Privacy notice

Who is responsible

Marioara Rubei, trading as CuddleCuts, is the data controller for the information described here. Our address is 2 Triq San Franġisk, Ħal Balzan BZN 1420, Malta.

Send privacy questions or requests to team@cuddlecuts.mt, or write to us at the address above.

Appointments and client records

When you book, we collect your name, email, contact details, pet information, selected services, appointment time and any care notes you provide. We keep appointment history, service notes, payment status and records of changes to bookings.

We use these details to arrange and provide grooming, manage changes and cancellations, contact you about your appointment and maintain client records. The legal basis is performing our contract with you, or taking steps you request before booking. Required fields are identified on the form; without them we cannot complete an online booking.

Relevant pet health and handling information helps us plan safe care. Please do not include your own medical information, identity documents or unrelated sensitive information in booking notes.

Malta's pet-grooming regulations require a register of services and dates, pet identification and descriptions, and owner or keeper identification and contact information. Information needed for that register is collected separately at check-in under our legal record-keeping obligation. It is not requested by the service finder.

Payments and service messages

Where an online deposit is collected, Stripe processes the payment. We receive payment identifiers, amounts and status, not your full card details. Stripe also processes information for its own fraud prevention and regulatory obligations under its privacy policy.

Appointment confirmations, reminders, collection updates and cancellation messages concern the service you booked. When email delivery is enabled, Resend receives your email address and the message content to deliver these messages. Emails may include your appointment, pet name and selected service; do not forward private booking-management links.

If you join the waiting list, we use the details and date preferences you submit to contact you about a suitable opening. Joining is not a booking. You can ask us to remove you at any time.

Using the website

Our hosting and infrastructure providers process technical information such as IP addresses, requested pages, browser information and security logs. We use this information in our legitimate interests in preventing abuse, investigating errors and operating the website.

The service finder uses answers in your browser to suggest a service. It does not submit those answers as a customer record. With analytics consent, a broad recommendation event may be recorded, but not the individual answers.

Optional analytics loads only after you agree. Read the cookie notice for browser storage and providers. Cookie choices lets you change or withdraw that choice.

Separately, and only with your marketing consent, the Meta Pixel reports website activity such as a page view, a started booking and a paid deposit to Meta Platforms Ireland, so we can measure which of our Facebook and Instagram posts lead to bookings. Meta can link that activity to your account there and use it for advert measurement and targeting, acting as an independent controller. We never send names, contact details, pet names or form answers. Rejecting marketing means the pixel is never loaded and Meta receives nothing from this site.

Enquiries, photographs and marketing

We use enquiries and correspondence to respond to you and keep a record of matters agreed. This is necessary for booking-related requests or for our legitimate interests in handling enquiries and resolving concerns.

Publicity photographs require separate permission. Refusing does not affect your appointment. Where a person is identifiable, we rely on their consent to publish their image. You can withdraw consent by emailing us; withdrawal does not affect lawful use before that point. We cannot remove copies held by other people.

Booking does not subscribe you to promotional email. Any consent-based marketing must be separately agreed and can be withdrawn. We do not sell personal information.

Who handles information

Access is limited to the salon and service providers needed to operate it. Website hosting is provided by Vercel and the production booking database uses Neon Postgres. We also use email services, and payment and messaging providers when enabled. Where you have consented to marketing, Meta Platforms Ireland receives website activity through the Meta Pixel. Professional advisers, payment providers or public authorities may receive information where necessary for accounting, a dispute or a legal requirement.

If veterinary assistance is needed, we may share relevant pet, owner and emergency-contact information with a veterinary service. Only information needed for the situation should be shared.

Some providers operate outside the European Economic Area. International processing must use an applicable adequacy decision or other safeguards, such as the European Commission's standard contractual clauses. Contact us for details of the arrangements relevant to your information. A European database location does not by itself mean every provider processes data only in Europe.

How long information is kept

Required grooming-register records must be kept for at least 12 months. We also consider ongoing appointments, the need to maintain an accurate care history, outstanding payments, complaints and applicable legal obligations when deciding whether a record is still needed. Records are not automatically deleted after the minimum period.

Enquiries are kept while needed to answer the request and resolve related matters. Payment and accounting records follow applicable record-keeping requirements. Photo permissions are kept while an image is used and as needed to document the permission. Information subject to a dispute or legal hold may need to be kept longer.

You can request deletion. We assess whether information can be removed or whether a specific legal or operational reason requires it to be retained. Website storage durations are set out in the cookie notice.

CCTV in the salon

CCTV cameras are installed in the salon, but they do not record continuously. A recording exists only where someone has deliberately started one, so most of the time no footage of your visit is created at all. Where a recording is made, it is kept for 10 days and then deleted.

Regulation 6(6) of S.L. 439.25 requires grooming-table sessions to be recorded where the owner or representative is not present with full visual access throughout. The retention period specified for those recordings is 10 days. This legal requirement is separate from publicity-photo consent.

For information about the areas recorded, footage held or a recording involving you, email team@cuddlecuts.mt with the relevant date and approximate time. We may need to verify your identity and protect the privacy of other people when responding. Footage may be disclosed where legally required, including to the Animal Welfare Directorate.

Your rights and complaints

Subject to the applicable conditions, you can request access, correction, deletion, restriction or portability of your information, and object to processing based on legitimate interests. You can withdraw consent at any time without affecting earlier lawful processing.

Email team@cuddlecuts.mt to make a request. We may ask for proportionate identity checks. We normally respond within one month; if a lawful extension is needed, we will explain why. Some records cannot be erased while a legal retention obligation applies.

You can complain to Malta's Information and Data Protection Commissioner, or another competent supervisory authority.

We do not use solely automated decision-making that produces legal or similarly significant effects. The service finder is a recommendation, and grooming decisions are discussed with you.

Updates to this notice

We update this notice when our services or data handling change. The date at the top identifies the current version. Where required, we will notify affected customers about a material change.