Privacy & cookies
Short version: we only collect what we need to reply to you, and we only use tracking cookies if you say yes.
Who is responsible for your data
Bohini is a trading name. The person responsible for your personal data (the "controller") is Marija Grech, trading as Bohini, 13, Triq Kurat Chetcuti, L-Imġarr, Malta. VAT number MT21020505. Contact: hello@bohini.com.mt or +356 2722 0302.
What we collect, and why we're allowed to
For each use below, the "legal basis" is the reason the GDPR (Article 6, and Article 9 for health information) allows it.
- Newsletter: your email address, to send you news. We only add you if you sign up yourself; joining Rewards or buying a gift card never adds you. Unsubscribe any time from any email. Legal basis: your consent.
- Event enquiries: name, email, phone, date, guests, budget and message, to reply and plan your event. Legal basis: steps you ask us to take before a contract. If you tell us about an allergy: your explicit consent, and we use it only to prepare your food safely.
- The Regulars page: if you sign up, your name, what you do, your description, links and photo are shown on our website once we approve them. Your email and mobile are never shown; we only use them to contact you about the page. Ask us at any time and we'll remove you within a few days. Legal basis: your consent.
- Dish ideas: if you suggest a dish, your idea and, if you give them, your first name and Instagram, so we can thank you. Kept up to 24 months. Legal basis: your consent.
- Job applications: name, email, phone, your answers to the application questions, your message and CV if you attach one, to consider you for a role. An AI assistant (Claude, by Anthropic) reads each application and writes a short summary for us; it never makes the decision, a person at Bohini does. Applications are stored securely with our website host (Netlify) and deleted automatically after 12 months. Legal basis: steps you ask us to take before a possible job contract; the AI summary is based on our legitimate interest in reading every application carefully and quickly.
- Bohini Rewards (loyalty card): your name, mobile number and points history, to run the programme. If you join on our website, your details wait securely with our website host (Netlify) until our team creates your card, and are then deleted from there. It's stored securely with Google Firebase. Only our staff can see member details; your card is opened with a private link that only you have. Ask us any time to see, correct or delete your account. Legal basis: the Rewards terms you agree to when you join (a contract).
- Gift cards: the names and message written on the card (if any), its balance and when it was used. Stored securely with Google Firebase. Anyone with the card's code can see that card, so treat the code like cash. If the buyer gives us the recipient's mobile number, we use it only to send them the card by WhatsApp or text; it isn't saved in our gift card system, but stays in our WhatsApp chat. Legal basis: the gift card purchase (a contract), and our legitimate interest in delivering the card to the person it's for.
- WhatsApp: if you message us, or we send you your Rewards card or a gift card by WhatsApp, WhatsApp (Meta) handles those messages under its own privacy policy. We only send marketing messages on WhatsApp if you've agreed. Legal basis for marketing messages: your consent.
- Delivery: orders on Wolt are handled by Wolt under its own privacy policy.
- Bookings: when you request a table, your name, mobile, date, time, number of guests and any notes are sent to us by WhatsApp from your phone, and a copy goes to our website host (Netlify). We use them only to manage your booking and keep them up to 12 months. Legal basis: steps you ask us to take to book a table (a contract). If you tell us about an allergy: your explicit consent, and we use it only to prepare your meal safely.
- Backups of Rewards and gift cards, so nothing is lost if something goes wrong. Legal basis: our legitimate interest in keeping your points and balances safe.
We never sell your data. No decision about you is made by a computer alone.
Who handles your data for us
- Netlify (website host): the website, all forms (table booking requests, newsletter, enquiries, Regulars, Rewards sign-ups, job applications) and our nightly backups.
- WhatsApp (Meta): booking requests and messages you send us on WhatsApp, under WhatsApp's own privacy policy.
- Google Firebase: Bohini Rewards and gift cards.
- Anthropic (Claude): reads job applications to write a summary for us. The email and phone number you type in the form are not sent to it, but if you attach a CV, the CV is sent as it is, including any contact details in it.
- Wolt: delivery orders.
- Google Analytics and Meta: only if you accept cookies (see below).
Some of these companies are based outside the EU, for example in the United States. Where that happens, your data is protected by the safeguards EU law requires, such as the EU's Standard Contractual Clauses or the EU–US Data Privacy Framework.
How long we keep it
- Booking requests: up to 12 months.
- Enquiries (events, contact): up to 24 months.
- Job applications: deleted automatically after 12 months.
- Rewards: while your card is in use; accounts with no activity for 24 months are deleted. Ask us any time and we'll delete it sooner.
- Gift cards: 24 months after the card expires, then deleted.
- Rewards sign-ups from the website: deleted from our website host as soon as your card is created.
- The Regulars page: while you're on the page, and removed within a few days if you ask.
- Newsletter: until you unsubscribe.
- Backups of Rewards and gift cards: kept for 60 days, then deleted automatically.
Cookies
Without your consent we set no tracking cookies. We store your cookie choice in your browser's local storage.
If you click Accept, we load:
- Google Analytics 4: to see which pages people use and which lead to bookings.
- Meta Pixel: to measure our Facebook and Instagram ads.
The map on our Visit page and the film on our After Hours page only load from Google or YouTube when you tap them. Those services may then set their own cookies.
Legal basis: your consent. You can change your mind at any time with the button below.
Your rights
At any time, and free of charge, you can ask us to:
- see the data we hold about you, and get a copy;
- correct it if it's wrong;
- delete it;
- restrict how we use it (we keep it but stop using it), for example while we check a complaint;
- move it: get the data you gave us in a common digital format, or have it sent to someone else (data portability);
- object to how we use it where we rely on our legitimate interest;
- withdraw your consent wherever we rely on it (newsletter, WhatsApp marketing, cookies, the Regulars page, allergy information). This doesn't affect what we did before you withdrew it.
Email hello@bohini.com.mt or ask any of our team. We'll reply within one month.
If you're not happy with how we handle your data, you can complain to Malta's Information and Data Protection Commissioner (IDPC) at idpc.org.mt.
Updated October 2026.