacting you about it. Basis: performance of our contract with you.
• To run your account and provide customer support. Basis: performance of our contract with you.
• To prepare food safely around an allergy you have told us about. Basis: your explicit consent, given when you tell us.
• To send marketing emails and our newsletter. Basis: your consent, which you can withdraw at any time using the unsubscribe link in any message.
• To measure how the site is used so we can improve it. Basis: your consent, given through the cookie banner.
• To keep our records, prevent fraud and protect the business. Basis: our legitimate interests in running a secure and well-managed business.
• To meet our tax, accounting and food-safety obligations. Basis: compliance with a legal obligation.

4. Cookies and analytics

A cookie is a small file stored on your device. We use two kinds:

• Essential cookies keep you signed in, remember what is in your basket and record your cookie choice. The site cannot work without them, so they are set without asking — no consent is required for these.
• Analytics cookies are set by Google Analytics and tell us which pages people visit and how long they stay. We do not load Google Analytics, and it sets no cookies, unless you accept them.

5. Who we share it with

We do not sell your personal data. We share it only with the service providers we need to run the site:

• Stripe processes all card payments and deposits. Stripe receives your card details, billing information and transaction data directly, and is certified to PCI-DSS Level 1. We never see or store your full card number.
• Google Analytics measures site usage — only after you have accepted analytics cookies.
• Cloudinary hosts and optimises the images on the site, including any profile picture you upload.
• Our email provider sends transactional messages (order confirmations, booking updates, deposit links, password resets) and, with your consent, marketing.
• Professional advisers and authorities where the law requires it — for example our accountants, or a food-safety or tax authority making a lawful request.

6. How long we keep it

• Order, payment and deposit records: 10 years from the end of the financial year they fall in, because tax and accounting law in Malta requires it.
• Your account: for as long as it is open. If you close it, or ask us to delete it, we remove your profile within 30 days and keep only what the retention periods above oblige us to keep.
• Booking records: 24 months after the booking date, so we can handle questions and no-show disputes.
• Allergy information you give us for a visit: deleted once the visit is over.
• Marketing preferences: until you unsubscribe, plus a minimal record of the unsubscribe itself so we do not email you again by mistake.
• Analytics data: retained by Google for up to 14 months.

7. Keeping it secure

We use appropriate technical and organisational measures to stop your personal data being lost, misused, altered or accessed without authorisation. Traffic to and from this site is encrypted with TLS, passwords are stored hashed and never in readable form, and access to customer data is limited to the staff and suppliers who need it to do their job. If a breach happens that is likely to put your rights at risk, we will tell you and the Information and Data Protection Commissioner (IDPC) as the law requires.

8. Sending data outside the country

Some of our third-party service providers (such as Google Analytics, Stripe and Cloudinary) process personal data outside the European Economic Area. Where they do, we rely on the transfer mechanisms permitted by the EU GDPR — an adequacy decision from the European Commission, or the European Commission’s Standard Contractual Clauses together with any additional safeguards the transfer requires.

You can ask us for a copy of the safeguards that apply to a particular transfer by emailing joinus@tribemalta.com.

9. Your rights

Data protection law gives you the following rights over your personal data. They are free to use, and we will respond within one month.

• Access — get a copy of the data we hold about you
• Rectification — have inaccurate or incomplete data corrected
• Erasure — have your data deleted where we have no continuing reason to keep it
• Restriction — have us pause our use of your data while a question about it is resolved
• Objection — object to processing we carry out under legitimate interests, and to direct marketing at any time
• Portability — receive the data you gave us in a machine-readable form, or have it sent to another provider
• Withdraw consent — where we rely on your consent, take it back at any time. That does not affect anything we did before you withdrew it.

To use any of these rights, email joinus@tribemalta.com.

10. Children

This website is not intended for children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us their data, contact us and we will delete it.

11. Links to other sites

Our site links to third-party sites, plug-ins and applications — social media and delivery partners among them. Following those links may allow the third party to collect data about you. We do not control those sites and are not responsible for their privacy practices, so please read the privacy policy of any site you move on to.

12. Contact us

If you have a question about this policy, or want to exercise one of the rights above, get in touch:

13. Changes to this policy

We update this policy from time to time. The current version always appears on this page with the date it was last updated at the top. If we make a change that materially affects how we use your data, we will tell you directly — by email where we have your address.