Privacy

This is the customer-facing notice required by Articles 13 and 14 of the UK- and EU-wide General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), as applied in Malta by the Data Protection Act, Chapter 586 of the Laws of Malta.

Article 12(1) GDPR requires this to be written in "clear and plain language". That is a legal requirement, not a style preference, so this document is written the way it would be spoken. Where a legal source matters it is named in a footnote-style line rather than buried in the sentence.

Last reviewed: 18 October 2026.

Who We Are

Joseph Schembri, trading as Dickens.

Dickens is a sole trader, not a company. That means the person responsible for your data is an individual, Joseph Schembri, and he is who you would exercise your rights against, or complain about. We say this plainly because a privacy policy that names a shop sign as the controller names nobody in law.

We are the controller of the personal data described below. That means we decide what is collected and why, and we are the ones answerable for it (GDPR Art 4(7)).

Who to contact about your data: Andrew Schembri. Write to info@dickens.com.mt and mark it for his attention, or write to the address above.

We have not appointed a Data Protection Officer, and we are not required to. A DPO is mandatory only where an organisation is a public authority, monitors people systematically on a large scale, or handles sensitive categories of data on a large scale (GDPR Art 37(1)). None applies to us: we are one shop in Malta, the only visitor measurement we do is Google Analytics (and, through it, counting which of our Google ads led to an order) and only for people who agree to it, and we hold no health, biometric or similar data. Malta has not added any further requirement of its own.

The Short Version

• You can browse this shop, search it, and fill a basket without giving us anything. No account, no cookie, no record with your name on it.
• We ask for your details when you open an account and buy something, because we cannot deliver goods to a person we cannot identify or contact. Every order is placed from an account.
• We do not track you across the internet. There is no remarketing, no personalised advertising, no social media pixel or button, no embedded video and no chat widget on this site.
• We use Google Analytics, and only if you agree to it. You are asked first, in a bar at the foot of the page with three equally sized buttons: "Yes to both" (analytics, and measuring which of our Google ads led to an order), "Analytics only", and "No thanks". Nothing is loaded and nothing is stored until you answer, and refusing changes nothing about using the shop. If you have never seen that bar, analytics is not switched on. See "Google Analytics" below and our cookie policy.
• We never see your card number. It goes straight from your browser to our card payment provider.
• We do not sell your data to anybody, ever.

Your Basket Is Not on Our Computers

This is unusual enough to say plainly at the top.

When you add something to your basket, it is saved in your own browser, in a storage area called localStorage, under the name dickens.cart. It holds only product numbers and quantities: no prices, no name, no identifier for you.

It never reaches our servers until the moment you press to pay, and it is not tied to any record we keep. We deliberately built it this way so that we do not end up holding an identifier for every person who ever put something in a basket. That is personal data we do not need, and data you do not hold cannot be lost, leaked or misused.

The same applies to the product comparison shortlist, stored in your browser under dickens.compare.

You can clear both at any time by clearing your browser's site data for this website. Nothing on our side changes when you do.

What We Collect, Why, and What Allows Us To

GDPR Art 6 requires a lawful basis for every use of personal data. Here is each one, in the order you would meet it.

1. When You Search the Shop

What we record: the words you searched for, and whether they found anything. We keep a running count per search term, in total and for each week: for example "drone battery: searched 41 times, found nothing 3 times", and "5 of those in the week of 12 October". We do not record who searched, from what device, from what address, in what order, or at what time beyond the week. There is no identifier of any kind in that table, and adding one later would require a change to the database structure rather than a line of code.

We automatically discard search text that contains an @ sign, or a run of 15 or more digits, because those are the shapes of an email address and a card number typed into the wrong box.

Why: to find out what customers want that we do not stock, or that we have named in a way nobody recognises.

Lawful basis: legitimate interests, GDPR Art 6(1)(f), running and improving our own shop. In our assessment this holds no personal data at all; the count is kept on this basis because "almost certainly not personal data" is an honest description and "definitely outside the law" is not.

