Privacy Policy
Introduction
YOUR PERSONAL DATA IS IMPORTANT TO US!
TradeMalta is committed to protecting your Personal Data in accordance with the European Union’s General Data Protection [EU] 2016/679 (the “GDPR”) and the Data Protection Act (Chapter 586 of the Laws of Malta) (the “Act”) (together, the GDPR and the Act shall be referred to as the “Data Protection Laws”)
This Site and TradeMalta only process personal data relating to an identified or identifiable natural person in accordance with applicable data protection legislations and this privacy policy.
This Privacy Policy outlines our continued commitment to protecting the privacy of individuals who visit TradeMalta’s websites and use our services, and end users accessing information built on our platform.
Your privacy is important to us, and so is being transparent about how we collect, use, and share information about you.
WELCOME TO OUR GENERAL PRIVACY POLICY
This Privacy Policy applies to the operations of TradeMalta (C-67993) (the “Company” / “Data Controller”), a Malta-based company, dedicated to help Malta-based businesses to go international by assisting them through Financial Support, Trade Information Services, Capacity Building and Trade Promotion and any other personalised assistance they may require. (the “Services”).
Who we are
Throughout this Privacy Policy, the terms, the ‘Company’, ‘we’, ‘us’ and ‘our’ refer to TradeMalta Limited. As explained further below, TradeMalta Limited collects and handles Personal Data in the course of its business. While the Personal Data we process relates mainly to our customers, we may also collect Personal Data pertaining to other individuals, as explained further below.
Our contact details
Full name of Controller: | TradeMalta Ltd. |
Postal address (Premises): | The Clock Tower, Level 1, Tigne Point, Sliema TP01, Malta. |
Email address: | |
Telephone: | +356 2247 2400 |
Website: |
What is the General Data Protection Regulation (GDPR)?
The General Data Protection Regulation (GDPR) is designed to give individuals more control over their personal data. You are the owner of your Personal Data and this law strives to enhance the rights that you have in relation to your Personal Data. TradeMalta is subject to the GDPR regulation under the EU Data Protection Directive, and by virtue of this Privacy Policy we aim to detail the manner in which we handle and process your Personal Data in accordance with the Data Protection Laws.
Definition of Personal Data
The term “personal data” means any information relating to an individual and is able to identify that person as a unique being. Such a person is referred to as a “data subject”.
A person is identifiable if they can be identified directly or indirectly using an “identifier”. The GDPR gives examples of identifiers, including names and surnames, identification numbers, photographs, contact details, location data and other similar information. A person may also be identifiable by reference to factors which are specific to their identity, such as physical, genetic or cultural factors. However, anonymized data is not Personal Data since it cannot uniquely identify an individual.
The GDPR also speaks of Special categories of data which include Personal Data which is intrinsically more sensitive in nature. This would consist of data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. Should it become necessary for us to process any such kinds of Data in order for us to successfully run our operation, we guarantee that any such processing shall comply with all the relevant principles, requirements and security measures mandated by the GDPR and the Act in relation to the processing of such Data.
Processing essentially means the use of your Personal Data. Activities such as our collection of your Personal Data, its storage, disclosure or alteration are all deemed to constitute ‘Processing’ of your Personal Data.
Your Privacy Rights
As a data subject, and under certain circumstances, you have certain data protection rights under the Data Protection Laws:
- THE RIGHT TO BE INFORMED: you have the right to be informed about the collection and use of your personal data.
- THE RIGHT TO ACCESS: you have the right to access your Personal Data and request a copy thereof.
- THE RIGHT TO RECTIFICATION: you have the right to rectify any incorrect Personal Data that we may hold about you.
- THE RIGHT OF ERASURE: you have the right to be forgotten, which enables you to ask us to delete your Personal Data where there is no good reason for us continuing to process it. Note that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, and if we are so permitted, at the time of your request. If you opt to exercise this right, we may not always be able to continue our relationship with you or continue providing our Services to you.
- THE RIGHT TO RESTICT ON PROCESSING: you have the right to request the restriction of our processing. This can be done in the following cases: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it. If you opt to exercise this right, we may not always be able to continue our relationship with you or continue providing our Services to you.
