Privacy

This is the customer-facing notice required by Articles 13 and 14 of the UK- and EU-wide General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), as applied in Malta by the Data Protection Act, Chapter 586 of the Laws of Malta.

Article 12(1) GDPR requires this to be written in "clear and plain language". That is a legal requirement, not a style preference, so this document is written the way it would be spoken. Where a legal source matters it is named in a footnote-style line rather than buried in the sentence.

Last reviewed: 31 August 2026.

Who we are

Joseph Schembri, trading as Dickens.

Dickens is a sole trader, not a company. That means the person responsible for your data is an individual, Joseph Schembri, and he is who you would exercise your rights against, or complain about. We say this plainly because a privacy policy that names a shop sign as the controller names nobody in law.

We are the controller of the personal data described below. That means we decide what is collected and why, and we are the ones answerable for it (GDPR Art 4(7)).

Who to contact about your data: Andrew Schembri. Write to info@dickens.com.mt and mark it for his attention, or write to the address above.

We have not appointed a Data Protection Officer, and we are not required to. A DPO is mandatory only where an organisation is a public authority, monitors people systematically on a large scale, or handles sensitive categories of data on a large scale (GDPR Art 37(1)). None applies to us: we are one shop in Malta, the only visitor measurement we do is Google Analytics and only for people who agree to it, and we hold no health, biometric or similar data. Malta has not added any further requirement of its own.

The short version

• You can browse this shop, search it, and fill a basket without giving us anything. No account, no cookie, no record with your name on it.
• We ask for your details when you buy something or open an account, because we cannot deliver goods to a person we cannot identify or contact.
• We do not track you across the internet. There is no advertising pixel, no social media button, no embedded video and no chat widget on this site.
• We use Google Analytics, and only if you agree to it. You are asked first, in a bar at the foot of the page with two equally sized buttons. Nothing is loaded and nothing is stored until you answer, and refusing changes nothing about using the shop. If you have never seen that bar, analytics is not switched on. See "Google Analytics" below and our cookie policy.
• We never see your card number. It goes straight from your browser to Stripe.
• We do not sell your data to anybody, ever.

Your basket is not on our computers

This is unusual enough to say plainly at the top.

When you add something to your basket, it is saved in your own browser, in a storage area called localStorage, under the name dickens.cart. It holds only product numbers and quantities: no prices, no name, no identifier for you.

It never reaches our servers until the moment you press to pay, and it is not tied to any record we keep. We deliberately built it this way so that we do not end up holding an identifier for every person who ever put something in a basket. That is personal data we do not need, and data you do not hold cannot be lost, leaked or misused.

The same applies to the product comparison shortlist, stored in your browser under dickens.compare.

You can clear both at any time by clearing your browser's site data for this website. Nothing on our side changes when you do.

Source in the code: apps/web/lib/cart.ts, apps/web/app/compare-tray.tsx.

What we collect, why, and what allows us to

GDPR Art 6 requires a lawful basis for every use of personal data. Here is each one, in the order you would meet it.

1. When you search the shop

What we record: the words you searched for, and whether they found anything. We keep a running count per search term: for example "drone battery: searched 41 times, found nothing 3 times". We do not record who searched, from what device, from what address, or in what order. There is no identifier of any kind in that table, and adding one later would require a change to the database structure rather than a line of code.

We automatically discard search text that contains an @ sign, or a run of 15 or more digits, because those are the shapes of an email address and a card number typed into the wrong box.

Why: to find out what customers want that we do not stock, or that we have named in a way nobody recognises.

Lawful basis: legitimate interests, GDPR Art 6(1)(f), running and improving our own shop. In our assessment this holds no personal data at all; the count is kept on this basis because "almost certainly not personal data" is an honest description and "definitely outside the law" is not.

One thing we should be straight about. Your search words also appear in the web address (/catalog?q=…). Like every website, our hosting provider records web addresses in its server logs alongside the internet address of the visitor. That combination is personal data, it sits with our hosting provider rather than in our shop database, and no amount of care in our own design changes it. It is covered under "Server logs" below.

