Privacy & Cookie Policy — MattyLuxWatches

1. Data Controller

The Data Controller responsible for processing your personal data is:

MattyLuxWatches
JC 1962, Pjazza President J. F. Kennedy
Victoria (Gozo) VCT 2582, Malta
VAT / P.IVA: 03074270012
WhatsApp: +356 77138554

For any data protection enquiries, please contact us via WhatsApp or in writing at the address above.

2. Legal Basis for Processing

We process personal data on the following legal bases under Article 6 GDPR:

Consent (Art. 6(1)(a)) — for analytics cookies and marketing communications.
Legitimate interest (Art. 6(1)(f)) — for customer enquiries, watch valuations and business operations.
Contractual necessity (Art. 6(1)(b)) — when processing data to complete a purchase or sale transaction.
Legal obligation (Art. 6(1)(c)) — where required under Maltese or EU law.

3. Data We Collect

Data you provide directly

Name and contact details (phone number via WhatsApp)
Photos and descriptions of your watch
Bank account details (only if a transaction is agreed)

Data collected automatically

IP address, browser type, operating system
Pages visited, time spent on site, referral source (via Google Analytics)
Chat session metadata (via Chatway live chat)

4. Third-Party Services

Google Analytics (Google Ireland Ltd.)

We use Google Analytics 4 to understand how visitors interact with our site. Data is anonymised where possible. Google acts as a data processor under a Data Processing Agreement. Data may be transferred to the USA under Standard Contractual Clauses (SCCs). You may opt-out via our cookie banner or at tools.google.com/dlpage/gaoptout.

Chatway (Live Chat)

We use Chatway to provide live chat support. Chatway may store chat transcripts and visitor IP address for quality and support purposes. No personal data entered in chat is shared with third parties for marketing. Data is processed per Chatway's own privacy policy.

WhatsApp (Meta Platforms Ireland Ltd.)

When you contact us via WhatsApp, your phone number and messages are processed by Meta under their own privacy policy. WhatsApp communications are end-to-end encrypted by default. We retain WhatsApp conversations only as long as necessary for the transaction or enquiry.

5. Data Retention

Enquiries with no transaction: deleted within 12 months.
Completed transactions: retained for 10 years to comply with Maltese accounting and tax legislation.
Analytics data: retained for 26 months (Google Analytics 4 default).
Chat logs (Chatway): retained for 6 months, then deleted.

6. Your Rights Under GDPR

Under GDPR (EU) 2016/679 and the Malta Data Protection Act (Cap. 586), you have the following rights:

Right of Access (Art. 15)

Request a copy of the personal data we hold about you.

Rectification (Art. 16)

Ask us to correct inaccurate or incomplete data.

Erasure (Art. 17)

Request deletion of your data where there is no legal basis to retain it.

Restriction (Art. 18)

Ask us to restrict processing in certain circumstances.

Portability (Art. 20)

Receive your data in a structured, machine-readable format.

Objection (Art. 21)

Object to processing based on legitimate interests or for direct marketing.

Withdraw Consent (Art. 7(3))

Withdraw consent at any time without affecting prior lawful processing.

Complaint — IDPC Malta

Lodge a complaint with the Information and Data Protection Commissioner.

IDPC — Malta Supervisory Authority
Information and Data Protection Commissioner
Level 2, Airways House, High Street, Sliema SLM 1549, Malta
idpc.org.mt · idpc.info@gov.mt

7. International Data Transfers

Some of our service providers (Google, Meta/WhatsApp, Chatway) may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place — including Standard Contractual Clauses (SCCs) approved by the European Commission — in line with Chapter V GDPR.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or destruction, in accordance with Art. 32 GDPR. WhatsApp communications are end-to-end encrypted by default.

9. Minors

Our services are not directed at persons under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us immediately so we can delete it.

10. What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They allow the site to recognise your browser, remember preferences and collect usage statistics. We use cookies strictly in accordance with GDPR (EU) 2016/679, the ePrivacy Directive (2002/58/EC) and the Malta Electronic Communications Act (Cap. 399).

11. Cookies We Use

Strictly Necessary — no consent required

These cookies are essential for the website to function and cannot be disabled.

Cookie	Provider	Duration	Purpose
`cookie_consent`	MattyLuxWatches	12 months	Necessary Stores your cookie consent preference.
`PHPSESSID`	MattyLuxWatches	Session	Necessary Maintains your active session.

Analytics — consent required

Help us understand how visitors use the site. All data is aggregated and anonymised.

Cookie	Provider	Duration	Purpose
`_ga`	Google Analytics	2 years	Analytics Distinguishes unique users.
`_ga_*`	Google Analytics 4	2 years	Analytics Persists session state for GA4.
`_gid`	Google Analytics	24 hours	Analytics Distinguishes users within the same day.
`_gat`	Google Analytics	1 minute	Analytics Throttles request rate to Google servers.

Functional / Chat (Chatway) — consent required

Set by our live chat provider to enable and personalise the chat widget.

Cookie	Provider	Duration	Purpose
`chatway_*`	Chatway	6 months	Functional Identifies returning chat visitors and maintains chat history.

12. Cookie Consent Management

When you first visit our website, a cookie consent banner is displayed (Cookie Consent tool). You may accept all cookies, accept only strictly necessary cookies, or customise your preferences by category. Your choice is stored for 12 months.

        Important:
        
          Non-necessary cookies are only placed on your device after you give explicit consent, in compliance with Art. 5(3) of the ePrivacy Directive. You can change or withdraw your consent at any time by clearing your browser cookies and revisiting the site.

13. Browser Cookie Controls & Opt-Out

You can manage or delete cookies at any time via your browser settings. Note that disabling all cookies may affect the functionality of this site. To opt out of Google Analytics tracking across all websites, install the browser add-on at tools.google.com/dlpage/gaoptout.

14. Updates to This Policy

We may update this Privacy & Cookie Policy periodically. Any significant changes will be communicated on this page with an updated date. Continued use of the website after changes constitutes acceptance of the revised policy. We recommend checking this page occasionally.