One thing we should be straight about. Your search words also appear in the web address (/catalog?q=…). Like every website, our hosting provider records web addresses in its server logs alongside the internet address of the visitor. That combination is personal data, it sits with our hosting provider rather than in our shop database, and no amount of care in our own design changes it. It is covered under "Server logs" below.

2. When You Open an Account

What we collect: your email address. There is no password: you sign in with a link we email you, so the address itself is the credential and using the link is what confirms it is yours.

Sign-in is handled by the provider that runs our database and our sign-in system. Each link works once and expires shortly.

Why: so you can sign in and see your own orders, addresses, points and repairs.

Lawful basis: performance of a contract with you, GDPR Art 6(1)(b): the account is a service you asked for.

3. When You Buy Something

You need an account to place an order (section 2). The order uses your account's email address, which we have already confirmed is yours, so an order can never be placed in someone else's name.

What we collect, for every order:

• your name
• your email address
• your telephone number, if you give one
• your delivery address, if you chose delivery
• what you bought, how many, and the price you were charged
• whether you chose collection or delivery
• how you chose to pay
• whether we promised you same-day delivery
• the order's history: when it was placed, confirmed, made ready, shipped, collected, cancelled or refunded, and which member of staff changed it

Names and prices are copied onto the order, not looked up later. If you change your address next month, that does not rewrite where a past order was sent. If we rename a product next month, that does not change what your receipt says you bought. This is deliberate, and it is also why order records cannot simply be updated when your details change.

Why: to take the order, take payment, deliver the goods, answer you if something goes wrong, and keep the accounting record the law requires. When you buy a DJI drone, camera, gimbal, microphone or power station, the same details are used to send you one email when it is handed over: the manufacturer's setup video, the app, and, for a drone, how to insure and register it. It is part of the order, not marketing, and carries no offers.

Lawful basis: performance of a contract, GDPR Art 6(1)(b), for taking and fulfilling the order. Legal obligation, GDPR Art 6(1)(c), for keeping the record afterwards; see "How long we keep things".

4. When You Pay

By card, or by Revolut Pay. We use a regulated card payment provider. The card form on our checkout page is the provider's own, loaded directly from it. Your card number, expiry date and security code go from your browser to the provider and never pass through our systems. What comes back to us is a payment reference, and whether it worked.

We do send the provider your email address, so that it can send you its own payment receipt, along with the amount, the currency, whether the order is collection or delivery, and how many lines are on it. We do not send it your name, address or what you bought.

By paying in store when you collect. No payment data is collected online. You pay at the counter. (Cash on delivery is no longer offered; for orders placed with it before 23 September 2026 no payment data was collected online either.)

By Revolut transfer. You send the money from your own Revolut app to our number. What we see is what Revolut shows us: the name on your Revolut account, the amount and the reference you typed. A member of staff records the amount received against your order. We do not see your Revolut balance or anything else on your account.

By cryptocurrency (Bitcoin, USDC or EURC). We show you an address to send coins to. When a member of staff confirms the payment arrived, they record the transaction reference against your order. A public blockchain transaction reference is permanently public by design and is not something we can erase.

Lawful basis: performance of a contract, GDPR Art 6(1)(b).

The payment provider's own role. Our card payment provider processes your payment on our instructions, but it also uses payment data for its own legal duties: fraud prevention, anti-money laundering, and payment services regulation. For those purposes it is a controller in its own right and not simply working for us, and its own privacy notice applies. Ask us and we will tell you who it is and where to read that notice.

5. Your Saved Delivery Addresses

What we collect: an optional label ("Home", "Office"), the address lines, locality, post code, country, and, if you place a pin on the map, the map coordinates of the front door.

Why the map pin. Maltese addresses are frequently unnumbered or ambiguous, and a delivery driver holding a pin finds the door where a driver holding a street name may not. We store the pin to about one metre, which identifies a building rather than a room.

We know a home coordinate is more sensitive than a street name. We store it because we judged it genuinely necessary to deliver to Maltese addresses reliably (GDPR Art 5(1)(c), data minimisation). You do not have to place a pin, and you can delete a saved address at any time from your account.