Source in the code: packages/db/migrations/0027_search_log.sql, apps/web/lib/search-log.ts, packages/core/src/search.ts.

2. When you open an account

What we collect: your email address and a password.

Your password is handled by Supabase, the service that runs our database and our sign-in system. It is stored as a one-way hash. We never see it and we cannot recover it: if you forget it, it is reset, not looked up.

We also send you a confirmation email to check the address is really yours.

Why: so you can sign in and see your own orders, addresses, points and repairs.

Lawful basis: performance of a contract with you, GDPR Art 6(1)(b): the account is a service you asked for.

Source: apps/web/app/sign-in/page.tsx, ADR-0012.

3. When you buy something

What we collect, for every order:

• your name
• your email address
• your telephone number, if you give one
• your delivery address, if you chose delivery
• what you bought, how many, and the price you were charged
• whether you chose collection or delivery
• how you chose to pay
• whether we promised you same-day delivery
• the order's history: when it was placed, confirmed, made ready, shipped, collected, cancelled or refunded, and which member of staff changed it

Names and prices are copied onto the order, not looked up later. If you change your address next month, that does not rewrite where a past order was sent. If we rename a product next month, that does not change what your receipt says you bought. This is deliberate, and it is also why order records cannot simply be updated when your details change.

Why: to take the order, take payment, deliver the goods, answer you if something goes wrong, and keep the accounting record the law requires.

Lawful basis: performance of a contract, GDPR Art 6(1)(b), for taking and fulfilling the order. Legal obligation, GDPR Art 6(1)(c), for keeping the record afterwards; see "How long we keep things".

Source: packages/db/migrations/0032_commerce_orders.sql, apps/web/lib/checkout.ts.

4. When you pay

By card, or by Revolut Pay. We use Stripe. The card form on our checkout page is Stripe's own, loaded directly from Stripe. Your card number, expiry date and security code go from your browser to Stripe and never pass through our systems. What comes back to us is a payment reference, and whether it worked.

We do send Stripe your email address, so that Stripe can send you its own payment receipt, along with the amount, the currency, whether the order is collection or delivery, and how many lines are on it. We do not send Stripe your name, address or what you bought.

By cash on delivery. No payment data is collected online. You pay the driver.

By cryptocurrency (Bitcoin, USDC or EURC). We show you an address to send coins to. When a member of staff confirms the payment arrived, they record the transaction reference against your order. A public blockchain transaction reference is permanently public by design and is not something we can erase.

Lawful basis: performance of a contract, GDPR Art 6(1)(b).

Stripe's own role. Stripe processes your payment on our instructions, but it also uses payment data for its own legal duties: fraud prevention, anti-money laundering, and payment services regulation. For those purposes Stripe is a controller in its own right and not simply working for us. Its privacy policy is at stripe.com/privacy.

Source: apps/web/lib/stripe.ts, apps/web/app/checkout/actions.ts, packages/db/migrations/0035_crypto_payments.sql.

5. Your saved delivery addresses

What we collect: an optional label ("Home", "Office"), the address lines, locality, post code, country, and, if you place a pin on the map, the map coordinates of the front door.

Why the map pin. Maltese addresses are frequently unnumbered or ambiguous, and a delivery driver holding a pin finds the door where a driver holding a street name may not. We store the pin to about one metre, which identifies a building rather than a room.

We know a home coordinate is more sensitive than a street name. We store it because we judged it genuinely necessary to deliver to Maltese addresses reliably (GDPR Art 5(1)(c), data minimisation). You do not have to place a pin, and you can delete a saved address at any time from your account.

Lawful basis: performance of a contract, GDPR Art 6(1)(b).

Source: packages/db/migrations/0002_pim_owned.sql, table pim.customer_address.

6. Your birthday

What we collect: the day and month only. Never the year.

Our database has no column for a birth year. That is a deliberate design choice, not an omission: a birthday reward needs to know when, never how old.

