Privacy Policy

1. Who We Are

Vinyl Records Malta (“we”, “us”, or “our”) operates the website https://vinylmalta.com. We are committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (GDPR) (EU 2016/679) and applicable Maltese data protection law.

For any privacy-related enquiries, contact us at: hello@vinylmalta.com

2. Data We Collect

We collect the following categories of personal data:

• Email address — when you subscribe to our newsletter or place an order.
• Name, phone number, and shipping address — when you complete a purchase via Stripe.
• Payment information — processed directly and securely by Stripe. We do not store card numbers.
• IP address — collected temporarily to prevent abuse (rate limiting) of our subscription form. Not stored permanently.
• Browsing data — standard server logs (page visits, browser type) for operational purposes only.

3. Legal Basis for Processing

4. Newsletter & Email Marketing

We operate a double opt-in subscription process. This means that after submitting your email address, you will receive a confirmation email. Your address is only added to our active mailing list after you click the confirmation link.

You may unsubscribe at any timeby clicking the “Unsubscribe” link included at the bottom of every newsletter email, or by emailing us at hello@vinylmalta.com.

We use Resend (resend.com) as our email delivery provider. Your email address is shared with Resend solely for the purpose of delivering emails. Resend processes data under GDPR-compliant Data Processing Agreements.

5. Third-Party Services

• Stripe — Payment processing. Stripe is PCI DSS compliant. See Stripe's Privacy Policy.
• Supabase — Database and authentication, hosted in the EU.
• Resend — Transactional and marketing email delivery.
• Vercel — Website hosting. Data is processed in EU-based edge locations where available.

6. Data Retention

• Newsletter subscribers: Retained while your subscription is active. Deleted upon request.
• Order data: Retained for 7 years to comply with Maltese accounting law.
• Unconfirmed subscriptions: Automatically deleted after 30 days if the confirmation link is not clicked.

7. Your Rights Under GDPR

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data (“right to be forgotten”).
• Restrict or object to certain processing activities.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time for consent-based processing (e.g. newsletter).

To exercise any of these rights, contact us at hello@vinylmalta.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC) in Malta: idpc.org.mt.

8. Cookies

We use only strictly necessary cookies to maintain your session when browsing the store (managed by Supabase Auth). We do not use tracking, advertising, or analytics cookies.

9. Changes to This Policy

We may update this policy periodically. When we do, we will revise the “last updated” date at the top of this page. We encourage you to review this page from time to time.