Privacy Policy
How Panku Street Food collects, uses, and protects your personal information — in plain language, backed by the detail that matters.
1. Who we are
This Privacy Policy explains how Panku Street Food, operated by TTBL Ltd ("Panku", "we", "us", "our"), collects, uses, discloses, and safeguards your personal information when you visit our website at panku.mt, order food from our Sliema or Mriehel locations, sign up to hear from us, or otherwise interact with our business.
We are established in Malta and process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Malta's Data Protection Act.
2. Information we collect
Information you give us directly
- Contact details — name, email address, and phone number, when you fill in a contact or enquiry form, sign up for updates, or get in touch with us directly.
- Order details — when you order through Wolt, Bolt Food, or another third-party delivery partner, that platform collects your order and delivery information directly. We only receive what's necessary to fulfil your order (e.g. items ordered, delivery address, order notes).
- Correspondence — any information you provide when you contact us by email, phone, or social media.
Information collected automatically
- Usage data — pages visited, time spent on our site, referring/exit pages, browser type, device type, and approximate location, collected via Google Analytics.
- Technical data — IP address, browser type and version, and time zone setting, collected as part of standard web server logging and security monitoring.
3. How we use your information
We use the information we collect to:
- Respond to your enquiries and provide customer support
- Understand how visitors use our website, so we can improve it
- Send you updates or offers, if you've opted in to hear from us
- Maintain the security and proper functioning of our website
- Comply with our legal obligations, including tax and consumer protection law
We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.
4. Our legal basis for processing
Under GDPR, we rely on the following legal bases:
- Consent — for optional marketing communications and non-essential cookies, which you can withdraw at any time.
- Legitimate interests — for website analytics and security monitoring, balanced against your right to privacy.
- Contractual necessity — for handling enquiries or fulfilling requests you make directly to us.
- Legal obligation — for records we're required to keep under Maltese tax and business law.
6. Third parties & delivery partners
We work with the following categories of third-party services, each with their own privacy practices:
- Google Analytics & Google Tag Manager — website usage analytics. See Google's Privacy Policy.
- Google Maps — used to display our locations. See Google's Privacy Policy.
- Wolt & Bolt Food — when you order through these platforms, they act as independent data controllers for your order and payment information. Please refer to their own privacy policies for details on how they handle your data.
- Our website hosting provider — processes technical data as part of standard server operation and security.
We do not permit any third party to use data collected through our site for their own independent marketing purposes without your consent.
7. How long we keep your data
| Data type | Retention period |
|---|---|
| Contact form / enquiry submissions | Up to 12 months after last contact, unless a longer period is required to resolve your enquiry |
| Marketing mailing list | Until you unsubscribe or withdraw consent |
| Website analytics data | Up to 14 months (Google Analytics default), aggregated thereafter |
| Records required by law (e.g. invoicing) | As required under Maltese law, typically up to 10 years |
8. Your rights
Under GDPR, you have the right to:
| Right | What it means |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Ask us to correct inaccurate or incomplete data |
| Erasure | Ask us to delete your personal data, where applicable |
| Restriction | Ask us to limit how we use your data |
| Portability | Request your data in a portable, machine-readable format |
| Objection | Object to processing based on legitimate interests, including direct marketing |
| Withdraw consent | Withdraw previously given consent at any time, without affecting prior lawful processing |
To exercise any of these rights, contact us using the details below. You also have the right to lodge a complaint with Malta's Information and Data Protection Commissioner (IDPC).
9. Data security
We take reasonable technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction, including secure hosting, encrypted connections (HTTPS/SSL), and restricted access to personal data. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
10. Children's privacy
Our website and services are not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can remove it.
11. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will post the updated version on this page with a revised "Last updated" date. We encourage you to review this page periodically.
12. Contact us
If you have any questions about this Privacy Policy or how we handle your personal data, please get in touch:
Panku Street Food
Triq Censu Xerri, Sliema, Malta
Zone 3, Central Business District, Birkirkara, Malta
Phone: +356 7734 9234
Email: [email protected]