← Back

Terms & privacy

Last updated: 29 October 2026 (version 2026-10-29)

Membership

  • Membership of the Matcha Cha Cha club is free. You must be 16 or older. One account per person and per mobile number.
  • Your member card is personal. We may close accounts created with false identities, virtual numbers, automated sign-ups or any other abuse.

Opening offer

  • The first 200 people who join our free club and verify their mobile number receive: 1 free matcha latte (our standard size). Joining is free and requires no purchase.
  • One free drink per person and per mobile number, including if an account is deleted and created again. Not transferable, no cash value, cannot be exchanged.
  • Valid from 2 Nov 2026.
  • Each free matcha must be used within 7 days after the day you sign up (or after the opening day if you sign up before we open), until 11:59 pm Malta time on the last day. Example: sign up on 5 November, use it by 12 Nov, 11:59 pm. Your exact date is shown on your member card and in your welcome email, and we will never shorten it.
  • The offer stops once all 200 free matchas have been claimed.
  • Signature drinks, extra shots, alternative milks and add-ons are charged at the normal price.

Loyalty programme

  • Stamp card: 1 stamp per matcha or lemonade you pay for (coffee, water and food don't earn stamps), added by our staff when they scan your card (up to 3 stamps a day). 8 stamps = free classic matcha or lemonade, valid 60 days (signature drink: +€3). New members start with 1 welcome stamp. Free drinks (rewards, opening offer) don't earn stamps. Stamps on an unfinished card expire after 6 months without a paid drink.
  • Invite friends: a friend who joins with your link or code gets 2 bonus stamps when they buy their first matcha or lemonade (a paid one, not a free one). At that moment you get: free classic matcha, thanks for the invite (valid 60 days, signature drink: +€3), provided you have bought at least one drink yourself. Up to 5 rewards a month and 25 in total. One code per new member and per phone number, only at sign-up (it can't be added afterwards). Inviting yourself, fake or duplicate accounts are not allowed.
  • Monthly Challenge: visit us on 8 different days in a calendar month (a visit-day = a day when a paid drink is recorded on your card; days with only a free drink count for up to 3 days) and you get 3 bonus stamps, once per month, as soon as you reach it. Everyone who reaches the goal gets them: there is no ranking and no draw.
  • Badges are collectibles with no cash value.
  • Matcha Master of the month (leaderboard): optional, for members aged 18 or over who choose to join. Ranked by the number of days in the calendar month on which you bought a drink (one per day), never by the number of drinks. Shown under a secret name we generate, never your real name. Whoever has the most visit-days at the end of the month wins the Matcha Master title and a Matcha Cha Cha mug; in case of a tie, everyone at the top wins. No chance element, no purchase volume counted. We contact the winner(s) in the app and by email within 7 days after the end of the month; the prize must be collected at the bar within 30 days, otherwise it lapses (staff will see your first name when handing it over). You can leave at any time.
  • At most 2 free drinks per person per day. Rewards are personal, not transferable and have no cash value. Paid extras (extra shots, syrups, toppings beyond the reward) are charged at the normal price. A visit you have already used to reward someone cannot be counted twice.
  • We may correct mistakes (for example a stamp added by error) and cancel rewards obtained through abuse (scans without a purchase, duplicate accounts, collusion).
  • We may change or end the programme for a valid reason (for example legal, cost or abuse reasons). We will tell you by email and on this page at least 30 days before; during that time you can keep collecting and redeeming. Rewards already earned stay valid until their date. Deleting your account cancels unused stamps and rewards.

Complaints & law

Something wrong? Contact us first at matchachacha@thefullbellygroup.com. These terms are governed by Maltese law; you keep the protection of the mandatory consumer law of your country of residence. You can also contact the Malta Competition and Consumer Affairs Authority (mccaa.org.mt).

Privacy notice

Who we are

Matcha Cha Cha Ltd, C 123456, 42, St Paul’s Street, Valletta (operator of Matcha Cha Cha) is the controller of your personal data. Contact: matchachacha@thefullbellygroup.com.

What we collect

Your first name, email address, mobile number and its country; when you verified them and when you signed in; your rewards and when and at which counter they were used; your loyalty activity (the days and number of paid drinks recorded by our staff, stamps, badges, Monthly Challenge), who invited you or whom you invited, and, if you join the leaderboard, your secret name; your marketing choices with their date, the wording you saw and a pseudonymised IP address; your sign-in sessions; security logs with a pseudonymised IP address. Email and mobile number are required to join: without them we cannot issue a member card.

Why, and on what legal basis

  • Your membership, member card and rewards: performance of our contract with you (art. 6(1)(b) GDPR). This includes service emails such as sign-in links, the welcome email and important account notices.
  • Your mobile number is used to verify you once at sign-up, to prevent duplicate accounts (we may check with Twilio whether it is a virtual number), and to send you a sign-in code if you ask for one: our legitimate interest in preventing fraud and keeping the service secure (art. 6(1)(f)).
  • Loyalty programme (stamps, rewards, invites, Monthly Challenge, badges): performance of our contract with you (art. 6(1)(b)). The leaderboard is only used if you join it (consent, art. 6(1)(a)); leaving it removes your secret name.
  • Security and abuse prevention (rate limiting, logs): legitimate interest (art. 6(1)(f)).
  • News, offers and events by email and/or SMS: only if you ticked the box for that channel: consent (art. 6(1)(a)). You can withdraw it at any time in Settings or with the unsubscribe link in every message. Withdrawing doesn't affect messages sent before. We don't send marketing texts to numbers outside the EU/EEA and the UK.

Your right to object

You can object at any time to processing based on our legitimate interests, and to direct marketing, by emailing matchachacha@thefullbellygroup.com or using the unsubscribe link.

Who sees your data

  • Our counter staff only see your first name, your stamps and your available rewards when they scan your card. A friend you invited is shown to you by first name only once they have had their first paid drink; they see that you invited them. If you share your invite link or code, people who open it see your first name, and your code starts with the first letters of your first name. Leaderboard players only see secret names and visit-days. The owner/administrator can access member records to run the club and answer your requests.
  • Processors acting on our instructions: Twilio (SMS verification), Resend (emails), Vercel (hosting, EU region), Neon (database, Frankfurt), Cloudflare (bot protection). Some are US companies; transfers are covered by the EU-US Data Privacy Framework and/or standard contractual clauses (a copy of these safeguards is available on request). If we use an email/SMS marketing tool to send news to members who opted in, it is listed here before first use.
  • Our providers keep short technical logs (hosting request logs, SMS and email delivery logs) under their own retention limits.
  • We never sell your data.

Security

Your name, email and phone number are encrypted in our database (AES-256), connections are encrypted (TLS), and your card's QR code changes every few minutes.

How long we keep it

  • Account data: until you delete your account, or after 24 months without any sign-in or visit (we email you 30 days before, if your email is confirmed).
  • After deletion, your name, email and phone number are erased immediately. Without your contact details we keep your consent history for 24 months (to prove our compliance), security logs for up to 12 months, a pseudonymised (keyed-hash) form of your number until 3 months after the last free matcha's use-by date to enforce "one free drink per number", and, if a friend invited you, a keyed-hash of your number for 24 months to enforce "one invite per number". Your loyalty history stays attached to the anonymous account for 24 months (statistics, fraud checks), then is detached: only anonymous statistics remain. Database backups are overwritten within 7 days.

Your rights

Access, rectification, erasure, restriction, objection, portability and withdrawal of consent. In Settings you can change your name and email, download your data and delete your account; to change your mobile number or for anything else, email us (we answer within one month). For requests by email we may ask you to confirm from your registered email or phone. You can complain to the Information and Data Protection Commissioner (idpc.org.mt).

Cookies

We only use cookies needed for the service: mcc_sid (keeps you signed in, up to 180 days), mcc_pending (sign-up or sign-in in progress, 10 minutes) and mcc_staff (staff devices only) and mcc_ref (remembers a friend's invite code for 7 days after you open their link). Cloudflare Turnstile may check device signals to block bots (strictly necessary for security). No analytics or advertising cookies.

Automated decisions

No automated decision-making or profiling with legal or similarly significant effects.

Terms & privacy · Matcha Cha Cha