Why: to send you something on your birthday, if you have asked us to.

Lawful basis: consent, GDPR Art 6(1)(a). It is optional and you can remove it at any time.

7. Marketing preferences

What we collect: for each of email, SMS and post: whether you said yes or no, when, and how you told us (for example, a tick box in your account settings, or verbally at the counter).

We keep the whole history, not just your current answer. Every change is a new record and nothing is overwritten. This is because GDPR Art 7(1) requires us to be able to demonstrate that you consented, and a simple yes/no box cannot show when or how.

If you have ever told the shop not to contact you (at the counter, by phone, in person) that instruction is held on our till system and it overrides anything ticked on the website. It is not possible to undo an opt-out by ticking a box online. That is intentional.

Lawful basis: consent, GDPR Art 6(1)(a), and Art 7. You can withdraw it at any time, and withdrawing is as easy as giving it.

Source: apps/web/lib/consent.ts, packages/db/migrations/0002_pim_owned.sql table pim.consent_event, ADR-0005.

8. Your loyalty points

What we collect: every points movement: how many, why (a sale, a birthday, an adjustment, a redemption, an expiry), which sale earned them, and when.

It is an append-only ledger: nothing is ever edited or deleted, and your balance is worked out by adding the entries up. A points balance is money we owe you, so "how did it get to this number" must always have an answer.

Why: to run the loyalty scheme and to be able to show you, or an auditor, how a balance was reached.

Lawful basis: performance of a contract, GDPR Art 6(1)(b), for the scheme itself; legal obligation, GDPR Art 6(1)(c), for keeping the financial record.

This affects erasure. See "Deleting your data" below.

Source: packages/db/migrations/0002_pim_owned.sql table pim.loyalty_entry, ADR-0006.

9. What we already hold because you have shopped with us in the shop

Dickens has used a till and stock system called Lightspeed Retail for years. If you have bought from us over the counter, or brought something in for repair, Lightspeed already holds a record of it.

Our website reads a copy of that record so that we can show you your own history when you sign in. Specifically:

• your name, and any company name or VAT number recorded against you
• your email addresses, telephone numbers and addresses as recorded at the till
• your "do not contact" flags
• your past purchases and what was on them
• the serial numbers of serial-tracked items you own: drones, cameras and the like
• your repair history: what came in, when, what you said was wrong with it, its status, when it is expected back, and whether it was under warranty

We show you the fault description you gave us. We never show you, or store on the website, staff internal notes.

Copying, not sharing. This is us moving our own customers' records from one of our own systems into another, for a closely related purpose. It is not a disclosure to anybody else.

Why: so that when you sign in you can see the things you own, what you have bought, and what is in for repair, without ringing us up.

Lawful basis: legitimate interests, GDPR Art 6(1)(f). Our interest is in serving customers well and cutting down phone calls; the data is data you gave us, used only to show you your own record, and shown only to you. We have written down the balancing test; see the internal record of processing.

10. Matching your web account to your shop record

When you register, we look for a till customer with exactly the same email address.

We only link automatically when exactly one customer matches. If your email matches several (a shared family address, a business address, an address a member of staff typed in) we do not guess. The account stays web-only and the case goes to a queue for a member of staff to decide. We store the email address and the list of possible matches until it is resolved.

We built it this way because getting it wrong would show one person another person's shopping. On our own records, 967 email addresses belong to more than one till customer, so this is not a theoretical risk.

Lawful basis: legitimate interests, GDPR Art 6(1)(f), joining up your own records accurately, with a deliberate bias towards showing you nothing rather than showing you somebody else's data.

Source: apps/web/lib/customer.ts, packages/db/migrations/0020_customer_link_review.sql, ADR-0012.

11. Server logs

Our hosting provider, like every hosting provider, records each request to the website: the internet (IP) address it came from, the page or web address asked for, the time, and the browser's description of itself. This is standard, it is needed to run and secure a website, and it happens before any of our own code runs.

Lawful basis: legitimate interests, GDPR Art 6(1)(f), keeping the site working and secure.

