Privacy Policy
Last updated: 7 October 2026
This policy explains how MANTA BLU ("we", "us") collects and uses your personal data when you visit mantablu.com or community.mantablu.com, buy from us, or sign up to hear from us. We follow the EU General Data Protection Regulation (GDPR) and Malta's Data Protection Act (Cap. 586).
1. Who we are
The data controller is Michele Borg Bonaci, a sole trader trading as MANTA BLU, 103 Triq is-Siġġiewi, Ħaż-Żebbuġ ZBG 2307, Malta. Contact: hello@mantablu.com.
2. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, phone, delivery and billing address, order details | To process, deliver and support your order, including returns | Contract (Art. 6(1)(b)) |
| Payment information | To take payment. Card details are handled by Shopify Payments and its payment partners, and we never see your full card number | Contract |
| Invoices and order records | To keep tax and accounting records | Legal obligation (Art. 6(1)(c)) |
| Email address (newsletter, 10% welcome code, community waitlist) | To send marketing emails you asked for | Consent (Art. 6(1)(a)). You can withdraw it at any time. |
| Account details | To run your customer account | Contract |
| Messages you send us | To answer your questions | Legitimate interests (Art. 6(1)(f)) |
| Analytics data (pages viewed, device, approximate location) through Google Analytics 4 and Microsoft Clarity | To understand how our site is used and improve it | Consent, through our cookie banner |
| Essential cookies (cart, checkout, security, your consent choice) | To make the shop work | Legitimate interests / strictly necessary |
3. Who we share it with
We share data only with providers that help us run the shop, under data-processing agreements:
- Shopify (store, checkout, payments, order emails)
- Fly.io (website hosting)
- Resend (website emails, and receiving email sent to mantablu.com addresses)
- Google (Analytics 4)
- Microsoft (Clarity)
- MaltaPost or another courier (delivery)
Some of these providers process data outside the EEA. Where they do, the transfer is covered by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. We never sell your personal data.
4. How long we keep it
- Order and invoice records: 10 years, as Maltese tax law requires.
- Marketing consent: until you unsubscribe, plus proof of consent and opt-out for 3 years.
- Analytics data: up to 14 months (GA4) and 12 months (Clarity).
- Customer accounts: until you ask us to delete yours, or 3 years without activity.
5. Your rights
You have the right to:
- access your data
- correct it
- have it deleted
- restrict how we use it
- object to us using it
- take a copy of it to another provider (data portability)
- withdraw your consent at any time.
Email hello@mantablu.com and we'll reply within one month. You can also complain to Malta's Information and Data Protection Commissioner (IDPC), idpc.org.mt.
6. Cookies
Our Cookie Policy lists every cookie we use. Analytics cookies are only set if you accept them, and you can change your choice at any time from the "Cookie settings" link in the footer.
7. Children
Our shop isn't aimed at children under 16, and we don't knowingly collect their data.
8. Changes
If we change this policy we'll update the date above. If the changes are significant, we'll tell you by email.