Malta Business Journal respects your privacy and is committed to handling personal data lawfully, fairly, securely and transparently. This policy explains what personal data we collect, why we use it, who may receive it, how long we keep it and the rights available to you.
1. Who we are
Malta Business Journal is the controller of the personal data described in this policy. The full legal name of the entity that operates and publishes Malta Business Journal, its company registration number and its registered office are identified in the website footer and Contact page. Privacy enquiries and requests may be sent to legal@maltabusinessjournal.com. If a Data Protection Officer is appointed or required, that person's contact details will be published through the same route.
2. Scope of this policy
This policy applies when you visit maltabusinessjournal.com, create or use an account, subscribe to a newsletter, contact us, submit material, comment or otherwise contribute, register for an event, enter a promotion, respond to a survey, apply to work with us, engage us commercially or interact with a Malta Business Journal page or campaign that links to this policy. Third-party websites and services have their own privacy practices. A link from Malta Business Journal does not make us responsible for another controller's processing.
3. Personal data we collect
Information you provide
- identity and contact details, such as your name, title, organisation, email address, telephone number and postal details;
- account and authentication details, including login credentials or identifiers supplied by a sign-in provider;
- newsletter selections, communication preferences and consent records;
- messages, news tips, pitches, press material, complaints, corrections, survey responses and other correspondence;
- comments, profile information, photographs, audio, video or other material you submit for publication or participation;
- event registrations, attendance information, accessibility or dietary requests and images or recordings made at an event;
- commercial and transaction details, including campaign contacts, contracts, invoices, VAT information and payment status; and
- recruitment information, such as a CV, work history, references and interview notes, if you apply to work with us.
Information collected when you use the service
- device and technical information, including IP address, browser, operating system, language, device type and security identifiers;
- server logs and security events, including request times, pages accessed, error information and suspected misuse;
- usage information, such as articles viewed, referral source, session activity, approximate location derived from IP address and interactions with emails or advertising; and
- cookie, local-storage and similar identifiers, subject to the choices described in our Cookie Policy.
Information from other sources
We may receive data from event or campaign partners, service providers, public sources, professional directories, social networks, analytics providers, authentication providers and people who introduce or copy you into correspondence. For journalism, we may also collect information from public records, documents, interviews, sources and other publications, subject to applicable law and our Ethical Standards.
4. Why we use personal data and our legal bases
| Purpose | Typical data | Legal basis |
|---|---|---|
| Deliver the website, accounts and requested services | Contact, account, device and usage data | Contract; legitimate interests in operating the service |
| Send newsletters and optional marketing | Name, email, preferences and engagement | Consent; legitimate interests for limited business-to-business communications where lawful |
| Respond to enquiries, tips, pitches and complaints | Contact details, messages and evidence | Legitimate interests; steps requested before a contract; legal obligations |
| Produce and publish journalism | Information about sources, subjects and contributors | Legitimate interests; freedom of expression and information; legal claims; consent where appropriate |
| Manage comments and user contributions | Profile, contribution, moderation and technical data | Contract; legitimate interests in safe, constructive participation; legal obligations |
| Run events, awards, surveys and promotions | Registration, preference, entry and attendance data | Contract; consent; legitimate interests; legal obligations |
| Manage advertising and partners | Business contacts, campaign, billing and performance data | Contract; legitimate interests; legal and tax obligations |
| Measure and improve the service | Usage, device and consented analytics data | Consent where non-essential storage/access is used; legitimate interests for aggregated and essential operational analysis |
| Protect the service and enforce terms | Logs, identifiers, reports and account activity | Legitimate interests in security, fraud prevention and legal claims; legal obligations |
| Recruit team members and contributors | Application, assessment and reference data | Pre-contract steps; legitimate interests; legal obligations; consent where required |
| Comply with law and defend rights | Relevant account, transaction, publication and correspondence data | Legal obligations; public interest where applicable; legitimate interests in legal claims |
Where we rely on legitimate interests, we consider the necessity of the processing and balance our interests against your rights and reasonable expectations. You may ask for information about that assessment. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out lawfully.
5. Journalism, public information and special-category data
Business journalism may involve personal data about people in public or professional life, allegations, opinions and, occasionally, sensitive information. We assess publication against accuracy, relevance, proportionality, privacy, public interest and freedom of expression. Data-protection rights may be limited where and to the extent permitted for journalistic purposes, legal claims or another statutory exemption.
Please do not send health information, political opinions, identity documents, criminal-allegation material or other sensitive data unless it is necessary and you have considered the risks. If you provide personal data about another person, you should have a lawful basis to do so and, where appropriate, direct them to this policy. This does not prevent confidential journalistic sourcing or lawful reporting in the public interest.
6. Cookies and similar technologies
We use strictly necessary technologies to operate and secure the website. Analytics, preference, social-media or advertising technologies are used only in accordance with applicable consent requirements. You can accept, reject or manage non-essential categories through the cookie banner or the permanent ‘Cookie Settings’ link. See our Cookie Policy for details.
