Privacy Policy

Tronix Malta is the controller of the personal data described in this policy, under the EU General Data Protection Regulation (GDPR) and the Data Protection Act (Chapter 586 of the Laws of Malta).

• Legal name: [To be confirmed: registered business or company name]
• Address: [To be confirmed: registered address in Malta]
• Contact for privacy questions: privacy@tronixmalta.com

When you place an order

You enter these details on our secure payment page, provided by Stripe, and they are passed to us to fulfil your order:

• your name, email address and phone number;
• your delivery address and whether delivery is to Malta or Gozo;
• your order details: the items, quantities, prices, delivery charge and total, order number and date;
• payment information from Stripe: whether the payment succeeded, the amount and a payment reference. We do not receive or store your full card number or security code.

When you contact us

If you email us, we receive your email address and whatever you choose to include, such as your order number and details of a problem.

When you browse

Like any website, our hosting provider and infrastructure process technical data when you visit, such as your IP address, browser type, the pages requested and the time of the request, in server and security logs. We do not use this to profile you.

When you create an account or sign in

When you register for a Tronix Malta customer account or sign in using an identity provider such as Google:

• Account details: We collect your name, email address, and an internal authentication identifier so you can sign in securely, track your orders, manage saved delivery addresses, and view your warranty details.
• Third-party sign-in (Google OAuth): When you choose “Continue with Google”, we receive your basic profile information (your full name and verified email address) provided by Google. We do not receive or request your Google account password, Google Drive files, contacts, or any other sensitive Google account data.

Google API Services User Data Policy Compliance

Tronix Malta's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:

• We only use your Google user data to facilitate secure authentication and maintain your Tronix Malta customer account.
• We do not transfer your Google user data to third parties, except as strictly necessary to provide account authentication services via Supabase.
• We never sell or use Google user data for advertising, retargeting, or to train artificial intelligence (AI) / machine learning (ML) models.
• We do not permit human review of your Google user data unless you have given explicit consent or where required by law.

We do not run an unsolicited newsletter, and we do not use advertising or social-media tracking cookies on this website.

• To process, deliver and support your order, including handling returns, refunds and complaints. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
• To take payment and prevent fraud, through Stripe. Legal basis: performance of the contract and our legitimate interest in preventing fraud and payment misuse (Art. 6(1)(f)).
• To keep accounting and tax records, as required by Maltese law. Legal basis: compliance with a legal obligation (Art. 6(1)(c)).
• To keep the website secure and working, using technical logs. Legal basis: our legitimate interest in operating a secure service (Art. 6(1)(f)).
• To establish, exercise or defend legal claims. Legal basis: our legitimate interests (Art. 6(1)(f)).

We only share personal data where needed for the purposes above:

• Stripe, our payment provider, which processes your payment details and may carry out fraud checks. For some processing Stripe acts as an independent controller under its own privacy policy.
• Supabase, which hosts the database where our catalogue and order records are stored (hosted in the EU, Frankfurt region).
• Netlify, which hosts and serves this website and its server functions.
• Fulfilment partners: the suppliers, order-management services and delivery carriers that pack and deliver your items receive the details needed to do so, namely your name, delivery address and phone number and the items ordered. Some of these partners are located outside the EU (see section 5).
• Professional advisers, and public authorities where we are required by law.

We do not sell your personal data.

Some of the service providers and fulfilment partners above are based, or process data, outside the European Economic Area, including in the United States and, for items shipped directly from suppliers, in the country of dispatch (such as China).

Where personal data is transferred outside the EEA we rely on the safeguards permitted by the GDPR, such as an adequacy decision or the European Commission’s standard contractual clauses offered in our providers’ data processing terms. Where an item is dispatched directly by a supplier abroad, sharing your delivery details with that supplier is necessary to perform the contract you asked us to fulfil. You can contact us for more information. [To be confirmed: confirm that the data processing agreements (DPAs) with Stripe, Supabase, Netlify and the fulfilment platform are accepted]

• Order and payment records are kept for as long as required for accounting and tax purposes under Maltese law, and then deleted or anonymised. [To be confirmed: confirm the statutory retention period to apply]
• Customer service correspondence is kept for as long as needed to deal with your query and any related claim.
• Technical logs are kept for a limited period by our hosting providers in line with their standard log retention.
• Data stored in your browser (section 7) stays on your device until you clear it.

We use only what is needed for the site to work. We do not use analytics or advertising cookies.

• tronix_access (cookie): set only when an authorised person enters the access password while the site is in pre-launch. It is strictly necessary for that access and expires after 30 days.
• Browser local storage (key tronix-catalogue-v1): remembers your basket, saved items, comparison list and recently viewed products on your own device, so they are still there when you return. This data is not sent to us; you can remove it at any time by clearing your browser’s site data.

Product images are loaded from a third-party image hosting service, so your browser connects to that service to display them. When you pay, you use Stripe’s payment page on Stripe’s own website, where Stripe may use its own cookies, as described in Stripe’s privacy and cookie policies.

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased, where there is no longer a lawful reason for us to keep it;
• restrict how we use your data in certain circumstances;
• object to processing based on our legitimate interests;
• receive data you gave us in a portable format, where processing is based on our contract with you.

To exercise any of these rights, email privacy@tronixmalta.com. We may need to verify your identity, and we will respond within one month, which can be extended in limited cases as the law allows.

You also have the right to complain to the Information and Data Protection Commissioner (IDPC) in Malta, or to the supervisory authority where you live or work. We would appreciate the chance to address your concerns first.

We use reputable providers and protect data with access controls and encrypted connections (HTTPS). Payment details are handled by Stripe and are never stored on our systems. No method of transmission or storage is completely secure, but we work to protect your data and will act on any security incident as the law requires.

We will update this policy when the way we use personal data changes, and show the date of the latest version at the top of this page. See also our Terms & Conditions.