Last updated: 6 January 2026

This Privacy Policy explains how Draco Gifts (“we”, “us”, “our”) collects, uses, stores, and protects your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable EU data protection laws.

The data controller responsible for your personal data is:

Draco Gifts
29 Triq l-Għenba, Ħ’Attard, Malta
Email: info@dracogifts.com

This Privacy Policy applies to all users located in the European Union who access or place orders through our website.

We may collect and process the following categories of personal data:

• Full name
   
• Email address
   
• Telephone number
   
• Billing and delivery address
   

• Products purchased
   
• Order history
   
• Payment confirmation (no full card details stored)
   

• Uploaded photographs
   
• Custom text, names, dates, and messages
   
• Design instructions submitted by the customer
   

• IP address
   
• Browser type and device information
   
• Cookies and usage data
   

We process personal data based on one or more of the following legal grounds:

• Performance of a contract – to fulfil orders and deliver products
   
• Legal obligation – accounting, tax, and regulatory compliance
   
• Legitimate interest – improving services and website functionality
   
• Consent – marketing communications and non-essential cookies
   

Your personal data is processed for the following purposes:

• Processing and fulfilling orders
   
• Customising products according to customer instructions
   
• Communicating order status and customer service inquiries
   
• Shipping and delivery
   
• Fraud prevention and security
   
• Compliance with legal obligations
   

We may share personal data with trusted third parties, including:

• Payment service providers
   
• Courier and logistics companies
   
• Website hosting and IT service providers
   

All third parties are contractually required to process data in compliance with GDPR.

We do not sell or rent personal data to third parties.

Personal data is processed primarily within the European Union.

Where data is transferred outside the EU (e.g. cloud or IT services), such transfers are protected by appropriate safeguards, including:

• Standard Contractual Clauses (SCCs)
   
• GDPR-compliant data processing agreements
   

Personal data is retained only for as long as necessary:

• Order and transaction data: as required by tax and accounting law
   
• Customisation data: until order completion and any warranty period
   
• Marketing data: until consent is withdrawn
   

We implement appropriate technical and organisational measures to protect personal data, including:

• Secure servers
   
• Access controls
   
• Encrypted communications where applicable
   

However, no system can guarantee absolute security.

As an EU data subject, you have the right to:

• Access your personal data
   
• Request correction of inaccurate data
   
• Request deletion (“right to be forgotten”)
   
• Restrict processing
   
• Object to processing
   
• Data portability
   
• Withdraw consent at any time
   

Requests can be made by contacting info@dracogifts.com.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority in the EU.

For Malta, this is:
Office of the Information and Data Protection Commissioner (IDPC)

Our website uses cookies and similar technologies to:

• Ensure proper website functionality
   
• Analyse website traffic
   
• Improve user experience
   
• Support marketing activities
   

You may manage cookie preferences via the cookie banner or your browser settings.

Our website and services are not intended for children under 16 years of age.
We do not knowingly collect personal data from children.

We reserve the right to update this Privacy Policy at any time.
Changes will be posted on this page with an updated revision date.

For any questions regarding this Privacy Policy or your personal data, contact:

📧 info@dracogifts.com