Privacy Policy

This Privacy Policy explains how GoFish, operated by Tubertini Malta (“we”, “us”, “our”), collects, uses, stores, and protects your personal data when you visit our website at gofish.mt, create an account, or place an order.

We are committed to protecting your privacy and processing your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Data Protection Act (Chapter 586 of the Laws of Malta), and all other applicable data protection legislation.

By using our Website, you acknowledge that you have read and understood this Privacy Policy.

The data controller responsible for processing your personal data is:

If you have any questions or concerns about how your personal data is handled, you may contact us using the details above.

We may collect and process the following categories of personal data:

• • Identity data: First name, last name, and username.
• • Contact data: Email address, phone number, and delivery address.
• • Account data: Login credentials (passwords are encrypted and never stored in plain text).
• • Transaction data: Details of orders you have placed, including products purchased, quantities, prices, and payment method.
• • Technical data: IP address, browser type and version, device information, operating system, time zone, and referral source.
• • Usage data: Information about how you use our Website, including pages visited, time spent on pages, and navigation paths.
• • Communication data: Messages and enquiries submitted through our contact forms or support system.
• • Cookie data: Information collected through cookies and similar tracking technologies (see our Cookie Policy for details).

We process your personal data only where we have a lawful basis to do so under the GDPR. The lawful bases we rely on are:

• • Contract performance (Art. 6(1)(b) GDPR): To process and fulfil your orders, manage your account, provide customer support, handle returns and refunds, and communicate with you regarding your purchases.
• • Legitimate interest (Art. 6(1)(f) GDPR): To improve our Website and services, detect and prevent fraud, maintain security, and analyse usage patterns to enhance user experience.
• • Consent (Art. 6(1)(a) GDPR): To send you marketing communications, set non-essential cookies, and provide personalised product recommendations. You may withdraw your consent at any time.
• • Legal obligation (Art. 6(1)(c) GDPR): To comply with legal requirements, such as maintaining financial and tax records, and responding to lawful requests from authorities.

Our Website uses cookies and similar tracking technologies to distinguish you from other users, improve your experience, and gather analytical data. We categorise cookies as:

• • Strictly necessary cookies — essential for website functionality (e.g., shopping cart, authentication).
• • Analytics and performance cookies — used to collect anonymous usage statistics.
• • Marketing and advertising cookies — used for personalised advertising and social media integration.

You can manage your cookie preferences at any time through our cookie consent banner or by visiting our Cookie Policy for detailed information on each cookie category.

We do not sell, rent, or trade your personal data. We may share your data with the following categories of third parties only where necessary:

• • Delivery and logistics partners: To fulfil and deliver your orders across Malta and Gozo.
• • Payment processors: To securely process your payments. We do not store your full payment card details on our servers.
• • Hosting and infrastructure providers: Our website is hosted on secure cloud infrastructure that may process data on our behalf.
• • Analytics services: To help us understand website usage (data is anonymised where possible).
• • Legal and regulatory authorities: Where required by law or to protect our legal rights.

All third-party service providers are contractually obligated to process your data in accordance with applicable data protection legislation and only for the specific purposes outlined above.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our general retention periods are:

• • Account data: Retained for the lifetime of your account and for up to 2 years after account closure.
• • Order and transaction data: Retained for 7 years to comply with Maltese tax and accounting obligations.
• • Communication data: Retained for up to 3 years after your last interaction with our support team.
• • Technical and usage data: Retained for up to 26 months.
• • Marketing consent records: Retained for as long as you remain subscribed, plus 1 year after unsubscription for record-keeping purposes.

When data is no longer needed, it is securely deleted or anonymised.

Under the GDPR, you have the following rights regarding your personal data:

• • Right of access (Art. 15): You have the right to request a copy of the personal data we hold about you.
• • Right to rectification (Art. 16): You have the right to request correction of any inaccurate or incomplete personal data.
• • Right to erasure (Art. 17): You have the right to request deletion of your personal data, subject to certain legal exceptions.
• • Right to restriction (Art. 18): You have the right to request that we restrict the processing of your personal data in certain circumstances.
• • Right to data portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• • Right to object (Art. 21): You have the right to object to the processing of your personal data based on legitimate interest or for direct marketing purposes.
• • Right to withdraw consent (Art. 7): Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact us at gofishmalta@gmail.com. We will respond to your request within 30 days.

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction. These measures include:

• • Encryption of data in transit using SSL/TLS protocols.
• • Secure password hashing and storage.
• • Regular security assessments and monitoring.
• • Access controls limiting data access to authorised personnel only.
• • Secure cloud infrastructure with industry-standard protections.

While we strive to use commercially acceptable means to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

Your personal data may be transferred to, and processed in, countries outside the European Economic Area (EEA) by our service providers. Where such transfers occur, we ensure that appropriate safeguards are in place, including:

• • Transfers to countries recognised by the European Commission as providing an adequate level of data protection.
• • Use of Standard Contractual Clauses (SCCs) approved by the European Commission.
• • Ensuring that recipients are bound by equivalent data protection obligations.

Our Website is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at gofishmalta@gmail.com and we will take steps to delete such information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Any updates will be posted on this page with a revised “Last updated” date. We encourage you to review this Privacy Policy periodically. Your continued use of the Website after changes are posted constitutes your acceptance of the revised policy.

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the relevant supervisory authority. In Malta, this is:

We encourage you to contact us first so that we can try to resolve your concern directly.

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us: