Privacy policy

This policy describes what thorix.shop collects, why, and who else handles it. It covers this website only.

Who is responsible

Thorix, a self-employed business registered in Malta, operated by Gabriel Debono (Owner and CEO). VAT number MT32097632. For anything in this policy, write to support@thorix.shop or ceo@thorix.shop.

What we collect, and why

Placing an order	Your name, email address, delivery address and what you ordered. We need these to take payment, build the order and ship it. Lawful basis: performance of a contract.
Contacting us	Your name, email address, your message, and an order number if you give one. Used only to answer you. Lawful basis: legitimate interest in replying to people who write to us.
Sending a Forge build	The specification you configured, plus your name and email so we can quote it. Treated the same as any other enquiry.
Payment details	None. Card details are entered on Stripe's own hosted checkout page and are never sent to, seen by, or stored on this website.

Cookies and storage

This site sets no cookies, runs no advertising or tracking pixels, and does not profile visitors. That is why you are not being asked to accept anything.

Your basket is kept in your own browser's local storage so it survives a page reload. It never leaves your device except when you start checkout, and it holds only product identifiers and quantities. Under the ePrivacy rules this is storage that is strictly necessary for a service you asked for, so it does not require consent. Clearing your browser data removes it.

Stripe sets its own cookies on its checkout pages, which are governed by Stripe's privacy policy, not this one.

Who else processes your data

We use a small number of providers to run the shop. Each acts on our instructions under a data processing agreement.

Stripe	Payment processing and card handling. Stripe Payments Europe is based in Ireland; Stripe, Inc. is in the United States.
Supabase	The database holding products and orders. The database itself is hosted in the European Union (eu-west-1, Ireland). Supabase Inc. is a United States company, so access from outside the EU is possible under its standard contractual clauses — we state this because it is a transfer you are entitled to know about.
Cloudflare	Hosting and content delivery for this website. Cloudflare, Inc. is a United States company.
Resend	Delivers the emails we send you and the notifications we send ourselves.
Carriers	Your delivery address is passed to the carrier handling your parcel, such as DHL or UPS.

We do not sell your data, and we do not share it with anyone for advertising.

How long we keep it

Order records are kept for as long as Maltese tax and accounting law requires us to retain them. Contact messages are kept while we deal with your query and for a reasonable period afterwards in case you follow up, then deleted.

Your rights

Under the GDPR you can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop processing it, or ask for it in a portable format. Write to support@thorix.shop and we will respond within one month.

Deleting an order record is not always possible while we are still legally required to keep it for tax purposes. If that applies we will tell you which records we must keep and why.

If you are not satisfied with how we have handled your data, you can complain to the Office of the Information and Data Protection Commissioner in Malta.

Changes

If this policy changes we update this page. Material changes affecting existing customers will also be emailed.