Lawful basis: performance of a contract, GDPR Art 6(1)(b).

6. Your Birthday

What we collect: the day and month only. Never the year.

Our database has no column for a birth year. That is a deliberate design choice, not an omission: a birthday reward needs to know when, never how old.

Why: to send you something on your birthday, if you have asked us to.

Lawful basis: consent, GDPR Art 6(1)(a). It is optional and you can remove it at any time.

7. Marketing Preferences

What we collect: for each of email, SMS and post: whether you said yes or no, when, and how you told us (for example, a tick box in your account settings, or verbally at the counter).

We keep the whole history, not just your current answer. Every change is a new record and nothing is overwritten. This is because GDPR Art 7(1) requires us to be able to demonstrate that you consented, and a simple yes/no box cannot show when or how.

If you have ever told the shop not to contact you (at the counter, by phone, in person) that instruction is held on our till system and it overrides anything ticked on the website. It is not possible to undo an opt-out by ticking a box online. That is intentional.

Lawful basis: consent, GDPR Art 6(1)(a), and Art 7. You can withdraw it at any time, and withdrawing is as easy as giving it.

8. Your Loyalty Points

What we collect: every points movement: how many, why (a sale, a birthday, an adjustment, a redemption, an expiry), which sale earned them, and when.

It is an append-only ledger: nothing is ever edited or deleted, and your balance is worked out by adding the entries up. A points balance is money we owe you, so "how did it get to this number" must always have an answer.

Why: to run the loyalty scheme and to be able to show you, or an auditor, how a balance was reached.

Lawful basis: performance of a contract, GDPR Art 6(1)(b), for the scheme itself; legal obligation, GDPR Art 6(1)(c), for keeping the financial record.

This affects erasure. See "Deleting your data" below.

9. What We Already Hold Because You Have Shopped with Us in the Shop

Dickens has used the same till and stock system for years. If you have bought from us over the counter, or brought something in for repair, our till system already holds a record of it.

Our website reads a copy of that record so that we can show you your own history when you sign in. Specifically:

• your name, and any company name or VAT number recorded against you
• your email addresses, telephone numbers and addresses as recorded at the till
• your "do not contact" flags
• your past purchases and what was on them
• the serial numbers of serial-tracked items you own: drones, cameras and the like
• your repair history: what came in, when, what you said was wrong with it, its status, when it is expected back, and whether it was under warranty

We show you the fault description you gave us. We never show you, or store on the website, staff internal notes.

Copying, not sharing. This is us moving our own customers' records from one of our own systems into another, for a closely related purpose. It is not a disclosure to anybody else.

Why: so that when you sign in you can see the things you own, what you have bought, and what is in for repair, without ringing us up.

Lawful basis: legitimate interests, GDPR Art 6(1)(f). Our interest is in serving customers well and cutting down phone calls; the data is data you gave us, used only to show you your own record, and shown only to you. We have written down the balancing test; see the internal record of processing.

10. Matching Your Web Account to Your Shop Record

When you register, we look for a till customer with exactly the same email address.

We only link automatically when exactly one customer matches. If your email matches several (a shared family address, a business address, an address a member of staff typed in) we do not guess. The account stays web-only and the case goes to a queue for a member of staff to decide. We store the email address and the list of possible matches until it is resolved.

We built it this way because getting it wrong would show one person another person's shopping. On our own records, 967 email addresses belong to more than one till customer, so this is not a theoretical risk.

Lawful basis: legitimate interests, GDPR Art 6(1)(f), joining up your own records accurately, with a deliberate bias towards showing you nothing rather than showing you somebody else's data.

11. Server Logs

Our hosting provider, like every hosting provider, records each request to the website: the internet (IP) address it came from, the page or web address asked for, the time, and the browser's description of itself. This is standard, it is needed to run and secure a website, and it happens before any of our own code runs.

Lawful basis: legitimate interests, GDPR Art 6(1)(f), keeping the site working and secure.

