- APPLICABLE LAWS
- WHAT ARE PERSONAL DATA?
- WHAT ABOUT INFORMATION RELATING TO COMPANIES?
- PERSONAL DATA MBR COLLECTS ABOUT YOU
- SOCIAL MEDIA
- HOW AND WHY WE COLLECT PERSONAL DATA
- PERSONAL DATA RELATING TO THIRD PARTIES
- WHAT WE USE YOUR PERSONAL DATA FOR (PURPOSE OF PROCESSING)
- DATA WHICH WE MAKE PUBLICLY AVAILABLE
- ACCURACY OF PERSONAL DATA
- TRANSFERS TO THIRD COUNTRIES
- INTERNET COMMUNICATIONS
- AUTHORISED DISCLOSURES
- SHARING OF PERSONAL DATA WITH OTHER CATEGORIES OF RECIPIENTS
- SECURITY MEASURES
- RETENTION PERIODS
- PROCESSING FOR RESEARCH AND STATISTICAL REASONS
- LINKS TO THIRD PARTY SOURCES
- AUTOMATED DECISION-MAKING
- YOUR RIGHTS UNDER THE DATA PROTECTION LAWS
- MBR DETAILS
As a Government agency established in Malta, EU, the main privacy laws that are applicable to Us in so far as You are concerned, are as follows:
- The Maltese Data Protection Act (Chapter 586 of the Laws of Malta) as well as the various subsidiary legislation issued under the same – the ‘DPA’;
- The Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – the ‘GDPR’.
All the above, as may be amended from time to time, referred to together as the “Data Protection Laws”
WHAT ARE PERSONAL DATA?
“PERSONAL DATA” means any information that identifies You as an individual or that relates to an identifiable individual. Information relating to legal persons (such as companies) does not amount to Personal Data. For more information on this important distinction, please read the section “WHAT ABOUT INFORMATION RELATING TO COMPANIES?” below.
Whenever it is not possible or feasible for Us to make use of anonymous and/or anonymised data (in a manner that does not identify any Users of the Site or recipients of Our services), We are nevertheless committed to protecting Your privacy and the security of Your Personal Data at all times.
We collect Personal Data in various ways both digitally via the Site (either when You choose to provide Us with certain data or in some cases, automatically or from third parties) as well as non-digitally (for example when a statutory form is submitted to Us or You fill in a physical form to benefit from one or more of Our services).
WHAT ABOUT INFORMATION RELATING TO COMPANIES?
Information relating to legal persons as opposed to natural persons does not amount to personal data. Limited liability companies and other legal entities have a distinct legal personality that is separate from that of their owners or even their directors. This means that information relating to such legal entities (as opposed to the details of the owners, shareholders or even directors) will not, in most cases, constitute personal data and falls outside the scope of the GDPR.
Having said the above, in all those cases where natural persons (such as company directors, shareholders, partners and even sole traders) are individually identifiable, and where information relates to such individuals in their personal capacity as opposed to them acting as representatives of a legal person, MBR will treat such information as personal data and will afford to such individuals (who would be deemed as data subjects) all the data protection rights listed below, as may be applicable.
PERSONAL DATA MBR COLLECTS ABOUT YOU
There are various categories of Personal Data that We collect about You, namely:
CONTACT DETAILS (WITHOUT NEED FOR REGISTRATION ON THE SITE):
- Comments containing any personal data You choose to send us.
- First Name
- Date of birth
- Residential Address
- E-mail address
- Mobile (optional)
- Fax Number (optional)
- ID/Passport Number
- Identification details (ID)
- Country of Residence
- Registered Office (only considered personal data if this is the home address of the individual sending Us this information).
- Contact details of shareholders, directors, company secretaries and other members of the applicant including:
- Residential address
- Email address
- Business Occupation
- Contact details of persons liaising and submitting documents on behalf of applicant (for example, a legal representative) including:
- Email address
- Police conduct and/or certificate of good standing (processed on the basis of Our official authority) (only in specific circumstances)
- Bank references (only in specific circumstances)
- Evidence that the commercial partnership can use the address as the registered office (only in specific circumstances)
- IP address
- Location Data
- Bank account details
- Credit or debit card information
In some cases, (for example, if You are a recipient [or prospective recipient] of Our services, via the Site, any App or otherwise – even if the service in question is merely information You request from Us), We may request additional Personal Data as a means of securely identifying You or for another similar lawful purpose (which will be explained in the table below and/or in a condensed policy/notice that may have directed You here). The additional information We may request from You to be able to provide You with Our services includes:
- More secure identification methods
- Details of Your next of kin
- Certain special categories of data (sensitive Personal Data) such as health conditions/status/details or trade union membership (only where necessary and with the necessary safeguards in place).