- THE RIGHT TO DATA PORTABILITY: you have the right to data portability. Your data may be requested in a machine-readable format and you may also ask that your data be transferred directly to another person or services provider. This right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
- THE RIGHT TO OBJECT TO PROCESSING: you may object to the processing of your data where we are relying on legitimate interests (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
- THE RIGHT TO WITHDRAW YOUR CONSENT: if you have provided consent for the processing of your data you have the right, in certain circumstances, to withdraw that consent at any time which will not affect the lawfulness of the processing before your consent was withdrawn. Any processing activities that are not based on your consent will remain unaffected.
- RIGHTS IN RELATION TO AUTOMATED DECISION MAKING AND PROFILING: you shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Note that we do not exercise decision-making and profiling in an automated manner.
Click here for further information on your rights under the GDPR.
If you wish to exercise any of the rights set out above, please contact us – kindly refer to the section below entitled ‘Contact Us’ for further information on the manner in which you may do so. We will try to respond to all legitimate requests within one (1) month, unless it is particularly complicated or you have made repeated requests in which case we will respond, at the latest, within three (3) months. We will inform you of any such extension within one (1) month of receipt of your request, together with the reasons for the delay.
You will not have to pay to access your Personal Data (or to exercise any of the other rights mentioned above). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.
Please note that none of these data subject rights are absolute, and must generally be weighed against our own legal obligations and legitimate interests. If we are permitted, and if a decision is taken to override your data subject request, we will inform you.
Whose Personal Data We Collect?
This Privacy Policy is intended to govern the collection of the Personal Data Pertaining to the below individuals:
- Website Visitors – individuals visiting our website;
- Visitors at our Premises – individuals visiting our Premises for any reason, inclusive of meetings, scheduled maintenance or the provision of services;
- Third Parties generally – this is a generic category of Data Subjects that typically includes individuals with whom we do not have a direct contractual relationship, such as prospective individual services providers and persons contacting the Company with enquiries or for any other reason;
- Prospective Clients – individuals being prospective customers who have expressed an interest in engaging our Services;
- Individual Shareholders, Company Officers and, or Executives of Prospective Clients that are legal persons, such as companies – individuals who are generally owners and, or legal and judicial representatives of the Prospective Client when the latter is a legal person.
- Service Providers – individuals who provide us with a range of services to facilitate the transfer of data.
- Individuals who agree to participate in market research.
If you provide us with Personal Data about someone else, it is your responsibility to ensure that you are entitled to disclose that Personal Data to us. You must ascertain that these persons comprehend how their details will be used, and that they have allowed you to disclose that information to us, as well as allowed us, and our outsourced services providers, to process it.
What data do we collect about you?
We may collect and process any type of personal data you provide to us in the course of your interactions with us. You may have provided some of your personal data directly to us such as when you visited our website by providing us with your personal data when subscribing to email alerts or by using our online feedback or other forms. We may also receive personal data about you from various third parties and public sources such as LinkedIn. Categories of such personal data include names, addresses, contact information and other information that is relevant to the provision of our services.
We refer to any information described above as “Account and Profile Information” for the purposes of this Policy. By voluntarily providing us with Account and Profile Information, you represent that you are the owner of such personal data or otherwise have the requisite consent to provide it to us.
Additionally, when you visit our website, the following information will automatically be processed and this is solely for the use of TradeMalta in the administration of this website and to improve the website’s usability:
- The requested web page or download;
- Whether the request was successful or not;
- The date and time when you accessed the site;
- The Internet address of the web site or the domain name of the computer from which you accessed the site;
- The operating system of the machine running your web browser and the type and version of your web browser.
When processing Personal Data pertaining to you as constituting a Data Subject, we may, depending on the case at hand, collect, use, store and transfer different kinds of Personal Data about you which we have grouped together as follows:
Identification Data: includes name, surname, title, date of birth, and, if necessary, identification documents and details, such as identity card and passport information. We may also request additional information in order to evidence your identity, particularly if we are required by law to do so.
