Privacy Policy

Who we are

Epic Detailing is a ceramic coating studio in Malta. It is run by [Company legal name], registration number [Company registration number], of [Registered address]. We are the controller of the personal data described in this policy.

If you have a question about this policy or your data, email [Contact email] or call [Contact phone].

This policy explains what personal data we collect through this website and at our studio, why we use it, who we share it with and what your rights are. It follows the EU General Data Protection Regulation (GDPR) and Malta's Data Protection Act (Cap. 586).

What we collect and why

When you ask for an estimate, our form asks for your name, your phone or WhatsApp number and your email address. It also records your vehicle size, the coating tier and add-ons you chose, and the estimate we showed you. You can choose to add photos of your car. We use this to prepare your estimate, send it to you and contact you about it.

When you book a drop-off date, we also record the drop-off and collection dates. We add the booking to our calendar with your name, email address and phone number, and send you a calendar invitation.

When you shop in our store, Shopify holds your basket. At checkout you enter your contact details, delivery address and payment details on Shopify's checkout page. We receive your order details so we can supply your order. We do not see or store your full card number.

When you tick the box to receive emails from us, we record that you agreed and when. We use your email address to send occasional detailing tips and offers.

When you browse the site, our hosting provider processes technical data such as your IP address and browser type to deliver pages and protect the site from abuse. We do not use analytics or advertising trackers.

When you email or call us, we keep the conversation so we can reply and keep a record of what we agreed.

You do not have to give us your details. Without your name and contact details we cannot prepare an estimate or book you in. Photos and marketing emails are optional.

Our lawful basis

We only use your personal data where the GDPR allows it. For each purpose we rely on:

• Preparing your estimate and handling your booking: steps you ask us to take before entering a contract, and performing our contract with you (Article 6(1)(b)).
• Supplying your store order: performing our contract with you (Article 6(1)(b)).
• Sending marketing emails: your consent (Article 6(1)(a)). You can withdraw it at any time.
• Keeping accounting and tax records: our legal obligations (Article 6(1)(c)).
• Keeping a record of past estimates so we can answer follow-up questions, keeping the site secure, and handling complaints or legal claims: our legitimate interests (Article 6(1)(f)). We rely on this only where those interests are not outweighed by your rights.

Who we share it with

We do not sell your personal data. We use these service providers to run the business. They process data on our behalf, under contract with us, and only on our instructions.

• Shopify. Holds our customer records, including your estimate and booking notes, and runs our online store and checkout.
• Vercel. Hosts this website and stores the car photos you upload.
• Resend. Sends our emails, including your estimate and booking confirmation.
• Google. Runs the calendar we use for bookings and sends your calendar invitation.

We may also share data with our accountants and professional advisers, or with public authorities where the law requires it.

Transfers outside the EU

Some of these providers are based in the United States or may process data there. Where that happens, the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the provider takes part in it, or on the Commission's standard contractual clauses. You can ask us which safeguard applies to a given provider.

How long we keep it

• Estimate requests that do not lead to a booking: 24 months after your last request.
• Car photos: 12 months after you upload them.
• Bookings, completed work and store orders: 6 years, to meet tax and accounting rules.
• Marketing consent: until you unsubscribe. We then keep a record that you opted out so we do not email you again.
• The basket cookie: 30 days.

When a period ends, we delete the data or make it anonymous.

Your rights

Under the GDPR you have the right to:

• Get a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data deleted where we no longer need it or have no lawful basis to keep it.
• Restrict how we use your data while a concern is being resolved.
• Object to our use of your data based on legitimate interests.
• Object to marketing at any time. We will stop straight away.
• Receive data you gave us in a common digital format, or have it sent to another business.
• Withdraw your consent at any time. This does not affect what we did before you withdrew it.

To use any of these rights, email [Contact email]. We reply within one month. We may ask you to confirm your identity first. Every marketing email also has an unsubscribe link.

Complaints

If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Information and Data Protection Commissioner (IDPC), Malta's data protection authority, at idpc.org.mt.

Cookies

This site sets one cookie of its own. It is called cart and it remembers your store basket for 30 days. It is only set once you add something to your basket. It is strictly necessary for the store to work, so it does not need your consent.

When you go to checkout, you move to Shopify's checkout page, which sets its own cookies. Shopify explains them in its own privacy and cookie notices.

We do not use analytics, advertising or social media tracking cookies.

Children

Our site and services are meant for adults. We do not knowingly collect personal data from anyone under 16. If you think a child has sent us their details, contact us and we will delete them.

Changes to this policy

We may update this policy when our services or the law change. We will post the new version on this page with a new effective date. If a change affects how we use data you have already given us, we will tell you by email.