Privacy Notice
Last updated:
This notice explains how HEIRLOOM and its brands (The Streatery by Heirloom, Events by Heirloom and Nourish by Heirloom) use personal data when you visit our websites, contact us, order catering, apply for a job or join Streatery Rewards. We keep it short and only collect what we need.
Who we are
The data controller is Hedonist Catering Services Ltd, trading as HEIRLOOM, company registration number C 107461, business address The Landmark, Triq l-Iljun, Qormi QRM 3800, Malta. You can contact us about privacy at hedonistcatering@gmail.com or on +356 9902 6092.
What we collect and why
| What | Why | Legal basis |
|---|---|---|
| Technical data when you visit (IP address, browser, pages requested, date and time) | To deliver the website securely and keep it working. Our hosting provider processes this data for us | Our legitimate interest in running a secure website (Art. 6(1)(f) GDPR) |
| Details you send through our enquiry forms, WhatsApp or email (name, phone, email, event date and type, number of guests, dietary preferences, your message) | To reply to you and to prepare a quote or booking | Steps you ask us to take before a contract, and the contract itself (Art. 6(1)(b)) |
| Allergies or health-related dietary needs you choose to tell us | Only to prepare your food safely | Your explicit consent (Art. 9(2)(a)), which you can withdraw at any time |
| Your consent to receive occasional news (Streatery catering form tick box) | To send you news and offers | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Job applications sent by email (CV and the details you include) | To assess your application | Steps before a possible employment contract (Art. 6(1)(b)) |
| Streatery Rewards membership (name, contact details you give, date of birth, points and rewards) | To run the loyalty programme and your birthday reward | The programme terms you accept when you join (Art. 6(1)(b)) |
Our forms do not store anything on our website. When you press send, the form opens WhatsApp or your email app with your message ready, and nothing reaches us until you send it from there.
Who we share it with
We do not sell your data. We only use these service providers, who process data for us or under their own terms:
- Cloudflare — hosts the websites.
- WhatsApp (Meta) and our email provider — carry the messages you choose to send us.
- LoyalMT — runs the Streatery Rewards platform for us, as our data processor. See LoyalMT's privacy policy (opens in a new tab).
- Google Maps — only if you press "Show map" on the Streatery website; Google then receives your IP address and may set cookies under Google's privacy policy (opens in a new tab).
Some of these providers may transfer data outside the European Economic Area. When they do, they rely on safeguards recognised under the GDPR, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
Links to other services
Online ordering (order.site), Instagram, Facebook and LinkedIn open in their own services, which apply their own privacy policies.
Cookies
Our websites do not use cookies for analytics or advertising, so we do not show a cookie banner. If you press "Show map", Google Maps may set its own cookies. If we ever add analytics or marketing tools, we will ask for your consent first.
How long we keep it
- Enquiries that do not lead to a booking: up to 24 months.
- Bookings and invoices: as long as Maltese tax and accounting law requires.
- Job applications: up to 12 months, unless you agree to a longer period.
- Rewards membership: while you are a member and up to 12 months after your last activity.
- Consent to receive news: until you withdraw it.
Your rights
You can ask to access, correct or delete your data, to restrict or object to how we use it, and to receive a copy in a portable format. Where we rely on your consent, you can withdraw it at any time without affecting what we did before. Write to hedonistcatering@gmail.com and we will reply within one month.
If you are not happy with our answer, you can complain to the Information and Data Protection Commissioner (IDPC) in Malta: idpc.org.mt (opens in a new tab).
Changes
We may update this notice. The date at the top shows the latest version.