ATLANTIC WATER HEATERS

Privacy Notice

How BJG Imports Co Limited collects, uses and protects personal data

This Privacy Notice explains how we process personal data when you visit our website, create an account, buy goods, request delivery, installation or after-sales support, or otherwise contact us.

It is issued in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, or “GDPR”), Malta’s Data Protection Act (Chapter 586 of the Laws of Malta) and, where applicable, the Processing of Personal Data (Electronic Communications Sector) Regulations (Subsidiary Legislation 586.01).

1. Who we are

BJG Imports Co Limited is the data controller for the processing described in this Notice. This means that we determine why and how your personal data is processed.

• Legal name: BJG Imports Co Limited
• Company registration number: C 106637
• Trading name: Atlantic Water Heaters
• Registered office: 67, “Our Dream”, Triq In-Nutar Zarb, Attard ATD 9041, Malta
• Email: info@atlanticwaterheaters.com.mt

2. Personal data we collect

“Personal data” means information relating to an identified or identifiable individual. Depending on how you deal with us, we may collect the following categories:

• Identity and contact data: name, billing and delivery address, email address, telephone number and, where relevant, details of an authorised contact.
• Account data: username, encrypted password, account preferences and order history.
• Order and service data: products ordered, delivery or installation instructions, warranty and repair information, returns, refunds and customer-support records.
• Payment and transaction data: billing information, payment method, payment status, transaction references and fraud-prevention information. Payment-card data may be collected directly by the payment service provider used at checkout; in that case, we receive payment confirmation or limited transaction details rather than full card details.
• Communications data: messages, emails, telephone enquiries, reviews, complaints and any information you choose to provide when contacting us.
• Technical and usage data: IP address, device and browser information, pages viewed, referring URLs, approximate location derived from IP address, timestamps, diagnostic data and interactions with the website or advertising.
• Cookie and preference data: cookie identifiers, consent choices, shopping-cart information, login state and marketing preferences.

How we obtain the data

We obtain personal data:

• directly from you, including when you create an account, place an order, request a service, contact us or submit a review;
• automatically from your device through cookies and similar technologies; and
• from service providers and business partners, such as payment providers, delivery or installation providers, fraud-prevention services, analytics providers and advertising platforms, where permitted by law.

3. Why we process personal data and our lawful bases

We process personal data only when a lawful basis under the GDPR applies. More than one basis may apply to the same activity.

To provide products and services

We process identity, contact, account, order, service, payment and communications data to:

• create and manage your account;
• process orders and payments;
• arrange delivery, installation, repair, returns and refunds;
• provide warranty and after-sales support; and
• communicate with you about an order, appointment or service request.

Lawful basis: performance of a contract with you, or taking steps at your request before entering into a contract.

To answer enquiries and manage customer relationships

We use contact and communications data to respond to questions, prepare quotations, handle complaints, manage reviews and improve customer service.

Lawful basis: our legitimate interests in operating the business, responding to customers and improving our services; or steps taken at your request before entering into a contract.

To meet legal and regulatory obligations

We process order, transaction, warranty and communications records as needed for accounting, taxation, consumer-protection, product-safety, recall, regulatory, court-order and other legal requirements.

Lawful basis: compliance with a legal obligation.

To secure the website and protect the business

We use account, transaction, technical and usage data to authenticate users, maintain website security, detect and prevent fraud or abuse, troubleshoot faults, enforce our terms and establish, exercise or defend legal claims.

Lawful basis: our legitimate interests in protecting customers, our systems and our legal rights; and, where applicable, compliance with a legal obligation.

To understand and improve the website

With your consent where required, we use analytics technologies to understand how visitors use the website, measure performance and improve content, products and customer journeys.

Lawful basis: consent for non-essential cookies and similar technologies. We may also use aggregated or effectively anonymised statistics that do not identify you.

To advertise and measure campaigns

With your consent where required, we and our advertising partners use identifiers and interaction data to measure advertising, understand conversions and show or limit relevant advertising on other services.

Lawful basis: consent for advertising cookies and similar technologies.

To send marketing communications

Where you have asked to receive marketing, or where applicable law otherwise permits it, we may use your contact details and preferences to send information about our products, services or offers. You may opt out at any time by using the unsubscribe method in the communication or contacting us.

Lawful basis: consent where consent is required; otherwise, our legitimate interests where electronic-marketing law permits the communication. Your right to object to direct marketing is absolute.

Our legitimate interests

When we rely on legitimate interests, we consider the necessity and proportionality of the processing and balance our interests against your rights and reasonable expectations. You may object as explained in section 10.

4. When you must provide personal data

Some information is required to create an account, process an order, arrange delivery or installation, comply with law, or respond to a service request. If you do not provide required information, we may be unable to complete the relevant transaction or service. Fields that are optional should be identified as such where the data is collected.

5. Cookies and similar technologies

The website uses cookies, pixels, local storage and comparable technologies. Some are set by us; others are set by third-party services integrated into the website.

• Strictly necessary technologies: support shopping-cart and checkout functions, account login, security, consent records and core website operation. These do not require consent where they are strictly necessary for a service you request.
• Analytics technologies: help us measure visits, traffic sources and website performance. Services used on the website may include Google Analytics, WordPress.com/Jetpack and WooCommerce analytics.
• Advertising technologies: help measure campaigns and advertising activity. Services used on the website may include Google Ads and Meta Pixel.
• Functional and embedded services: support features such as YouTube videos, WhatsApp/Chaty contact tools and Trustindex review content. These providers may receive technical and usage data when their content is loaded or used.

