Privacy Policy

Last updated: 26 October 2026

This Privacy & Cookie Policy explains how KURA Skincare collects, uses and protects your personal data when you visit kuraskincare.mt, create an account, place an order or contact us. We process personal data in line with the EU General Data Protection Regulation (GDPR) and the Maltese Data Protection Act (Cap. 586).

1. Who we are

The data controller responsible for your personal data is:

Mario Schembri, trading as KURA Skincare
Green Grove, 67, Triq il-Fraxxnu
San Ġiljan STJ 1674, Malta
Email: [email protected]
Phone: +356 9947 7110

If you have any questions about this policy or how we handle your data, please contact us using the details above.

2. What personal data we collect

Order and account details: your name, billing and delivery address, email address, phone number, order history and any notes you add at checkout. If you create an account, we also store your login details (your password is stored encrypted and we cannot see it).
Payment information: payments are processed securely by Stripe. Your full card details are entered directly with Stripe and are never stored on our website. We only receive limited information such as the payment status and the last four digits of your card.
Newsletter sign-ups: your name and email address if you subscribe to updates from KURA.
Messages you send us: anything you share when you contact us by email, phone, WhatsApp or through the website.
Technical and security data: your IP address, browser type, device information and the pages you visit, which are logged automatically to keep the website running and secure.

3. Why we use your data and our legal basis

To process and deliver your orders, manage returns and refunds, and send order confirmations and updates. Legal basis: performance of a contract.
To manage your customer account if you choose to create one. Legal basis: performance of a contract.
To keep invoices and accounting records as required by law. Legal basis: legal obligation.
To send you our newsletter, tips and offers, only if you have subscribed. You can unsubscribe at any time using the link in every email or by contacting us. Legal basis: consent.
To answer your questions and provide customer support. Legal basis: legitimate interests.
To protect the website, our customers and ourselves against fraud, spam and malicious activity. Legal basis: legitimate interests.

We do not sell your personal data, and we do not use it for automated decision-making or profiling.

4. Who we share your data with

We only share your data with trusted service providers who need it to help us run our shop, and only as much as they need:

Stripe – to process card and other online payments securely and prevent fraud.
Delivery and courier services – your name, address and phone number, so your order can be delivered.
Our website hosting provider – which stores the website and its data.
Our email delivery service – used to send order confirmations, account emails and newsletters.
Wordfence (Defiant Inc.) – a security service that protects the website from attacks, which may process IP addresses for this purpose.
Authorities or professional advisers – where required by law, or to establish or defend legal claims.

Some of these providers may process data outside the European Economic Area (for example in the United States). Where this happens, the transfer is protected by appropriate safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

5. How long we keep your data

Orders and invoices: for as long as required by Maltese tax and accounting laws.
Customer accounts: until you ask us to delete your account. Inactive accounts may be deleted after a long period of inactivity.
Newsletter subscriptions: until you unsubscribe.
Messages and enquiries: for as long as needed to deal with your request, and normally no longer than 2 years.
Security logs: for a short period, only as long as needed to keep the website secure.

6. Cookies

Cookies are small text files stored on your device when you visit a website. When you first visit our website, a cookie banner lets you accept or reject non-essential cookies. You can change your choice at any time by clicking the cookie icon on the website.

Strictly necessary cookies are always active because the website cannot work properly without them. These include cookies that:

remember the products in your cart and your checkout session (WooCommerce);
keep you logged in to your account;
remember your cookie preferences;
protect the website and the checkout against fraud and attacks (for example Stripe and Wordfence security cookies).

Functional, analytics and marketing cookies are only set if you give your consent through the cookie banner. At the moment we do not use analytics or advertising cookies. If this changes, they will only be used with your consent and this policy will be updated.

Some pages may show content from other websites, such as a Google Maps map on our Contact page. These services may set their own cookies, which are covered by their own privacy policies.

You can also block or delete cookies through your browser settings. Blocking strictly necessary cookies may stop parts of the website, such as the cart and checkout, from working.

7. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data deleted, where we are not required to keep it;
restrict or object to how we use your data;
receive your data in a portable format;
withdraw your consent at any time, for example by unsubscribing from our newsletter or changing your cookie preferences.

To use any of these rights, contact us at [email protected]. We will reply within one month. You can also view and update many of your details yourself in My Account.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information and Data Protection Commissioner (IDPC) in Malta – idpc.org.mt.

8. How we protect your data

Our website uses an encrypted (HTTPS) connection, payments are handled by Stripe, and the website is protected by a security firewall. Only authorised people have access to your data. While no website can guarantee complete security, we take reasonable steps to keep your data safe.

9. Children

Our website and products are not intended for children under 16, and we do not knowingly collect personal data from them. If you believe a child has given us their personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. The latest version will always be available on this page, with the date it was last updated shown at the top.