We keep server logs for 90 days. We do not name our hosting provider on this page; that is a deliberate choice about a technical detail, not a gap in what you are entitled to know about your data. If you want to know who hosts the site, ask us and we will tell you.

12. Google Analytics: Only If You Agree to It

This one is last in the list but it is the first thing you would meet, so it is worth being unusually plain about.

We ask before anything happens. If Google Analytics is switched on for this site, a bar appears at the foot of the page with three buttons, all the same size: "Yes to both", "Analytics only" and "No thanks". Until you press one of them, Google's script is not on the page. It is not loaded and disabled; it is not there, and your browser does not contact Google at all. If you have never seen that bar, analytics is not switched on and none of what follows has happened to you.

What we collect if you agree. For each page you look at: the address of that page, the page title, the site you arrived from, your language, your screen size and rough device type, and an approximate location. Google stores two cookies in your browser, _ga and _ga_ followed by our Analytics measurement ID, which tell one browser apart from another and keep track of a single visit. Both last two years.

The page address includes anything in it. If you use the search box, your search words are part of the web address, so they go to Google too. We say this because we are otherwise careful about search words (see section 1) and the difference is worth knowing about before you decide.

Your internet (IP) address. Google has to receive it in order to answer the request at all. Google states that for visitors in the EU, the UK and Switzerland it uses that address only to derive a rough location and then discards it without logging or storing it. That is Google's statement about Google's own systems; we are relying on it and we cannot verify it ourselves.

When you place an order. The order confirmation page tells Google Analytics that a sale happened: its value, the currency, and the products (name, price, quantity). Never your name, email, address or account, and not the order number itself: Google receives a scrambled code made from it, so an order is counted once but cannot be traced back to you through it.

Measuring our Google ads: only if you pick "Yes to both". We pay for Google ads. With "Yes to both", Google Ads can count how many orders came from people who clicked one of them, so we know whether the money is well spent. Two of the three advertising permissions Google's tag recognises are switched on for that (storing an advertising identifier, and using your data to measure our ads), and Google stores one more cookie, _gcl_au, for 90 days. If you arrived from one of our ads, Google also receives the click identifier the ad put in the page address. The third permission, personalising adverts, stays off whatever you answer, and Google signals (Google's cross-device advertising feature) is switched off in our code. There is no remarketing: our ads are not shown to you because you visited us. "Analytics only" leaves all three advertising permissions off.

What we do not do. We do not combine analytics data with your account or your shop record. We do not build a profile of you and we do not sell any of it.

Why we ask, rather than just doing it. Maltese law requires your consent before anything is stored on, or read from, your device unless it is strictly necessary to give you the service you asked for: regulation 5(1) of the Processing of Personal Data (Electronic Communications Sector) Regulations, S.L. 586.01. Analytics is not strictly necessary to run a shop you asked to look at; it is useful to us. So it needs permission, and permission has to come first.

Lawful basis: your consent, GDPR Art 6(1)(a). Not legitimate interests. Even where a business could argue legitimate interests under the GDPR, S.L. 586.01 requires consent for the storage itself, and we are not going to run one part of this on permission and another part on our own say-so.

You can take it back at any time, from Cookie choices at the foot of every page. It is one click, the same as giving it (GDPR Art 7(3)). The page then reloads without Google's script and nothing further is sent. The two cookies already in your browser stay there until they expire or you clear them in your browser settings; we cannot reach into your browser to remove them, and we would rather say so than imply otherwise.

How long it is kept. Our Analytics account has been open since 16 September 2026. Google holds the detailed record of individual visits for the period set in that account (Google offers two months or fourteen), and summary reports for longer. We will state our setting here once we have confirmed it in the account.

Who sees it. Google. See "Who else sees your data" and "Sending data outside Europe" below.

13. When You Ask Us for Help, or Book a Consultation

From your account you can raise a support request or ask for a one-to-one consultation. We keep what you give us for that: your name, the phone number if you asked to be rung or messaged, how you prefer to be contacted, the short description and everything written in the conversation, by you and by us, and the order it concerns if you named one. Staff read it in order to answer you, and our replies appear in your account. We email the shop's own mailbox when you write, and email you when we have replied.

