1. Purpose

This Data Protection page describes how MozzaRush protects personal information collected when people browse our menu and order from our pizzeria. We operate from St Paul's Bay, Malta. Orders, table requests, allergy notes, and messages to our team all pass through the safeguards described here. The page sits alongside our Privacy Policy, which explains what we collect and why, and our Terms of Service, which explain the purchase itself.

Protection is a daily practice, not only a document. Staff who take an order, bake a pizza, or answer a phone call are expected to handle names and addresses with care. We review these practices when we change a supplier, a form, or a storage tool. The date at the top of this page shows the latest review.

2. What We Protect

Protected information includes customer names, email addresses, phone numbers, delivery addresses, order history, allergy and dietary notes, payment references, messages to our team, and technical data such as IP address and browser type. We do not store a complete card number or card security code. Those details stay with the payment provider that takes the payment.

3. Principles

We collect only what a stated purpose needs, such as preparing a pizza, delivering an order, or answering a question about ingredients. We use information lawfully, fairly, and openly. We keep it accurate where you help us with corrections. We store it only while we need it, and we protect it against unauthorised access, loss, and misuse. We can explain these points in plain language if you write to us.

4. Security Measures

Measures include encrypted website forms, controlled storage of order records, software updates, and monitoring for unusual access. Card payments are taken by specialist providers that follow industry standards. Staff open order lists only through controlled systems so that phone numbers and addresses are not left on shared screens in the kitchen. Paper order slips, if used during a busy service, are collected at closing and securely disposed of, and are never left with a courier after delivery.

5. Access Control

Only people who need customer information for their work may see it, for example order handling, kitchen preparation, delivery, finance, or customer care. Access is reviewed when roles change and removed when it is no longer needed. Anyone who handles personal information must follow confidentiality rules, including a rule that a customer's address and phone number are discussed only for that customer's order.

A cook may see the items and any allergy note without needing the customer's full address. A finance colleague may see the amount and the payment reference without needing to browse unrelated messages. We separate those views where the system allows it. Shared inboxes and phone lines are used only by people whose job includes answering customers.

6. Service Providers

We work with payment processors, delivery couriers, hosting providers, ordering software suppliers, and email services so that your food can be prepared and delivered. We share only what each party needs. A courier may receive a name, address, and phone number. A payment provider receives the payment details. Partners must protect the information and use it only for the task we set. We do not sell personal information, and we do not allow a partner to use an address for its own marketing.

Before we rely on a new provider for order data, we look at where the data will sit, who can open it, and how long the provider keeps it. Contracts require confidentiality and a duty to tell us if they become aware of a breach that affects our customers. We keep the list of providers under review and stop sharing with one that no longer works on our orders.

7. Storage and Retention

Some technology providers may store or process information on servers outside Malta. When that happens we take reasonable steps required by data protection law, including choosing reputable providers and using appropriate transfer safeguards. Transfers linked to email confirmations or page performance are limited to what is necessary to operate the ordering website. We keep records only as long as needed for orders, accounting, and complaints, then delete or anonymise them.

8. Incidents and Requests

If we learn of a security incident that may affect personal information, we investigate promptly, contain it, and assess the risk. Where the law requires it, or where there is a significant risk to rights, we will notify affected customers and the Information and Data Protection Commissioner in Malta without undue delay, explain what happened in plain language, and describe steps they can take. We will also review whether order lists were involved and reset access where that is appropriate.

9. Training, Updates, and Contact

Everyone who handles order information is expected to understand why protection matters in a restaurant that takes names, phone numbers, and addresses every day. We give practical guidance on email, ordering systems, and delivery lists, and we ask the team to report risks early. Accountability sits with the management of MozzaRush, which oversees how information is collected, stored, shared, and deleted across browsing, payment, cooking, and delivery.

We review these practices regularly and may update this page when our menu, technology, or legal duties change. Please read the page again after an update so you know the practices that apply to order information held by MozzaRush.

To submit a data protection request or report a suspected incident, contact MozzaRush and write Data protection in the message. Include your name and any order number. Do not send a full card number.

Email: [email protected]

Phone: +35677514267

Address: St Paul's Bay, Malta