Contact Data: includes postal address, email address and telephone and/or mobile number.
Cookie Data: includes information collected via cookies used on our website, as better explained in our Cookie Policy.
In all cases, we may request additional and proportionate information if and when we deem such to be necessary.
It is important that the Personal Data we hold about you is accurate and current. Please keep us informed if your Personal Data changes during your relationship with us.
How do we collect your personal data?
We use different methods to collect your Personal Data. Any Personal Data collected is a result of, and relates to, your relationship with us:
Website Visitors: we collect Identification Data and, or Contact Data as submitted to us by yourself if you decide to utilise the ‘Contact Us’ form on and through our website.
Furthermore, and upon accessing our website, Cookie Data is processed by ourselves and by our third party processors throughout the duration of your session. More information on the use of cookies on our website is found in our Cookie Policy.
Visitors at our Premises: upon entering into our Premises, our front desk may manually collect the Identification Data and or Contact Data that would be deemed proportionate and necessary in the circumstances.
Third Parties generally: this is a generic category of Data Subjects, as explained in section 6 iii further above. For example, in each of the following categories, Identification Data and Contact Data are usually collected through direct interaction with the data subject:
- Prospective services providers: when you, as a prospective individual services provider, express an interest in doing business with us, and during the course of our negotiations or dealings;
- Persons contacting us: upon contacting us by means other than our website, such as through a telephone enquiry; and
- Representatives / agents: when an individual has been sent to deal with us on behalf of another entity, be it another individual or a third party. For the purposes of this Privacy Policy, Individual Shareholders, Company Officers and, or Executives of Prospective Clients that are legal persons, such as companies, comprise a separate category of data subjects, and shall accordingly be treated as such.
Prospective Clients: we collect your Personal Data when you express an interest in engaging our Services, and this typically through:
- Direct interactions, through meetings, calls, email correspondence or by other means, usually when you submit the relevant Identification Data, Contact Data, Compliance Data, Financial Data and Investment Data to us; and
- Third parties and other available sources, such as the Malta Registry of Companies, company registers of other jurisdictions, and from electronic data searches, online search tools, anti-fraud databases and other third-party databases, sanctions lists and general searches carried out via online search engines.
How We Use Information That We Collect
We will only use your personal data for the purposes and legal bases set out in the table below.
- provide, operate, maintain, improve, and promote our services;
- enable you to access and use our services;
- process and complete transactions, and send you related information, including applications confirmations, grant documents and invoices;
- send transactional messages, including responses to your comments, questions, and requests; provide customer service and support; and send you technical notices, updates, security alerts, and support and administrative messages;
- solicit feedback on your engagement with TradeMalta or to ask you to participate in a survey;
- send promotional communications, such as providing you with information about products and services, features, downloads, newsletters, and events; and provide other news or information about us and our partners. You can opt-out of receiving marketing communications from us by contacting us at info@trademalta.org or following the unsubscribe instructions included in our marketing communications;
- monitor and analyse trends, usage, and activities in connection with our websites and services and for marketing or advertising purposes;
- investigate and prevent fraudulent transactions, unauthorized access to the websites and services and other illegal activities;
- personalize the websites and services, including by providing features or services, and advertisements that match your interests and preferences;
- evaluate job applications and quotations or bids submitted by potential service providers, and
- for other purposes for which we obtain your consent.
Processing of Data:
Our legal basis for collecting and using the personal information will depend on the personal information concerned and the specific context in which we collect it. However, we will normally collect personal information from you only where:
- we have your consent to do so,
- where we need the personal information to perform a contract with you (e.g. to deliver the Services you have requested), or
- where the processing is in our or a third party’s legitimate interests (and not overridden by your data protection interests or fundamental rights and freedoms). In some cases, we may also have a legal obligation to collect personal information from you or may otherwise need the personal information to protect your vital interests or those of another person.
Where we rely on your consent to process the personal information, you have the right to withdraw or decline your consent at any time. Please note that this does not affect the lawfulness of the processing based on consent before its withdrawal.
