Privacy Policy.

Your privacy matters to us. This Privacy Policy explains what personal data we collect when you visit our website, book a table or contact us, why we collect it, and what rights you have under the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Data Protection Act (Chapter 586 of the Laws of Malta).

2. Visiting our website

When you visit our website, our hosting provider automatically records technical information in server log files. This may include your IP address, the date and time of access, the page visited, your browser type and operating system, and the referring website.
We use this data only to deliver the website, ensure its stability and security, and detect misuse. The legal basis is our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR). Log data is not combined with other data and is deleted after a short period, unless it is needed to investigate a security incident.

3. Table reservations

When you book a table using the form on our Contact page, we collect:

• your full name and phone number (required)
• your email address (optional)
• the date, time and number of guests
• any special requests you choose to share

We use this data only to manage and confirm your reservation and to contact you about it. The legal basis is the performance of a contract or pre-contractual steps at your request (Art. 6(1)(b) GDPR).

Allergies and dietary requirements: if you tell us about allergies or other health-related needs, we process this information only to prepare your visit safely, based on your explicit consent (Art. 9(2)(a) GDPR). You can withdraw this consent at any time.

4. Contacting us by phone, email or social media

If you call us, email us or send us a message via Facebook or Instagram, we process the details you provide (such as your name, contact details and the content of your message) to answer your enquiry. The legal basis is our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR) or, where your enquiry relates to a booking, Art. 6(1)(b) GDPR. Messages sent via social media are also processed by the respective platform under its own privacy policy.

5. Cookies

Our website does not use analytics, advertising or tracking cookies, and we do not use any third-party tracking tools. The site only uses technical browser storage that is strictly necessary for it to display and function correctly. Because no optional cookies are used, no cookie consent banner is required.
Fonts, icons and images are hosted on our own server, so no data is sent to third-party font or image services when you load our pages.

6. Links to third-party services

Our website contains links to external services, including Facebook and Instagram (Meta Platforms Ireland Ltd.), Google Maps (Google Ireland Ltd.) and Bolt Food (Bolt Technology OÜ). These are simple links: no data is transferred to these providers until you click on a link. Once you visit their websites or apps, their own privacy policies apply.

7. Food delivery via Bolt Food

If you order our food through Bolt Food, your order is placed on the Bolt platform, and Bolt is responsible for the personal data processed in its app and on its website. We receive only the order information needed to prepare and hand over your order (for example, the items ordered, any notes you add and the name shown on the order). Please see Bolt’s privacy information for details.

8. Who receives your data

We do not sell, rent or trade your personal data. Your data may be shared only with:

• our website hosting and IT service providers, who process data on our behalf under a data processing agreement (Art. 28 GDPR);
• public authorities, where we are legally required to do so (for example, tax authorities).

9. Transfers outside the EU/EEA

We do not intend to transfer your personal data to countries outside the European Union or European Economic Area. If a service provider processes data outside the EU/EEA, we will make sure that appropriate safeguards are in place, such as an adequacy decision of the European Commission or the EU Standard Contractual Clauses.

10. How long we keep your data

We keep personal data only for as long as necessary for the purpose it was collected for:

• reservation data is deleted after your visit, at the latest 12 months after the reservation date, unless we need it to resolve a dispute;
• allergy and dietary information is deleted after your visit;
• enquiries by email or message are deleted once they are fully answered, unless they relate to an ongoing matter;
• data we must keep under Maltese tax and accounting laws is retained for the legally required period.

11. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict the processing of your data (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on our legitimate interests (Art. 21);
• withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3)).

To exercise any of these rights, please email us at kayapubmalta@gmail.com. We will respond within one month.

12. Right to lodge a complaint

If you believe that we process your personal data unlawfully, you have the right to lodge a complaint with the supervisory authority in Malta:

Information and Data Protection Commissioner (IDPC)
Floor 2, Airways House, Triq il-Kbira, Tas-Sliema SLM 1549, Malta
Phone: +356 2328 7100
Email: idpc.info@idpc.org.mt
Website: idpc.org.mt

You may also contact the supervisory authority in the EU country where you live or work.

13. Security and changes to this policy

We use appropriate technical and organisational measures to protect your data, including an encrypted (HTTPS) connection to this website. We may update this Privacy Policy when our services or legal requirements change. The current version is always available on this page.

Last updated: 22 September 2026