Privacy Policy

Last updated: 4 November 2026

This Privacy Policy explains how MtLocalGoodies collects, uses, shares and protects your personal data when you use our website. MtLocalGoodies is a directory that helps people in Malta and Gozo discover verified local businesses. We do not sell goods, take orders or handle payments between you and a business, so we collect far less data than a shop would. We handle what we do collect lawfully, fairly and transparently under the EU General Data Protection Regulation (GDPR) and Maltese data protection law. Any question, write to us at info@mtlocalgoodies.com.

1. Data controller

The data controller responsible for your personal data is Lukasz Samelko, who is registered in Malta and operates MtLocalGoodies as part of his marketing services, in accordance with the laws of Malta.

• Controller: Lukasz Samelko
• Service: MtLocalGoodies (provided within his marketing services)
• Registered in: Malta
• VAT number: MT 2881 5325
• Contact email: info@mtlocalgoodies.com
• Business WhatsApp / phone: +356 7965 8226

2. What we collect

We only collect what we need to run the directory and support the people who use it:

• Business sign-up details, if you list your business with us: your name, business name, contact email and phone, location, the categories and products you offer, opening hours, and any photos or description you provide for your storefront. You give us this so we can build and publish your listing.
• Enquiry and contact data: if you email us or send us a message through a form on the site, we receive the details you include so we can reply. Sign-up forms are handled on our own server, stored in our database at Supabase, and emailed to us so we can get back to you.
• Membership billing data: if you take a paid membership, your subscription payment is handled by Stripe. We receive confirmation that a payment succeeded and basic billing records, but we do not collect or store your full card number on our servers.
• Analytics data: with your consent, Google Analytics 4 collects usage data such as pages visited, approximate location and device type, so we can understand and improve the site. Analytics is consent-gated through Consent Mode v2 and stays off until you accept.
• Rosa chats: if you chat with Rosa, our site helper, we keep what you type and her answers for 90 days (see section 14).
• Cookie and consent choices: your cookie preference is stored on your device so we can respect it (see our Cookie Policy).

When you find a business on MtLocalGoodies and contact it directly, for example over WhatsApp or by phone, that conversation happens between you and the business, on their own channel. We are not part of it and do not receive its contents.

3. How and why we use your data (lawful bases)

Under the GDPR we rely on the following lawful bases:

• Performance of a contract: to set up and run your business listing, manage your membership, and provide the directory service you signed up for.
• Consent: for analytics and any marketing cookies. You give consent through the on-site cookie banner and can withdraw it at any time.
• Legitimate interests: to keep the site secure, prevent abuse, answer your enquiries and improve the service, where this does not override your rights.
• Legal obligation: to meet our accounting and tax obligations for membership billing under Maltese and EU law.

4. Who we share your data with

We never sell your personal data. We share it only with the providers we need to run the service, each acting under their own data protection obligations:

• Stripe: processes membership payments securely as our payment provider.
• Supabase: stores the details you submit through the sign-up form, so we can act on them, and your Rosa chats (see section 14).
• Hostinger: hosts the site and sends the emails our forms generate.
• Google: provides Google Analytics 4, used only with your consent.
• Cloudflare: runs Cloudflare Workers AI, which writes Rosa’s chat answers (see section 14).

We do not pass your personal data to the businesses listed in the directory. If you choose to contact one of them, you do that directly and share only what you decide to tell them.

5. International transfers

Some of our providers (such as Stripe, Supabase, Google and Cloudflare, which runs Workers AI for Rosa) may process data outside the European Economic Area. Where that happens, the transfer is protected by appropriate safeguards recognised under the GDPR, such as the European Commission’s Standard Contractual Clauses or an adequacy decision, so your data keeps an equivalent level of protection.

6. How long we keep your data

We keep listing and membership data for as long as your listing is active and then only as long as we need it to meet our legal, accounting and tax obligations, after which it is securely deleted or anonymised. Enquiry emails are kept while we deal with them and for a reasonable period afterwards. Rosa chats are kept for 90 days and then deleted (see section 14). Analytics data is retained for the period set in our Google Analytics configuration. Consent records are kept for as long as we need them to show we complied.

7. Your rights

Under the GDPR you have the right to:

• Access: get a copy of what we hold on you.
• Rectification: fix data that is wrong or incomplete.
• Erasure: ask us to delete your data where there is no overriding reason to keep it.
• Restriction: in some cases, limit how we use it.
• Portability: receive the data you gave us in a structured, machine-readable format, or have it sent to another controller.
• Objection: object to processing based on our legitimate interests, and to any direct marketing.
• Withdraw consent: withdraw your consent for analytics or marketing at any time, without affecting processing already carried out.