If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information). Similarly, if we collect and use your personal information in reliance on our (or a third party’s) legitimate interests which are not already described in this Notice, we will make clear to you at the relevant time what those legitimate interests are.
If you have any questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided further below.
Although we may process your personal data in the European Union, this data may also be stored or processed in systems based in other parts of the world. These systems and providers may be based on territories which do not provide the same level of protection to data subjects as may be enjoyed within the EU. TradeMalta will take the appropriate safeguards to ensure that your rights are safeguarded in accordance with this privacy policy and any applicable laws and regulations.
You may contact us at any time if you have questions, general concerns about the processing of your Personal Data, or any data protection issue as per the contact details provided below.
Sharing of Information Collected
We share information, including personal information, with our third-party service providers that we use to provide hosting for and maintenance of our Websites, application development, backup, storage, payment processing, analytics and other services for us. These third-party service providers may have access to or process your personal information for the purpose of providing these services for us. We do not permit our third-party service providers to use the personal information that we share with them for their marketing purposes or for any other purpose than in connection with the services they provide to us.
For the purpose of processing the applications in line with the International Trade Incentive Scheme Guidelines, the General Block Exemption Regulations or the Commission Regulation (EU) No 1407/2013 of 18 December 2013 on the application of Articles 107 and 108 of the Treaty on the Functioning of the European Union to de minimis aid (hereinafter referred to as the ‘de minimis Regulations’), TradeMalta shall share the data provided via this application with other Government Entities, subject that such processing satisfies at least one of the grounds listed under Regulation of the GDPR.
For the purpose of monitoring of aid in line with Article 6 of the de minimis Regulations and Articles 11 and 12 of the General Block Exemption Regulations 2014 or Articles 10 and 11 of the General Block Exemption Regulations 2008 or where legally required, any data provided as part of the application may be shared with the European Commission.
Given that TradeMalta has been, and could be in the future, a beneficiary of EU funds, your data might also be shared with and processed by the Managing Authority and other Third Parties (including other stakeholders in the system involved in implementation, monitoring and control as stipulated in the Manual of Procedures for Structural Funds), having regard to the purposes for which data is collected.
Compliance with Laws and Law Enforcement Requests; Protection of Our Rights:
In certain situations, we may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We may disclose personal information to respond to subpoenas, court orders, or legal process, or to establish or exercise our legal rights or defend against legal claims. We may also share such information if we believe it is necessary in order to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our Service Agreement, or as otherwise required by law.
Our Sharing:
We may share information, including personal information, with any member of TradeMalta.
With Your Consent:
We may also share personal information with third parties when we have your consent to do so.
Security and where we store your personal data
We are committed to protecting the security of your personal data.
This site uses Secure Sockets Layer (SSL) to ensure secure transmission of your personal data. You should be able to see the padlock symbol on the right-hand side of the status bar situated at the top left hand corner of the browser window. The url address will also start with https:// depicting a secure webpage. SSL applies encryption between two points such as your PC and the connecting server. Any data transmitted during the session will be encrypted or scrambled and then decrypted or unscrambled at the receiving end. This will ascertain that data cannot be read during transmission.
As effective as modern security practices are, no physical or electronic security system is entirely secure. We cannot guarantee the complete security of our database, nor can we guarantee that information you supply will not be intercepted while being transmitted to us over the Internet.
Although we will do our best to protect your personal data, we cannot guarantee the security of your personal data transmitted to our website. Any transmission of personal data is at your own risk. Once we receive your personal data, we use appropriate security measures to seek to prevent unauthorised access or disclosure.
Retention of Data
We will retain your personal information for as long as is needed to fulfil the purpose outlined in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements). When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.
Third Party Sites
To give you a better service our site may connect you with a number of links to other local and international organisations and agencies. When connecting to such other websites you will no longer be subject to this policy but to the privacy policy of the new site. TradeMalta will not accept any responsibility or liability for those policies, so please check those policies before you submit any personal data to those websites.