Except for technologies that are strictly necessary, we use or activate cookies and similar technologies only after obtaining the consent required by law. You should be able to accept or reject non-essential categories and later withdraw consent through the website’s Cookie Settings control. Withdrawing consent does not affect processing that occurred before withdrawal.

Browser settings can also block or delete cookies, but doing so may affect essential website functions. The cookie settings should provide current details of each cookie or technology, including its provider, purpose and duration.

6. Who receives personal data

We disclose personal data only where necessary and subject to appropriate safeguards. Recipients may include:

• website hosting, e-commerce, account, security, IT support, communications and cloud-service providers;
• payment processors, banks and fraud-prevention providers;
• delivery, logistics, installation, repair and warranty-service providers;
• analytics, advertising, video, messaging and review-platform providers, where the relevant technology is enabled lawfully;
• accountants, auditors, insurers, lawyers and other professional advisers;
• public authorities, regulators, courts, law-enforcement bodies or other parties where disclosure is required or permitted by law; and
• a purchaser, investor or adviser in connection with a proposed or completed sale, merger, restructuring or transfer of all or part of the business, subject to confidentiality and legal safeguards.

Some recipients act as our processors and may use personal data only on our instructions. Others, such as certain payment, advertising or platform providers, may act as independent controllers for their own processing. Their privacy notices explain that processing. We do not sell or rent personal data.

7. International transfers

Some service providers may process personal data outside Malta or the European Economic Area (“EEA”). When personal data is transferred to a country outside the EEA, we use a transfer mechanism recognised by the GDPR, such as:

• an adequacy decision adopted by the European Commission;
• European Commission standard contractual clauses, together with supplementary measures where required; or
• another lawful safeguard or a specific derogation available under the GDPR.

You may contact us for further information about the safeguards used for a relevant transfer. A copy may be provided subject to redaction where needed to protect confidential or security-sensitive information.

8. How long we retain personal data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, tax, product-safety, warranty, dispute-resolution and enforcement requirements. Retention is determined by the nature and sensitivity of the data, the risks associated with keeping it, the relevant relationship and applicable limitation or statutory periods.

• Account data: kept while the account remains active and afterwards for a limited period needed to address transactions, security, legal obligations or claims.
• Order, invoice, delivery, warranty and service records: kept for the periods required by applicable accounting, taxation, consumer, warranty, product-safety and limitation laws.
• Enquiries and complaints: kept until resolved and for a reasonable follow-up or claims period.
• Marketing data: kept until you withdraw consent, object, unsubscribe or the data is no longer needed. We may retain a minimal suppression record to respect an opt-out.
• Technical, security and cookie data: kept for the period necessary for security, diagnostics, consent management and the duration disclosed in the website’s cookie settings.

When retention is no longer justified, we delete or anonymise the data securely.

9. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include access controls, authentication, encryption in transit, security updates, backups and contractual controls for service providers. No system is completely secure, but we review safeguards in light of the risks and available technology.

10. Your data-protection rights

Subject to the conditions and exceptions in the GDPR, you may have the right to:

• obtain confirmation that we process your personal data and request access to it;
• have inaccurate data corrected and incomplete data completed;
• request erasure of personal data;
• request restriction of processing;
• receive certain personal data in a structured, commonly used and machine-readable format and transmit it to another controller (data portability);
• object to processing based on legitimate interests, including related profiling;
• object at any time to processing for direct marketing, including related profiling;
• withdraw consent at any time where processing relies on consent, without affecting the lawfulness of earlier processing; and
• not be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you, except where the law permits it and appropriate safeguards apply.

How to exercise your rights

Send your request to info@atlanticwaterheaters.com.mt. Please describe the request and the data or interaction concerned. We may ask for information reasonably necessary to verify your identity and protect personal data from unauthorised disclosure.

We normally respond within one month after receiving a valid request. The GDPR permits an extension of up to two additional months where necessary because of complexity or the number of requests; if so, we will inform you within the initial month. Rights are not absolute, and we will explain any lawful limitation or refusal. We do not ordinarily charge a fee, although the GDPR permits a reasonable fee or refusal for manifestly unfounded or excessive requests.

11. Automated decision-making

We do not currently make decisions about you based solely on automated processing that produce legal effects or similarly significant effects. If this changes, we will provide the information and safeguards required by law before the processing begins.

12. Children

The website and online shop are intended for adults. Purchases should be made by an adult with legal capacity to enter into the transaction. We do not knowingly seek personal data from children. If you believe a child has provided personal data to us without appropriate involvement of a parent or guardian, please contact us.

13. Third-party websites and services

The website may link to or embed services operated by third parties. We are not responsible for their independent websites or privacy practices. Review the relevant third party’s privacy notice before providing data or using its service.

14. Changes to this Notice

We may update this Notice when our processing, services or legal obligations change. The current version will be published on the website with a revised “Last updated” date. Where a change materially affects your rights or how we use personal data, we will take reasonable steps to bring it to your attention and obtain consent where required.

15. Contact and complaints

Questions, requests or complaints about this Notice or our processing should be sent to:

BJG Imports Co Limited
67, “Our Dream”, Triq In-Nutar Zarb
Attard ATD 9041, Malta

Email: info@atlanticwaterheaters.com.mt

You also have the right to lodge a complaint with Malta’s supervisory authority, the Office of the Information and Data Protection Commissioner (IDPC):

Office of the Information and Data Protection Commissioner
Floor 2, Airways House, Triq Il-Kbira
Tas-Sliema SLM 1549, Malta

Website and complaint information: idpc.org.mt/contact

Questions about privacy? Contact info@atlanticwaterheaters.com.mt and we will help.