We keep server logs for 90 days. We do not name our hosting provider on this page; that is a deliberate choice about a technical detail, not a gap in what you are entitled to know about your data. If you want to know who hosts the site, ask us and we will tell you.

12. Google Analytics: only if you agree to it

This one is last in the list but it is the first thing you would meet, so it is worth being unusually plain about.

We ask before anything happens. If Google Analytics is switched on for this site, a bar appears at the foot of the page with two buttons the same size as each other, one to agree, one to refuse. Until you press one of them, Google's script is not on the page. It is not loaded and disabled; it is not there, and your browser does not contact Google at all. If you have never seen that bar, analytics is not switched on and none of what follows has happened to you.

What we collect if you agree. For each page you look at: the address of that page, the page title, the site you arrived from, your language, your screen size and rough device type, and an approximate location. Google stores two cookies in your browser, _ga and _ga_ followed by our Analytics measurement ID, which tell one browser apart from another and keep track of a single visit. Both last two years.

The page address includes anything in it. If you use the search box, your search words are part of the web address, so they go to Google too. We say this because we are otherwise careful about search words (see section 1) and the difference is worth knowing about before you decide.

Your internet (IP) address. Google has to receive it in order to answer the request at all. Google states that for visitors in the EU, the UK and Switzerland it uses that address only to derive a rough location and then discards it without logging or storing it. That is Google's statement about Google's own systems; we are relying on it and we cannot verify it ourselves.

What we do not do. We do not use Google Analytics for advertising. The three advertising permissions Google's tag recognises (storing an advertising identifier, using your data for advertising, and personalising adverts) are set to "denied" in our code and stay denied whatever you answer. We do not combine analytics data with your account, your orders or your shop record. We do not build a profile of you and we do not sell any of it.

Why we ask, rather than just doing it. Maltese law requires your consent before anything is stored on, or read from, your device unless it is strictly necessary to give you the service you asked for: regulation 5(1) of the Processing of Personal Data (Electronic Communications Sector) Regulations, S.L. 586.01. Analytics is not strictly necessary to run a shop you asked to look at; it is useful to us. So it needs permission, and permission has to come first.

Lawful basis: your consent, GDPR Art 6(1)(a). Not legitimate interests. Even where a business could argue legitimate interests under the GDPR, S.L. 586.01 requires consent for the storage itself, and we are not going to run one part of this on permission and another part on our own say-so.

You can take it back at any time, from Cookie choices at the foot of every page. It is one click, the same as giving it (GDPR Art 7(3)). The page then reloads without Google's script and nothing further is sent. The two cookies already in your browser stay there until they expire or you clear them in your browser settings; we cannot reach into your browser to remove them, and we would rather say so than imply otherwise.

How long it is kept. Google holds the detailed record of individual visits for a period set in our Analytics account, and summary reports for longer. We have not opened that account yet, so we cannot state the figure honestly; when we do, it will be stated here.

Who sees it. Google. See "Who else sees your data" and "Sending data outside Europe" below.

Source in the code: apps/web/app/consent.tsx, apps/web/app/layout.tsx.

Cookies and browser storage

We set very little, and we would like to keep it that way.

If you never sign in, never reach the checkout, and do not agree to analytics, you receive no cookie from this website at all.

There is no advertising tag, no embedded video, no social media button and no chat widget on this site.

The typeface is served from our own server. The site is set in a Google typeface, but the font file is copied onto our site when it is built, so your browser downloads it from us and never asks Google for it. Most shops load fonts straight from Google, which hands your internet address to Google on every page. We do not.

The rule in Malta is regulation 5(1) of the Processing of Personal Data (Electronic Communications Sector) Regulations, S.L. 586.01: storing information on your device, or reading information already there, needs your consent. The exemption we rely on for the first five rows is regulation 5(2), which disapplies that where the storage or access is "strictly necessary in order for the service provider to provide an information society service explicitly requested by the subscriber or user". Keeping you signed in, remembering your basket, remembering your cookie answer, and taking a payment you asked to make all fall inside it. Analytics does not, which is why it is the one row where we ask.

