(Draft : Updating practically daily)

Who we are

What do we store

Anonymous browsing

Anonymous buying

Data collection

Apache log files


Right to be forgotten.
Right to access data.
Right to transfer information.
Data Protection Officer (DPO)
Data Breaches
Cloudflare, AWS, Google, Onesignal.
Security (AWS, Cloudflare, worpdress, patches).
Facebook and Google login.
Under 16s

Credit Cards

Richard Stallman has a concept of storing as little data as possible. That is, data that is stored can easily be abused or stolen (and therefore abused). Captain A. Caruana have a belief in this concept.

Who we are

Our website address is: https://www.captcaruana.com.

What do we store.

This membership scheme and online shop necessarily stores some information as all similar systems do. We only store information that you have voluntarily handed over. Information can be changed by you at any point from the “My Account” page.

Anonymous browsing

Please feel free to browser anonymously. We may need to update this section based on legislation.

Anonymous buying

You can certainly enter our physical stores and buy anonymously. Unfortunately, and we are really sorry about this (as customers ourselves of various products we sometimes want to be anonymous, so we understand you), given the type or products that we sell online we are unable to offer anonymous online buying at this stage. We might be able to come up with something in the future.

Apache log files

The webserver logs are rotated each week with 4 weeks storage resulting in a maximum of 5 weeks storage. Generally we would be logging your client IP address and the pages accessed. Currently we only see the CDN (see below) IP address but reserve the right to store the client IP address in future. If and when we do so we shall update this section.

– Right to transfer information.
GPDR includes the right to transfer information from one entity to another.
One would see how this works our in practice. This is going to be a complex one that will take many years for all the details to be worked out. We will adhere to any common practice under this directive.
CaptCaruana only holds basic personal information and information about purchases

Data Protection Officer (DPO)
There is a derogation on the DPO for SMEs that do not have, as their primary function, data processing and Captcaruana, Ten Green Bottles and NMArrigo fall in this category.
Nonetheless we have a representative that can be contacted [Log in to see].
DPOs must be appointed in the case of: (a) public authorities, (b) organizations that engage in large scale systematic monitoring, or (c)
organizations that engage in large scale processing of sensitive personal data (Art. 37).
If your organization doesn’t fall into one of these categories, then you do not need to appoint a DPO.

Cloudflare, AWS, Onesignal.

Hosting is on AWS (Amazon) and Google Cloud. A significant number of the web pages that you visit daily are.
Captcaruan.com and durexmalta.com are also behind Cloudflare. Like AWS and Google cloud, Cloudflare is a MAJOR internet player
Unlike a number of smaller sites that you visit daily we are more secure utilising end-to-end encryption.
It is technically possible (since the data centre is owned by these companies) that Amazon and Google access your data, however these players are not likely to compromise their cloud hosting offerings by acting stupidly.
Cloudflare does not (either in the Terms and conditions), nor have they been known to gather and collate personal information on the visitors to sites behind them. Cloudflare, however, is in a position to gather information about your location as well as IP address.

One signal.

OneSignal is a Push message notification service that we use. They make their money by collating information on which sites your browser has visited. They do not generally store personal information but in a “big data” way may be in a position to profile and garner this information. We do not have access to any personal information from this service and are only informed about the subscribed browser, the Country, time of first visit and last visit. We are not generally in a position to “unsubscribe” you from this push service since we do not generally have the information that correlated browser with a personal identity. You can unsubscribe from the Push messaging any time https://www.google.com.mt/search?q=unsubscribe+from+push+messaging

Please view their privacy policy here. https://onesignal.com/privacy_policy

All of the players have updated their privacy policies to comply with GDSP as well as the most stringent privacy policies.

– Facebook and Google login.
The option to log in via Facebook and/or Google is there primarily for your convenience.
Facebook and Google provide us with the most basic information, but most importantly, with a verified user.

We collect your public profile data only from your consent that you grant before initiating Social Login, from the social network used to login at our website.

This data includes your first name, last name, email address, link to your social media profile, unique identifier, social profile avatar. This data is used to create your user profile at our website. You can revoke this consent at any time by sending us an email.

– Under 16s.
It is not our expectation that under 16s are interested in the services we offer on this site.
Indeed under 16s will achieve nothing by registering and trying to gain points or accessing information on this site.
Our Delivery Personnel *WILL NOT* leave products with under 16s.

– Data Breaches
Data breaches which may pose a risk to individuals must be notified to the relevant authorities and DPA within 72 hours and to affected individuals without undue delay.
All our companies will strive to achieve this in case of a data breach, of which we have had none (at least that have been noticed or been notified of) in the company history.

What personal data we collect and why we collect it


When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.

An anonymised string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

Social Commenting :

We embed Facebook Comments plugin to allow you to leave comment at our website using your Facebook account. This plugin may collect your IP address, your web browser User Agent, store and retrieve cookies on your browser, embed additional tracking, and monitor your interaction with the commenting interface, including correlating your Facebook account with whatever action you take within the interface (such as “liking” someone’s comment, replying to other comments), if you are logged into Facebook. For more information about how this data may be used, please see Facebook’s data privacy policy: https://www.facebook.com/about/privacy/update

We use GooglePlus Comments widget at our website for you to be able to comment at our webpages using your GooglePlus account. From this interaction Google automatically collects and store certain information in server logs like IP address, device event information such as crashes, system activity, hardware settings, browser type, browser language, the date and time of your request, in accordance with their data privacy policy: https://policies.google.com/privacy


If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included, unless you have a specific purpose in doing so. Visitors to the website could otherwise download and extract the location data from images on the website.

Contact forms


If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you have an account and you log in to this site, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed. This is generally for your convenience, especially on the mobile, to avoid constant re-logins, and we suggest it.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Embedded content from other websites

We do not currently have embedded context on our site, though we reserve the right to. Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracing your interaction with the embedded content if you have an account and are logged in to that website.


Who we share your data with

How long we retain your data

If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognise and approve any follow-up comments automatically instead of holding them in a moderation queue.

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators (our I.T. department, in effect) can also see and edit that information.

What rights you have over your data

If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

Where we send your data

Visitor comments may be checked through an automated spam detection service. Currently we do not do this, but we reserve the right to do so in future. We will keep this section updated.

Your contact information

Additional information

How we protect your data

In this section you should explain what measures you have taken to protect your users’ data. This could include technical measures such as encryption; security measures such as two-factor authentication; and measures such as staff training in data protection. If you have carried out a Privacy Impact Assessment, you can mention it here too.

What data breach procedures we have in place

In this section, you should explain what procedures you have in place to deal with data breaches, either potential or real, such as internal reporting systems, contact mechanisms, or bug bounties.

What third parties we receive data from

If your website receives data about users from third parties, including advertisers, this information must be included in the section of your privacy policy dealing with third-party data.

What automated decision making and/or profiling we do with user data

If your web site provides a service which includes automated decision making – for example, allowing customers to apply for credit, or aggregating their data into an advertising profile – you must note that this is taking place, and include information about how that information is used, what decisions are made with that aggregated data, and what rights users have over decisions made without human intervention.

Industry regulatory disclosure requirements

If you are a member of a regulated industry, or if you are subject to additional privacy laws, you may be required to disclose that information here.

Credit Cards

Capt. A Caruana online shop uses Endeavour payment solutions, a Maltese company, for Credit Card processing. You can access their privacy policy here.