Disclosure
In the course of our business, we have day-to-day dealings with third parties which may be individuals or legal persons, usually companies – that are typically our service providers or subcontractors – and may also simultaneously be our Processors. We may, therefore, have to share your Personal Data with said third parties, set out below, for the purposes outlined in this Privacy Policy:
IT development services | Services providers who help us in developing software necessary for the running of our business. |
IT backup and cloud services | Services providers who assist us in relation to backups for business continuity purposes so that your Personal Data is not lost. |
Administration | Services providers who provide administrative assistance in order to enable us to better organise and streamline our internal administrative processes. Within this category, we are also considering services providers that will assist us in our onboarding process, such as fraud prevention and identity verification agencies and services providers, that shall undertake required due diligence and anti-fraud checks via the relevant databases. |
Third party consultants and professional advisors | Services providers who assist us in various matters, including lawyers, accountants and insurers. |
Regulators, courts, law enforcement and other authorities | Entities that may require the disclosure of processing activities in certain circumstances, such as the FIAU, the MFSA and the executive police. |
We will, in usual circumstances, not disclose Personal Data to other persons not mentioned above without your consent. There may however be times where we may need to do so, such as when abiding by a court order, for the proper administration of justice, in complying with a legal request or a legal requirement, to report actual or suspected fraud, money laundering or other criminal activity, to protect your vital interests, and, or to fulfil your requests.
We require all third parties with whom we share Personal Data to respect the security of such Personal Data and to treat it in accordance with the applicable laws and regulations.
We do not allow our Processors to use your Personal Data for their own purposes and only permit them to process your Personal Data for specified purposes and in accordance with our instructions.
Business Transaction
We may assign or transfer this Policy, as well as Account and Profile information gathered from you and related information and data, including any personal information , to any person or entity that acquires all or substantially all of our business, stock or assets, or with whom we merge.
Changes to This Policy
If there are any changes to this Policy, we will replace this page with an updated version. It is therefore in your own interest to check the ‘Privacy Policy’ page any time you access our website so as to be aware of any changes which may occur from time to time. Any changes to our policy will become effective upon posting of the revised statement on this website. If requested by law, we will seek your express consent to any changes to how we disclose your Personal Data. Otherwise, the use of this website following such changes constitute your acceptance of the revised Privacy Policy then in effect.
Contact Us
Any comments or suggestions that you may have and which may contribute to a better quality of service will be welcome and greatly appreciated. You can contact us by using the ‘Contact Us’ form available on our website.
If you have questions regarding this Policy or about TradeMalta privacy practices, please contact us
Postal address: | The Clock Tower, Level 1, Tigne Point, Sliema TP01, Malta. |
Email address: | info@trademalta.org |
Telephone: | +356 2247 2400 |
How to submit a subject access request to TradeMalta under the General Data Protection Regulation
You can submit a subject access request in writing by post or by email to:
Klaus Pedersen
Data Protection Officer
TradeMalta
info@trademalta.org
Your request should include the following:
- A statement that the request is being made under the General Data Protection Regulation
- As much information as possible about the subject matter of the access request
- In what format you wish to receive any records released (e.g. photocopies or electronically).
Proof of ID is required to process subject access requests, e.g. driver’s license or passport. Please note depending on the nature of the request additional ID maybe required. TradeMalta’s Data Protection Officer will discuss this requirement for additional ID if required prior to the request being processed.
Complaints
If you feel that your data protection rights have been infringed, you have the right to lodge a complaint with the Information and Data Protection Commissioner.
We strive to be receptive to your concerns and would appreciate it if you would contact us in the first instance should you believe that we have breached any privacy rules.
Nonetheless, should you feel wronged by our data protection practices, you may file a complaint with the data protection supervisory authority of your country of residence. In Malta, this would be the Office for the Information and Data Protection Commissioner, the contact details of which are as follows:
OFFICE OF THE INFORMATION AND DATA PROTECTION COMMISSIONER [MALTA]
Email: idpc.info@idpc.org.mt
Phone: +356 2328 7100
Governing Law
This Privacy Notice is governed by and construed in accordance with the laws of Malta.
Last Updated: 4th September 2024