1. Who We Are
Tulipán Negro ("we", "us", "our") operates this online store at tulipannegromalta.com. We are the data controller responsible for the personal data collected through this website. Our contact details:
- Triq Alfredo Cachia Zammit, Żejtun, Malta
- +356 99298974
- Harox492@gmail.com
This Privacy Policy is made in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Data Protection Act (Chapter 586 of the Laws of Malta).
2. What Data We Collect
When you place an order or contact us, we may collect:
- Identity data: full name
- Contact data: email address, phone number, delivery address
- Transaction data: order details (products, quantities, amounts), payment method type
- Communication data: messages sent through contact forms or email
- Technical data: IP address, browser type, device information (collected automatically)
- Cookie/usage data: how you interact with our website (see Section 8 below)
We do not collect or store your full payment card details. All card payments are processed securely by our PCI-compliant payment gateway partner.
3. How We Use Your Data
Your personal data is used to:
- Process and fulfil your order
- Send you order confirmation and delivery updates
- Respond to queries or complaints
- Comply with legal obligations (e.g., tax and accounting records)
- Prevent fraud and maintain website security
- Improve our website (where you have consented to analytics cookies)
We do not use your data for direct marketing without your explicit consent, and we never sell your data to third parties.
4. Legal Basis for Processing (GDPR)
We process your data under the following legal bases (GDPR Article 6):
- Contract performance (Art. 6(1)(b)): processing your order requires us to handle your data.
- Legal obligation (Art. 6(1)(c)): we retain certain records for tax and accounting compliance under Maltese law.
- Legitimate interests (Art. 6(1)(f)): preventing fraud, maintaining security, and basic website operation.
- Consent (Art. 6(1)(a)): for optional analytics and marketing cookies. You may withdraw consent at any time (see Section 8).
5. Third-Party Services
We use the following third-party services that may process your data on our behalf. We do not authorise these parties to use your data for their own purposes beyond what is necessary to provide their service:
- Payment processor - for processing card payments securely (we do not store or see card details).
- Database and hosting providers - to securely host our website and store order records.
- Email delivery provider - to send transactional emails (such as order confirmations).
- Web analytics provider - to collect anonymous website usage statistics (only with your consent).
6. Data Retention
We retain personal data only for as long as necessary:
- Order and transaction records: 7 years, to comply with Maltese and EU tax regulations.
- Communication data: up to 3 years after last contact.
- Analytics data: up to 26 months (standard analytics retention).
- Cookie consent records: stored locally in your browser; reset when you clear localStorage.
After the applicable retention period, data is securely deleted or anonymised.
7. Your Rights Under the GDPR
You have the following rights regarding your personal data:
- Access (Art. 15): request a copy of the data we hold about you.
- Rectification (Art. 16): request correction of inaccurate data.
- Erasure (Art. 17): request deletion of your data (where no legal obligation to retain exists).
- Restriction (Art. 18): request that we limit how we use your data in certain circumstances.
- Portability (Art. 20): receive your data in a structured, machine-readable format.
- Objection (Art. 21): object to processing based on legitimate interests or for direct marketing.
- Withdraw consent (Art. 7): where processing is based on consent (e.g., analytics cookies), you may withdraw at any time without affecting prior lawful processing.
To exercise any of these rights, contact us at Harox492@gmail.com. We will respond within 30 days.
You also have the right to lodge a complaint with Malta's data protection authority: the Information and Data Protection Commissioner (IDPC).
8. Cookies & Your Consent
Our website uses cookies in three categories:
- Strictly necessary cookies - always active; required for the shopping cart, checkout, and security. No consent is needed as these are essential for the service you request.
- Analytics & performance cookies - set only with your consent. Used to collect anonymous traffic data to help us improve the site.
- Marketing & social cookies - set only with your explicit consent. May be used by social platforms (e.g. Facebook, Instagram) for personalised content. Not currently active.
When you first visit, a cookie consent banner lets you choose your preferences. You can change your preferences at any time by clicking Cookie Settings or visiting our Cookie Policy.
Withdrawing cookie consent: click the "Cookie Settings" link in the footer of any page to re-open the consent panel. Selecting "Reject All" or toggling off optional categories immediately removes your prior consent. Note that this does not affect the lawfulness of any processing that took place before withdrawal.
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption of data in transit using SSL/TLS (HTTPS).
- Secure cloud infrastructure with access controls.
- Payment data handled exclusively by our secure payment gateway partner - we never see or store card details.
While we take all reasonable steps to protect your data, no method of transmission over the internet is 100% secure.
10. Changes to This Policy
We may update this policy from time to time. Any changes will be reflected with a revised "Last updated" date at the top of this page. Continued use of our website after changes are posted constitutes acceptance of the revised policy. We encourage you to review this page periodically.