Lawful basis: performance of a contract, GDPR Art 6(1)(b), where the request concerns something you bought; otherwise our legitimate interest in answering people who ask us for help, Art 6(1)(f), which is what you would expect when you write to a shop.

Asking us to ring you. On some pages, such as the Marketing Department Bundles, you can leave your name, phone number, what you are interested in and a part of the day, and we ring you. You do not need an account. We use that only to make the call, email it to the owner of the shop, who rings you, and note on our staff screen that you were called. We do not add you to any marketing list. To keep the form free of automated spam we check, on our own server, that a hidden field was left empty and that the form was not sent faster than a person can fill it in; no outside service sees you. We delete the request 90 days after you made it.

Lawful basis: steps you asked us to take before a possible purchase, GDPR Art 6(1)(b).

Asking us for a quote. If you ask us for a price, by email, by phone or at the counter, for yourself or for the business you work for, we keep what we need to answer you: your name, your company if you gave one, how to reach you, what you asked for, and the written quote we send back (what we quoted, at what price, its number and date). You do not need an account. Staff keep track of the request in our internal work tools, and only the owner of the shop prepares and sends the quote. We do not add you to any marketing list. Two years after the quote's date we remove your name, your company and any notes about you; the numbered record of what was quoted, and at what price, stays, so a quote number is never used twice.

Lawful basis: steps you asked us to take before a possible purchase, GDPR Art 6(1)(b).

14. When We Move Your Data to a New Phone

If you ask us to move your contacts, photos, messages and apps from your old phone or tablet to a new one in the shop, we ask you to read and tick a short list of points and sign on our tablet before we start. We keep a record of that: your name, your email address, your telephone number if you gave it, the two devices (for example "Phone: iPhone 12"), which points you ticked and when, the name you typed, your signature as a picture, who on our staff did the job, the date and time, and, if we match it to your receipt, the till sale. If you give them to us, we also note a number to call you on when your phone is ready, the email address of your Google or Apple account (never its password), a short note about the job, and which apps you want moved, so we can print them on a details sheet for you to keep. We do not keep the printed sheet: it is yours. We email you a copy straight away, or print one for you if you have no email address. That email is about your transfer only; it is not marketing.

What we do not keep. We never write down or keep your passcode, pattern or password: you type it into your phone yourself, and if you want to note it on your details sheet, you write it there yourself. Staff do not look through, copy or keep your photos, messages or other content, and we use the phone makers' own tools to move it from one phone to the other, so your content is not stored on our computers. We do not record your phone's serial number or IMEI, or your IP address.

Lawful basis: doing the transfer you asked for is performance of a contract, GDPR Art 6(1)(b). Keeping the signed record afterwards is our legitimate interest in being able to show what was agreed if a question comes up later about the transfer, Art 6(1)(f).

We keep the record for two years from the day you signed it. Then your name, email address, telephone number, typed name and signature, and those notes, are removed automatically; what is left is a numbered record that a transfer was done, with no one named.

Cookies and Browser Storage

We set very little, and we would like to keep it that way.

If you never sign in, never reach the checkout, and do not agree to analytics, you receive no cookie from this website at all.

There is no remarketing, no social media pixel or button, no embedded video and no chat widget on this site.

The typeface is served from our own server. The site is set in a Google typeface, but the font file is copied onto our site when it is built, so your browser downloads it from us and never asks Google for it. Most shops load fonts straight from Google, which hands your internet address to Google on every page. We do not.

The rule in Malta is regulation 5(1) of the Processing of Personal Data (Electronic Communications Sector) Regulations, S.L. 586.01: storing information on your device, or reading information already there, needs your consent. The exemption we rely on for the first five rows is regulation 5(2), which disapplies that where the storage or access is "strictly necessary in order for the service provider to provide an information society service explicitly requested by the subscriber or user". Keeping you signed in, remembering your basket, remembering your cookie answer, and taking a payment you asked to make all fall inside it. Analytics does not, which is why it is the one row where we ask.