7. When we share personal data
We disclose personal data only where reasonably necessary and subject to appropriate safeguards. Recipients may include:
- hosting, content-delivery, cybersecurity, IT support, analytics and website-service providers;
- email, customer-relationship, form, survey, event, payment, accounting and document-management providers;
- freelance editors, journalists, photographers, production partners and professional advisers working under appropriate duties;
- advertising or event partners where the disclosure is necessary for an agreed service and transparent to you;
- social platforms when you choose to interact with embedded or linked features;
- regulators, courts, law-enforcement bodies, tax authorities or other public bodies where disclosure is required or lawfully requested; and
- a purchaser, investor, lender or adviser involved in a genuine restructuring, financing or transfer of all or part of the business, subject to confidentiality and lawful processing.
We do not sell or rent personal data as a standalone product. Service providers may process data only for documented purposes and under appropriate contractual and security requirements.
8. International transfers
Some providers or recipients may process personal data outside Malta or the European Economic Area. Where the destination is not recognised as providing an adequate level of protection, we use an approved safeguard such as the European Commission's Standard Contractual Clauses, together with supplementary measures where required, or rely on another lawful transfer mechanism. You may contact us for information about the safeguard relevant to your data.
9. How long we keep personal data
We keep personal data only for as long as necessary for the relevant purpose, taking account of legal obligations, the sensitivity of the data, security needs, limitation periods and the continuing public value of published journalism.
| Record | Typical retention approach |
|---|---|
| Newsletter record | Until you unsubscribe or the service ends; a minimal suppression record may then be retained to respect your choice. |
| General enquiries and pitches | Normally up to 24 months after the last meaningful contact, unless needed for an ongoing relationship, complaint or legal issue. |
| Account and comment data | For the life of the account or contribution and a reasonable period afterwards for moderation, security and legal claims. |
| Cookie and analytics data | According to the duration shown in the cookie preference centre and the provider configuration. |
| Contracts, invoices and tax records | For the period required by Maltese accounting, tax and company law and any applicable limitation period. |
| Unsuccessful recruitment applications | Normally 12 months after the process, unless a different period is explained or you consent to a talent pool. |
| Security logs | Normally up to 12 months, with longer retention where an incident, investigation or legal claim requires it. |
| Published editorial material | Normally retained as part of the Journal's archive, subject to corrections, updates, legal obligations and proportionate review requests. |
10. Security
We use proportionate technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse, alteration and disclosure. Measures may include access controls, encryption in transit, backups, logging, supplier due diligence, staff confidentiality and incident procedures. No online service can guarantee absolute security. You are responsible for keeping account credentials confidential and notifying us promptly of suspected misuse.
11. Your data-protection rights
Depending on the circumstances and applicable exemptions, you may have the right to:
- be informed about how your personal data is used;
- obtain access to your personal data and a copy of it;
- correct inaccurate or incomplete personal data;
- request erasure of personal data;
- restrict processing in certain circumstances;
- receive certain data in a structured, commonly used and machine-readable format and transmit it to another controller;
- object to processing based on legitimate interests and object at any time to direct marketing;
- withdraw consent at any time; and
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, where the right applies.
To make a request, email legal@maltabusinessjournal.com. We may ask for information reasonably necessary to verify your identity and locate the relevant data, but we will not request excessive identification as a matter of routine. Rights are not absolute; for example, erasure may not apply where information is needed for freedom of expression, a legal obligation or legal claims.
We normally respond without undue delay and within one month, subject to any lawful extension for a complex or numerous request. Exercising a right is normally free of charge, although the law permits limited action for manifestly unfounded or excessive requests.
12. Direct marketing
You can unsubscribe from an email using the link in the message or by contacting us. Withdrawing from marketing does not prevent service messages, responses you requested or communications necessary for an existing contract. We may retain a minimal suppression record so that we do not add you back inadvertently.
13. Automated decision-making
We do not intend to make decisions about readers based solely on automated processing where those decisions produce legal or similarly significant effects. We may use automated tools for spam filtering, security, content recommendations, workflow support or audience segmentation, subject to human oversight and applicable consent requirements.
14. Children
Malta Business Journal is directed to a professional and general business audience, not to children under 13. A child under 13 should not create an account, subscribe or submit personal data without the authorisation required by Maltese law. If we learn that we collected a child's data unlawfully, we will take appropriate steps to remove it.
15. Published archives, corrections and removal requests
The integrity of a news archive is an important public interest. We generally correct or update an accurate historical record rather than delete it. We consider proportionate requests concerning inaccurate, outdated, unlawfully published or unduly harmful personal information by reference to the facts, current relevance, public interest, legal duties and freedom of expression. Contact editorial@maltabusinessjournal.com for editorial accuracy and legal@maltabusinessjournal.com for a data-protection request.
16. Complaints
Please contact us first so that we can try to resolve your concern. You also have the right to complain to the Office of the Information and Data Protection Commissioner in Malta or, where applicable, another competent supervisory authority. The Maltese authority's current contact details are available at idpc.org.mt.
17. Changes to this policy
We may update this policy when our services, providers or legal obligations change. The current version will be published on this page with its review date. Where a change materially affects consent-based processing, we will seek fresh consent when required.
18. Contact
Privacy enquiries: legal@maltabusinessjournal.com. The operator's registered office and corporate details appear in the website footer and Contact page.