Cookies
Joseph Schembri, trading as Dickens. Dickens is a sole trader, not a company. Bisazza Street, Sliema, SLM 1640, Malta. VAT number MT10611512. Email info@dickens.com.mt. Telephone +356 2133 3562.
The short version
We use one analytics tool, Google Analytics, and only if you say yes. Nothing to do with Google is loaded, and no analytics cookie is stored, until you have answered the banner. If you say no, or if you simply ignore it, nothing loads and nothing is stored. Saying no changes nothing about using the shop.
There is still no advertising on this site. No Facebook or Instagram pixel, no remarketing tag, nothing that follows you elsewhere. Advertising is planned for later this year; when it comes you will be asked about it separately, and this page will be updated before it goes anywhere near the site.
Everything else we store is there to make the shop work: your basket, your comparison list, your answer to the cookie question, your sign-in and your card payment. Those five are listed first, below.
How to tell, for yourself, whether analytics is running
If Google Analytics is switched on for this site, you are asked before it loads. A bar appears at the foot of the page with two buttons, the same size as each other: one to agree and one to refuse.
If you have never seen that bar, analytics is not switched on, and nothing in the "Google Analytics" section below has happened to you. It is written so that you can check rather than take our word for it.
What we store to make the shop work
| What | Where it is kept | What it holds | How long | Who can read it |
|---|---|---|---|---|
| Your basket | Your browser's local storage, under dickens.cart | The reference numbers of the items you added and how many of each. No prices, no name, no identifier. | Until you clear it, place an order, or clear your browser data | Only this site, in this browser. It is never sent to us until you go to checkout |
| Your comparison list | Your browser's local storage, under dickens.compare | Up to three product reference numbers | Until you clear it or clear your browser data | Only this site, in this browser |
| Your answer to the cookie question | Your browser's local storage, under dickens.consent | Whether you said yes or no to analytics, and the date and time you said it. No identifier, no name | Until you change your answer or clear your browser data | Only this site, in this browser |
| Your sign-in session | Cookies beginning sb- | The token that keeps you signed in to your account | Set when you sign in and refreshed while you use the site. Removed when you sign out | This site, and Supabase, who run our sign-in system |
| Payment security | Set by Stripe when you reach the payment step | Stripe's own fraud-prevention data | Set by Stripe. See their notice, linked below | Stripe |
We do not ask your permission for those five, and the law does not require us to; see "Why we ask about some things and not others" below.
If you never sign in, we set no cookies at all. The basket, the comparison list and your cookie answer are not cookies; they stay in your browser and are never sent with a page request.
If you never reach the payment step, Stripe never loads. Stripe's script is fetched only after you have filled in the checkout form and chosen to pay by card. Browsing the shop does not load it.
Google Analytics: only if you agree
What it is for. It tells us which pages and products people look at, how they found us, and where they gave up. We use that to fix the shop. It is not used to advertise to you and it is not shared with anyone for their marketing.
Nothing happens until you answer. The Google script is not on the page before you agree. It is not loaded and switched off, and it is not loaded and waiting: it is not there. If you refuse, or ignore the question, your browser never contacts Google at all.
If you agree, two cookies are stored in your browser:
| Cookie | What it does | How long it lasts |
|---|---|---|
_ga | Tells one browser apart from another, so that two visits from you are not counted as two different people | 2 years |
_ga_ followed by our Analytics measurement ID, for example _ga_ABCDE12345 | Keeps track of a single visit: when it started, and what happened during it | 2 years |
Both are first-party cookies: they are stored under this shop's own web address, not under a Google one. The names and the lifetimes are Google's own published figures, and we checked them against a real browser on this site.
What is sent to Google. For each page you look at: the address of that page, the page title, the site you came from if any, your language, your screen size, and a rough location. The address of the page includes anything in it, so if you use the search box, the words you searched for are part of the address and are sent.
Your internet (IP) address. Google has to receive it to answer the request at all; that is how the internet works. Google states that for visitors in the EU, the UK and Switzerland it uses that address only to work out a rough location and then discards it without logging or storing it. That is Google's statement about Google's own systems, and we are relying on it; it is not something we are able to check from our side.
We have not turned on any advertising feature. The three advertising permissions that Google's tag recognises (storing an advertising identifier, using your data for advertising, and personalising adverts) are all set to "denied" in our code, and agreeing to analytics does not change any of them. There is no advertising tag on the site to use them.
Changing your mind. There is a Cookie choices link at the foot of every page. It brings the same two buttons back. If you switch from yes to no, the page reloads without the Google script and nothing further is sent. The two cookies already stored stay in your browser until they expire or you clear them; see "Turning things off" below for how.
Product photographs
Our product photographs are served from Cloudinary, an image hosting service, so that pages load quickly. When your browser fetches a photograph, Cloudinary receives your IP address and browser type, in the same way any website that loads an image does. Cloudinary does not store anything on your device for us and we do not use it to identify or track you.
The lettering on this site
The site is set in a typeface called Inter, which was designed by Google. The font file comes from our server, not Google's. It is copied onto our own site when the site is built, so your browser downloads it from us in the same way it downloads a product photograph's page; it never asks Google for it, Google never learns you were here, and nothing is stored on your device.
We mention it because most shops load their fonts straight from Google, which does hand your internet address to Google on every single page. We do not do that, deliberately.
What we still do not do
- No advertising or remarketing tags. Nothing follows you to another site.
- No Facebook, Instagram or other social media pixels.
- No tag manager.
- No embedded videos, maps or chat widgets.
- We do not sell your browsing data and we do not share it for anyone else's marketing.
Turning things off
You can clear or block any of this from your browser's settings, usually under "Privacy", "Site data" or "Cookies". That is also where you clear the two Google Analytics cookies if you have changed your mind and want them gone straight away rather than waiting for them to expire.
Be aware of the trade-off. If you block storage for this site:
- your basket will empty every time you move to another page;
- your comparison list will not be remembered;
- you will be asked the cookie question again on every page, because we cannot remember that you already answered it;
- you will not be able to stay signed in;
- you will not be able to pay by card.
Everything else keeps working. The site is written to carry on if the browser refuses to store anything; you will simply have to do more in one go.
Why we ask about some things and not others
Maltese law lets a site store things on your device without asking only where the storage is strictly necessary to provide the service you asked for (Processing of Personal Data (Electronic Communications Sector) Regulations, S.L. 586.01, regulation 5(2)). A basket, a comparison list, a sign-in session, payment security (and the record of your answer to this very question) are exactly that.
Analytics is not. It is not necessary to the service you asked for by opening this site; it exists for Dickens's own purposes. So it needs your consent, under regulation 5(1) of the same instrument, and that is why it does not load until you have given it. The same will be true of advertising when it arrives.
Your consent has to be freely given, specific, informed and given by a clear action, and you must be able to take it back as easily as you gave it (GDPR Article 4(11) and Article 7). That is why the two buttons are the same size, why refusing takes one click and not two, why the shop works identically either way, and why Cookie choices is at the foot of every page.
Other people's privacy notices
- Google, who provide Google Analytics: https://policies.google.com/privacy
- Stripe, who process our card payments: https://stripe.com/privacy
- Supabase, who run our sign-in system: https://supabase.com/privacy
- Cloudinary, who host our product photographs: https://cloudinary.com/privacy
Questions
Email info@dickens.com.mt. If you are not satisfied, you can complain to the Information and Data Protection Commissioner, Malta: https://idpc.org.mt.