S.L. 586.01 was made by L.N. 16 of 2003 and last amended by L.N. 429 of 2013; regulation 5 was substituted by L.N. 239 of 2011. Verified in force against the consolidated text; the instrument carries no repeal note.

This position is easy to lose. We have an internal rule that the first advertising pixel, embedded video, externally hosted font, map tile provider or chat widget added to this site cannot ship until the consent banner covers it, with its own separate question. See the separate cookie policy.

Who Else Sees Your Data

We describe the companies that work for us by what they do rather than by name. That is a deliberate choice about a technical detail, not something that changes what they are allowed to do with your data or what you are entitled to know; ask us directly if you want to know who any of them are. Google is named because Google Analytics only runs if you agree to it, and you should know whose service you are agreeing to.

Everybody in that list except Google, our card payment provider and our till system provider acts on our instructions and nothing else. Google Analytics data is handled by Google under its own Analytics terms, and Google uses some of it for its own purposes as well as ours, which is one more reason we ask you before any of it starts, rather than assuming. For our database, card payment and till system providers alike, we make it our job to ensure your data is properly cleared with each of them when you ask us to delete it; see "Deleting your data" below.

We do not sell your data. We do not share it for anybody else's marketing. We do not personalise advertising and we do not profile you. Agreeing to analytics does not change any of that. "Yes to both" lets Google count which of our ads led to an order, nothing more: the permission to personalise adverts stays "denied" on this site whatever you answer.

We will disclose data where we are legally required to, for example to the tax authorities, or to the police under a lawful order.

One thing that is worth stating because people assume otherwise. We use AI tools to help write product descriptions and specifications. Those tools are given product information and manufacturers' published pages. No customer data of any kind is sent to an AI provider.

Sending Data Outside Europe

Your data is held on servers in the European Union. Our database and sign-in system are hosted in an EU region.

Four of the companies above are or may be based outside the EU, and that has to be dealt with honestly:

Google, for analytics. If you agree to analytics, what is collected reaches Google in the United States. The legal route for that is an adequacy decision: on 10 July 2023 the European Commission decided that the United States gives an adequate level of protection to personal data sent to companies that have certified to the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795). Google LLC has certified, and Google states that it relies on that Framework for transfers of EEA personal data in its advertising and analytics products, falling back on the European Commission's Standard Contractual Clauses where the Framework does not apply. A transfer covered by an adequacy decision does not need any further permission from you and does not need extra safeguards (GDPR Art 45).

Two honest caveats. This is not the old Privacy Shield, which the Court of Justice struck down in 2020; the Framework is a different arrangement built on new US commitments, and the EU General Court dismissed the first challenge to it. But an adequacy decision can be annulled or withdrawn, as its predecessors were. If that happened, this would revert to Standard Contractual Clauses and this page would say so. And none of this arises at all if you say no to analytics: nothing is sent anywhere.

Our database provider. The database and sign-in system are in an EU region. The provider is a United States company, so administrative access from outside the EU is possible.

Our card payment provider. Its European business is contracted through an EU entity, but it operates globally.

Our till system provider. It is not a European company, and our customer records have been held there for years, since long before this website existed. It is based in Canada, with a company in the Netherlands acting for merchants in the EEA and UK. A data processing agreement covering this is part of our agreement with it.

For these three, our commitment is the same: if you ask us to delete your data, we make sure it is properly cleared with all three as well as on our own systems, not just disconnected from your account here. We do not need to quote each company's contract terms back to you for that promise to hold.

Google is different, and we will not pretend otherwise. What Google Analytics holds is not filed under your name. It is not linked to your account, your orders or anything you told us, so there is no record of "you" for us to point at and delete. What you can do instead is refuse, or withdraw, from Cookie choices at the foot of any page: after that nothing more is sent. If you want us to try to have something specific removed from Analytics, ask, and we will do what Google's tools allow.

