personal data collected by Thumbelina Limited via the website [https://okfashion.com.mt/ ]
(the ‘Site’). The Site is operated and managed by Thumbelina Limited, a Maltese registered
company bearing company registration number C 46987 and with VAT registration number
MT24052311 (the ‘Company’).
2016/679) and the Data Protection Act (Cap 586 of the laws of Malta) on the processing of
personal data and the protection of privacy in the electronic communications sector. Within this
subject’) the supply of such information means that you can be identified, directly or indirectly,
such as by means of your name and surname, birth date, gender, email address, delivery and
billing addresses, phone number, signature (for delivery or collection of online purchase orders),
payment details, historical purchase information and other factors specific to you.
result also be updated. You will be notified of any such updates on the Site. This policy was
last updated 30 th March 2020.
The Company is not responsible for the content or privacy policies of other third party websites
which may be linked to the Site.
Your use of this Site or by providing the Company with your personal data through the Site, you
THE PERSONAL DATA WE COLLECT
The Company collects and processes your personal information when you save a ‘Wish List’ and
make a purchase order through the use of the Site. If you choose not to provide the Company
with your personal data, we will not be in a position to fulfil our services to you including fulfilling
any purchase order and will not deliver the items to you.
The Company also stores the IP address or the location of your device for security and
information purposes. This data is not shared or disclosed to third parties save for the exceptions
as stated below.
WHY WE USE YOUR DATA
In order to process your purchase requests from a Wish List created by You on the Site, certain
personal data attributable to you is required. In general and on a case by case basis, the
personal data the Company will require may include:
(a) Information of your identity
This may include, your name, surname, language and country from which you access the
Site from, contact information etc.
(b) Information of economic and financial nature
This may include your payment option information such as your card data, information of
your purchases, orders and returns history.
(c) Information of geographical nature
This may include your connectivity data such as if you are accessing the Site via a
mobile device or from a desktop device, your location information etc.
Certain personal data is required from you in order to allow you to access functionality or service
of the Site. The necessary fields will be marked as compulsory because such information is
required to be able to fulfil your orders and deliver the items of choice to you. Should you not
wish to provide such personal data, you may be unable to carry on with the purchase order of the
The services provided by the Company depend on your requests and on the services, products
or functionalities you wish to use from the Site and the Company processes your data for the
(a) To fulfil your orders
If you wish to purchase an item or items from our Site we will request your personal data
to be able to execute and fulfil your order, prepare an invoice for the completion of the
sale contract between you and the Company and manage a request for returns of
purchased if required. This data may also be used to contact you via the contact means
you provide including email, telephone or sms to update you on the status of your
purchase order and other communication related to the purchase order.
(b) To meet requests made to Customer Care
Only personal data which is strictly necessary to manage or resolve a request made by
you will be processed.
The Site stores your browsing data anonymously for analytic and statistical purposes in order
to allow the Company to understand your interaction with the Site however we do not process
personal data to do so.
OUR PARTNERS AND WHO WE SHARE YOUR DATA WITH
The Company requires your personal data to achieve the purposes mentioned in this Privacy
Policy and the Company must give access to your personal data to third parties, both internal
and external, to the Company, in order to allow us to fulfil your purchase order. Therefore, your
personal data may be shared with the following and by requesting a purchase order you are
expressly authorising the Company to disclose and/or transfer such data to the following entities
and for the purpose of executing your purchase orders or requests:
– Financial institutions (such as Revolut);
– Credit institutions (such as any of the local banks registered with the MFSA in Malta);
– Logistic, transport and delivery service providers (such as couriers to deliver your
– Customer support representatives of the Company (to assist you with any queries or
problems you may have in connection with your purchase order);
– Group companies operating under the OK Group.
The Company discloses such personal data only if it is required and permitted to do so by law or
we believe, in good faith, that such action is necessary to:
(a) Comply with legal provisions;
(b) Protect and defend our rights and property;
(c) Protect against the misuse of unauthorised use of the Site and its content; or
(d) Protect the personal safety or property of the users or that of the public.
The Company will hold and store your personal data for no longer than is necessary bearing in
mind the purpose for which we first collected the data. The Company may however keep your
data for longer if it cannot be deleted for legal or regulatory reasons including:
– Responding to your purchase order requests or queries, complaints or questions;
– Compliance with tax or VAT reporting requirements;
– Maintaining records according to rules which apply to the Company;
– Establishing, bringing or defending legal claims;
– Evidencing that the Company has treated you fairly.
USER DATA RIGHTS
We undertake to keep your personal data confidential and to ensure that you may exercise your
rights. The request to exercise any of your rights may be made to the Data Controller of the
Company in writing at no expense setting out the reason for your request and the right you wish
The Company will provide you with information following any reasonable request for data subject
access. The Company will seek to ensure that the data is kept in an accessible format to
facilitate access by the data subject.
In certain circumstances you have the right to request a copy of your personal information from
the Company or to have that information passed to an organisation of your choice in a format
that can be easily re-used.
Verification and Rectification
You may write to us to request us to rectify the personal data that we hold. You hereby
guarantee that the personal data provided to the Company are true and accurate and undertake
to notify us of any change or alteration of them. Any loss of damage to the Site or the Company,
or to any third party through the provision of erroneous, inexact or incomplete information on the
purchase request form, will be exclusively the responsibility of the user.
You may write to us to request us to erase the personal data that we hold to the extent that the
information is no longer necessary for the purpose for which the Company must hold it for
processing or when we are no longer legally allowed to process the information.
If you have given us your consent to process your data for any purpose, you have the right to
withdraw such consent at any time.
Right to file a claim
You have the right to file a claim before the responsible data protection regulatory authority in
Malta, that is, the the Office of the Information and Data Protection Commissioner in Malta:
complaint about the processing of your personal data, please contact us at any time:
(a) By post at The Director
Thumbelina Limited (C 46987)
4, Timber Wharf,
(b) By email on email@example.com
(c) By using the applicable contact form on the Site.
Any method listed above may be utilised in order to contact us in connection with this Privacy
Policy and/or any request concerning your personal data.