S.L. 586.01 was made by L.N. 16 of 2003 and last amended by L.N. 429 of 2013; regulation 5 was substituted by L.N. 239 of 2011. Verified in force against the consolidated text; the instrument carries no repeal note.

This position is easy to lose. We have an internal rule that the first advertising pixel, embedded video, externally hosted font, map tile provider or chat widget added to this site cannot ship until the consent banner covers it, with its own separate question. See the separate cookie policy.

Who else sees your data

We do not name our email provider or our hosting provider on this page. That is a deliberate choice about a technical detail, not something that changes what they are allowed to do with your data or what you are entitled to know; ask us directly if you want to know who they are.

Everybody in that list except Google, Stripe and Lightspeed acts on our instructions and nothing else. Google Analytics data is handled by Google under its own Analytics terms, and Google uses some of it for its own purposes as well as ours, which is one more reason we ask you before any of it starts, rather than assuming. For Supabase, Stripe and Lightspeed alike, we make it our job to ensure your data is properly cleared with each of them when you ask us to delete it; see "Deleting your data" below.

We do not sell your data. We do not share it for anybody else's marketing. We do not run advertising and we do not profile you. Agreeing to analytics does not change any of that: the advertising permissions in Google's own tag are set to "denied" on this site and stay denied.

We will disclose data where we are legally required to, for example to the tax authorities, or to the police under a lawful order.

One thing that is worth stating because people assume otherwise. We use AI tools to help write product descriptions and specifications. Those tools are given product information and manufacturers' published pages. No customer data of any kind is sent to an AI provider.

Sending data outside Europe

Your data is held on servers in the European Union. Our database and sign-in system are hosted in an EU region.

Four of the companies above are or may be based outside the EU, and that has to be dealt with honestly:

Google, for analytics. If you agree to analytics, what is collected reaches Google in the United States. The legal route for that is an adequacy decision: on 10 July 2023 the European Commission decided that the United States gives an adequate level of protection to personal data sent to companies that have certified to the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795). Google LLC has certified, and Google states that it relies on that Framework for transfers of EEA personal data in its advertising and analytics products, falling back on the European Commission's Standard Contractual Clauses where the Framework does not apply. A transfer covered by an adequacy decision does not need any further permission from you and does not need extra safeguards (GDPR Art 45).

Two honest caveats. This is not the old Privacy Shield, which the Court of Justice struck down in 2020; the Framework is a different arrangement built on new US commitments, and the EU General Court dismissed the first challenge to it. But an adequacy decision can be annulled or withdrawn, as its predecessors were. If that happened, this would revert to Standard Contractual Clauses and this page would say so. And none of this arises at all if you say no to analytics: nothing is sent anywhere.

Supabase. The database and authentication are in an EU region. Supabase Inc. is a United States company, so administrative access from outside the EU is possible.

Stripe. Stripe's European business is contracted through an EU entity, but Stripe operates globally.

Lightspeed Retail. Lightspeed is not a European company, and our customer records have been held there for years, since long before this website existed. The company we contract with is Lightspeed Commerce Inc., of Montréal, Canada, with Lightspeed Netherlands B.V., of Amsterdam, acting for merchants in the EEA and UK. A data processing agreement covering this is incorporated into our agreement with Lightspeed and published at pdf.lightspeedhq.com/privacy/DPA_EN.pdf.

For Supabase, Stripe and Lightspeed, our commitment is the same: if you ask us to delete your data, we make sure it is properly cleared with all three as well as on our own systems, not just disconnected from your account here. We do not need to quote each company's contract terms back to you for that promise to hold.

Google is different, and we will not pretend otherwise. What Google Analytics holds is not filed under your name. It is not linked to your account, your orders or anything you told us, so there is no record of "you" for us to point at and delete. What you can do instead is refuse, or withdraw, from Cookie choices at the foot of any page: after that nothing more is sent. If you want us to try to have something specific removed from Analytics, ask, and we will do what Google's tools allow.