What the website sends to the till. When you order online, the order is sent to our till system as a sale so the shop does not sell the same item twice: the items, the quantities, the prices and the order reference. So that the sale is on your record at the till, and earns your loyalty points, it also carries your till customer number. If you already have a record at the till (found by your email address), the sale is added to it. If you do not, a till record is created for you with your name, email address, telephone number and address as you gave them at checkout. From then on that record belongs to the till, like any record made at the counter, and the website never changes it. This has been so since 3 September 2026.

How Long We Keep Things

Your Rights

Under GDPR Articles 15 to 22 you can ask us to:

• Show you what we hold about you, and give you a copy (Art 15)
• Correct anything that is wrong (Art 16)
• Delete it (Art 17), with the limits explained below
• Pause what we do with it while a dispute is sorted out (Art 18)
• Hand it over in a machine-readable file, or send it to another company (Art 20)
• Object to anything we do on the basis of legitimate interests (Art 21)
• Stop marketing to you: this one is absolute, we must stop, and there is nothing to weigh up (Art 21(2))
• Withdraw consent at any time, and it must be as easy as giving it (Art 7(3))

How to ask: email info@dickens.com.mt, or write to us at the address above.

We will answer within one month (GDPR Art 12(3)). If the request is genuinely complicated we may take up to two months longer, and if we do, we will tell you within the first month and say why.

It is free. We will only charge, or refuse, if a request is clearly unfounded or repetitive, and we will explain if that ever happens (Art 12(5)).

We may ask you to prove who you are before we hand over personal data. That is a protection for you, not an obstacle.

Deleting Your Data: What We Can and Cannot Do

We will delete what we can. Two things we cannot delete, and it is fairer to say so here than in a reply later:

1. Order and accounting records. The law requires us to keep them (see above), and GDPR Art 17(3)(b) recognises that. We will disconnect them from your account and your identity as far as the record still makes sense, but we cannot destroy them until the retention period ends.

1. The loyalty points ledger. It is an add-only financial record and our database is built so it cannot be broken. What we do instead is sever the link to you: remove your sign-in identity, remove your link to the till record, delete your saved addresses and your birthday, and leave the financial entries as an anonymous line in the books.

Everything else goes: your account, your addresses, your birthday, your marketing preferences, your matching-queue entry.

How to ask. You can delete your account at any time using the delete-account button in your account settings, or by emailing info@dickens.com.mt; both are treated the same way and reach the same person.

Your record at the till is separate. If you also want your customer record at the till dealt with, say so, and we will handle it as part of the same request. As explained above, our commitment covers our database, card payment and till system providers as well as our own systems.

Complaining

If you are unhappy with how we have handled your data, please tell us first; most things are a misunderstanding and we would rather fix it.

You also have the right to complain directly to Malta's data protection authority, and you do not need our permission or to come to us first (GDPR Art 77):

Office of the Information and Data Protection Commissioner (IDPC) Floor 2, Airways House, Triq il-Kbira (High Street), Tas-Sliema, SLM 1549, Malta Telephone: +356 2328 7100 (telephone enquiries are taken every working day between 10am and 1pm) Email: idpc.info@idpc.org.mt Complaints: idpc.org.mt/file-a-complaint/

Your right to complain comes from GDPR Art 77, read with the Data Protection Act (Cap. 586) arts 11 and 31.

Automated Decisions

We do not make any decision about you by computer alone. Nothing on this site profiles you, scores you, or decides anything about you automatically in a way that has a legal or similarly significant effect (GDPR Art 22).

Two things that might look like it but are not:

• The account-matching described above deliberately refuses to decide when there is any doubt, and sends the case to a person.
• Whether an order can be paid cash on delivery is decided by its value against a fixed limit. That is arithmetic on the order, not a judgement about you.

Children

This shop is for adults. We do not knowingly sell to, or open accounts for, anyone under 16. If you believe we hold data about a child, tell us and we will delete it.

Changes to This Policy

If we change how we use your data in a way that matters, we will update this page and change the date at the top. If the change is significant and you have an account, we will tell you directly.