To exercise any of these rights, email info@mtlocalgoodies.com. We will respond within the time limits set by the GDPR.

8. Your right to complain

If you believe we have not handled your data properly, you can lodge a complaint with the Maltese supervisory authority, the Information and Data Protection Commissioner (IDPC), at idpc.org.mt. We would rather put it right first, though, so please contact us and give us the chance.

9. Security

We use appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Membership payments are encrypted and handled by Stripe, and we limit access to personal data to the people who need it to run the service.

10. Changes to this policy

We may update this Privacy Policy from time to time. The current version always carries the “last updated” date shown above, and material changes will be reflected here.

11. Contact us

For any privacy question or to exercise your rights, contact MtLocalGoodies at info@mtlocalgoodies.com.

12. Businesses we listed from public information

Some businesses in the directory did not sign up themselves. We added them so people can find local shops and services. Each of these pages says so at the top.

• What we use: the business name, its trade, the town, and contact details the business already shows in public, such as a shop sign, its own website or a public social media page. Where a business is run by one person, the business name or number can be personal data.
• Why: to help people find and contact local businesses in Malta and Gozo. Our lawful basis is legitimate interests. We only list what a business already makes public for customers to use.
• Who sees it: anyone who visits the site. We do not sell it or pass it to anyone else.
• How long: until the owner claims the page, asks us to change it or asks us to take it down.

If this is your business, you can claim the page for free and write it yourself, ask us to fix something, or ask us to remove it. Use the link on the page, or email info@mtlocalgoodies.com. You also have all the rights in section 7, including the right to object, and the right to complain in section 8.

13. The weekend newsletter

If you sign up for “This weekend in Malta & Gozo”, we send you one email every Thursday with festas, markets and things to do that weekend. Nothing else goes to that address.

• Why and on what basis: to send you the weekend list you asked for. Our lawful basis is your consent. You give it by ticking the box and then pressing Confirm in the email we send you. Until you confirm, we send you nothing else.
• What we store: your email address; the exact sentence you agreed to (“Send me the weekend list every Thursday. Unsubscribe any time.”); when you signed up, confirmed and, if you do, unsubscribed; a keyed hash of your IP address and your browser’s user agent, taken when you sign up and again when you confirm; and which week’s email we last sent you. We keep the hash and the user agent as proof of your consent. We hash the IP address with a secret key, so it cannot be turned back into your address.
• Who handles it: the list is stored in our database at Supabase and the emails are sent from our host, Hostinger (see section 4). We never sell or share your address.
• How long: if you never confirm, we delete the sign-up after 7 days. While you are subscribed, we keep it. When you unsubscribe, we keep your address and the date you left, marked as unsubscribed, so we never mail you again by mistake. For 30 days after that, a new sign-up with the same address is ignored. Ask us and we delete the record entirely, knowing that we then cannot check it against a later sign-up.
• How to unsubscribe: use the link at the bottom of any newsletter email (one click, no login), use your mail app’s own unsubscribe button, or email info@mtlocalgoodies.com. Withdrawing consent is as easy as giving it and does not affect emails already sent.

The controller for the newsletter is the one named in section 1. You have all the rights in section 7 and can complain as described in section 8.

14. Rosa, our site helper

Rosa is the chat helper in the corner of the site. She helps you find local businesses and answers questions about MtLocalGoodies. You don’t need an account to use her, and she never asks for your name or email.

• What we store: each message you type to Rosa, each answer she gives, and the time of the chat. We do not store your name, email or phone number, unless you type them into the chat yourself. If you ask to speak to a person or raise a complaint, we keep a copy of that message so someone can follow it up.
• Why and on what basis: to see which questions Rosa answers badly so we can improve her answers, and to spot misuse of the chat. Our lawful basis is legitimate interests (Article 6(1)(f) GDPR). You can object at any time; see section 7.
• Who handles it: to write an answer, your message is sent to Cloudflare Workers AI, which runs the language model behind Rosa. The chat is then stored in our database at Supabase (see section 4). We do not sell chats or share them with the businesses in the directory. Cloudflare may process the message outside the European Economic Area, with the safeguards described in section 5.
• How long: 90 days from the start of the chat. After that we delete it, together with any copy kept for a follow-up.
• Deleting a chat sooner: email info@mtlocalgoodies.com and tell us roughly when you chatted (the date and the time, to the nearest hour). Chats are not linked to your name, so the time is how we find yours.

Please don’t type personal details such as your address, phone number, health information or card numbers into the chat. Rosa doesn’t need them to help you. You have all the rights in section 7 and can complain as described in section 8.