Worth knowing, because it cuts the risk down: this website reads from Lightspeed and almost never writes to it. The single automated message this system sends to Lightspeed is the sale itself, and that message contains the items, the quantities, the prices and an order reference, and no customer name, email address, telephone number or address at all. So the website is not adding to what Lightspeed holds about you.

Verified in the code: packages/sync/src/punch.ts, function saleBody.

How long we keep things

Your rights

Under GDPR Articles 15 to 22 you can ask us to:

• Show you what we hold about you, and give you a copy (Art 15)
• Correct anything that is wrong (Art 16)
• Delete it (Art 17), with the limits explained below
• Pause what we do with it while a dispute is sorted out (Art 18)
• Hand it over in a machine-readable file, or send it to another company (Art 20)
• Object to anything we do on the basis of legitimate interests (Art 21)
• Stop marketing to you: this one is absolute, we must stop, and there is nothing to weigh up (Art 21(2))
• Withdraw consent at any time, and it must be as easy as giving it (Art 7(3))

How to ask: email info@dickens.com.mt, or write to us at the address above.

We will answer within one month (GDPR Art 12(3)). If the request is genuinely complicated we may take up to two months longer, and if we do, we will tell you within the first month and say why.

It is free. We will only charge, or refuse, if a request is clearly unfounded or repetitive, and we will explain if that ever happens (Art 12(5)).

We may ask you to prove who you are before we hand over personal data. That is a protection for you, not an obstacle.

Deleting your data: what we can and cannot do

We will delete what we can. Two things we cannot delete, and it is fairer to say so here than in a reply later:

1. Order and accounting records. The law requires us to keep them (see above), and GDPR Art 17(3)(b) recognises that. We will disconnect them from your account and your identity as far as the record still makes sense, but we cannot destroy them until the retention period ends.

1. The loyalty points ledger. It is an add-only financial record and our database is built so it cannot be broken. What we do instead is sever the link to you: remove your sign-in identity, remove your link to the till record, delete your saved addresses and your birthday, and leave the financial entries as an anonymous line in the books.

Everything else goes: your account, your addresses, your birthday, your marketing preferences, your matching-queue entry.

How to ask. You can delete your account at any time using the delete-account button in your account settings, or by emailing info@dickens.com.mt; both are treated the same way and reach the same person.

Your record at the till is separate. If you also want your Lightspeed customer record dealt with, say so, and we will handle it as part of the same request. As explained above, our commitment covers Supabase and Stripe as well as Lightspeed and our own systems.

Complaining

If you are unhappy with how we have handled your data, please tell us first; most things are a misunderstanding and we would rather fix it.

You also have the right to complain directly to Malta's data protection authority, and you do not need our permission or to come to us first (GDPR Art 77):

Office of the Information and Data Protection Commissioner (IDPC) Floor 2, Airways House, Triq il-Kbira (High Street), Tas-Sliema, SLM 1549, Malta Telephone: +356 2328 7100 (telephone enquiries are taken every working day between 10am and 1pm) Email: idpc.info@idpc.org.mt Complaints: idpc.org.mt/file-a-complaint/

Your right to complain comes from GDPR Art 77, read with the Data Protection Act (Cap. 586) arts 11 and 31.

Automated decisions

We do not make any decision about you by computer alone. Nothing on this site profiles you, scores you, or decides anything about you automatically in a way that has a legal or similarly significant effect (GDPR Art 22).

Two things that might look like it but are not:

• The account-matching described above deliberately refuses to decide when there is any doubt, and sends the case to a person.
• Whether an order can be paid cash on delivery is decided by its value against a fixed limit. That is arithmetic on the order, not a judgement about you.

Children

This shop is for adults. We do not knowingly sell to, or open accounts for, anyone under 16. If you believe we hold data about a child, tell us and we will delete it.

Changes to this policy

If we change how we use your data in a way that matters, we will update this page and change the date at the top. If the change is significant and you have an account, we will tell you directly.