1. Who We Are

Charma (referred to as “we”, “us”, or “our”) operates an online sticker shop based in Malta. This Privacy Policy explains how we collect, use, and protect your personal information when you place an order or interact with our shop.

2. What Information We Collect

We collect the following information from you: Name – to address your order and package correctly Email address – to send order confirmations, shipping updates, and respond to inquiries Shipping address – to deliver your stickers Order history – to manage returns, replacements, and provide customer support Payment information – we do not store your credit card or payment details directly. Payments are processed securely by our payment provider ([PayPal / Stripe / etc.]). If you contact us via email, we may also collect any information you choose to share in that communication.

3. How We Use Your Information

We use your information for the following purposes: To process and fulfill your orders

To communicate with you about your order (confirmation, shipping, problems, resolutions) To respond to your customer service inquiries To improve our products and services To comply with legal obligations (e.g., tax records)

4. Legal Basis for Processing (GDPR Compliance)

Because we operate from Malta (EU), we process your personal data under the following legal bases: Contract performance: To fulfill your order, we need your name, email, and address Legitimate interest: To communicate with you about your order and improve our service Consent: If you sign up for marketing emails (newsletters, new releases), you may withdraw consent at any time

5. How Long We Keep Your Information

We retain your order information for as long as necessary to: Fulfill your order Comply with tax and legal obligations in Malta (typically 5–7 years for financial records) Handle potential disputes or returns If you request deletion of your data (see Section 8), we will honor that request unless we are required to keep certain information by law.

6. Who We Share Your Information With

We do not sell or rent your personal information to anyone. We only share your

data with trusted third parties necessary to operate our shop: Third Party Purpose Data Shared [Payment provider ] Process payments Payment details (we do not store them) [Shipping carrier – e.g., MaltaPost / DHL] Deliver your order Name + shipping address [E-commerce platform ] Host our shop Order and customer data All third parties are contractually obligated to protect your data and use it only for the services they provide to us.

7. Data Security

We take reasonable measures to protect your information from loss, theft, misuse, or unauthorised access. This includes: Using secure, password-protected systems Limiting access to order information to Charma team members only Using trusted payment processors with encryption However, no method of electronic transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Your Rights (GDPR)

If you are located in the European Union (including Malta), you have the following rights under the General Data Protection Regulation (GDPR): Right to access – Request a copy of the personal data we hold about you Right to rectification – Correct inaccurate or incomplete data Right to erasure – Request deletion of your data (subject to legal retention requirements) Right to restrict processing – Limit how we use your data Right to data portability – Receive your data in a structured, commonly used

format Right to object – Object to processing based on legitimate interests Right to withdraw consent – For marketing emails (unsubscribe link is in every email) To exercise any of these rights, please contact us at: [Your email address] We will respond within 30 days.

9. Marketing Communications

We may send you marketing emails (e.g., new releases, discounts, shop updates) only if you have explicitly opted in. You can unsubscribe at any time by clicking the “unsubscribe” link at the bottom of any marketing email. Order-related emails (confirmation, shipping, problem resolution) are not marketing communications and cannot be opted out of, as they are necessary to fulfill your purchase.

10. Children’s Privacy

Our products (name tags, kids’ stickers) are often purchased by adults for children. We do not knowingly collect personal information from children under 13. All information provided (e.g., a child’s name for a name tag) is assumed to be provided by a parent or guardian.

11. International Transfers

We operate from Malta and primarily ship within Malta. However, some thirdparty services (e.g., payment processors, e-commerce platforms) may store data on servers located outside the EU (e.g., United States). When this occurs, we ensure appropriate safeguards (e.g., Standard Contractual Clauses) are in place.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will reflect changes. If we make significant changes, we will notify you via email (if we have your address) or through a notice on our shop.

13. Contact Us

For any privacy-related questions, requests, or concerns: Email: Shop: Location: Malta You also have the right to lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC) in Malta if you believe your data rights have been violated.