- Your police conduct and/or certificate of good standing which we may require for company incorporation in certain cases, and which we process, primarily for verification purposes under the control of Our official authority.
Many of the categories of Personal Data above are collected directly from You (for example, Your Contact Details and Your Registration Data). However, WE MAY ALSO COLLECT PERSONAL DATA FROM OTHER SOURCES, including authorised members (e.g. directors or company secretaries) of the company or other legal entities You may be associated with, third party data companies, publicly accessible databases, social media platforms, other Government agencies and Government bodies (both local as well as foreign bodies within the EU) and other third parties.
We may also receive Personal Data about You from third parties when We need to confirm Your Contact Details or even certain Financial Information. Should this be the case, We will take all measures as required by law to further inform You about the source of such Personal Data as well as the categories of Personal Data We collect and process (unless We are satisfied that You already have that information). There are certain instances at law where We are specifically forbidden from disclosing to You such activity (for example, when carrying out due diligence for anti-money laundering purposes).
For a detailed description of the reasons why We process the categories of Personal Data above (and any other specific Personal Data We process) as well as the corresponding legal ground(s) for doing so please see the ‘What We Use Your Personal Data For (Purpose of Processing)’ below.
For information/Personal Data that We may collect automatically via the Site, please see the Cookies section below.
HOW AND WHY WE COLLECT PERSONAL DATA
As a general rule, We do not collect any Personal Data, that is, information that identifies You as an individual other than that which You choose to provide to Us such as the data (including Contact Details and Registration Data) You provide when contacting us via Our Site (where registration is not required) or registering with the said Site (where this is available), when registering a company or other entity with MBR (if this applies to You as an identifiable natural person), when filing documents with Us on behalf of any legal entity (if this applies to You as an identifiable natural person) when otherwise contacting Us with enquiries relating to Our services, when subscribing to any service offered by Us or via Our Site, such as any newsletters as may be issued by Us from time to time (see Personal Data We Collect About You above).
Unless otherwise specified and subject to various controls, as a general rule, we only collect Personal Data (from You or elsewhere) that we:
- Need to be able to provide You with the services/information You request from Us
- Are legally required to collect/use and to keep for a predetermined period of time
- Believe to be necessary for the performance of a task carried out in the public interest
- Believe it to be necessary for the performance of a task carried out in the exercise of official authority vested in Us (as a Government agency).
For a detailed description of the reasons why We process specific categories of personal data as well as the corresponding legal ground(s) for doing so, please seethe ‘What We Use Your Personal Data For (Purpose of Processing)’ below.
PERSONAL DATA RELATING TO THIRD PARTIES
WHAT WE USE YOUR PERSONAL DATA FOR (PURPOSE OF PROCESSING)
The following is a description (in a clear and plain manner) of what We use Your Personal Data for and the corresponding legal ground(s) We rely on for doing so.
For more detail on what is meant by terms such as ‘Contact Details’, ‘Registration Data’ and other categories of Personal Data used in the tables below, please see the section above relating to Personal Data We Collect About You.
Please note that in the rare instances (if any) WHERE WE RELY ON YOUR CONSENT, THIS CAN ALWAYS BE WITHDRAWN AT WILL.
- GENERAL PROCESSING OPERATIONS
PROSPECTIVE RECIPIENTS/ USERS OF THE SITE/NEW RECIPIENTS OF OUR SERVICES:
|PURPOSE OF THE PROCESSING||CATEGORIES OF PERSONAL DATA||LEGAL BASIS FOR PROCESSING|
|Evaluating Your application(s)/requests You send Us to use/receive any of Our services||Registration Data Contact Details Financial Information Other Communication Data Incorporation/Declaration Data References||Contractual Necessity Official Authority Public Interest Legal Obligations|
|Set up a record on our systems||Registration Data Contact Details Financial Information Incorporation/Declaration Data Other Communication Data||Contractual Necessity Legal Obligations|
|To manage our relationship with You||Registration Data Contact Details Financial Information Incorporation/Declaration Data Other Communication Data Transaction and Usage data||Contractual necessity Compliance with the legal obligations|
|To carry out mandatory verification in compliance with applicable laws (anti-money laundering and combatting the financing of terrorism legislation)||Registration Data Contact Details Financial Information Incorporation/Declaration Data Identification and verification data Background Checks||Compliance with our legal obligations|
|To establish and investigate any suspicious behaviour in order to protect Our systems from any risk and fraud||Registration Data Contact Details Identification and Verification Data Log in Data|
|Compliance with the legal obligations|
|To keep an accurate and up to date legal entities database (open to the public)||Contact Details (in addition to the details of the legal entity which are out of scope here) Incorporation/Declaration Data||Compliance with the legal obligations|
|To monitor our premises via CCTV for security purposes, when not exercising any of Our official tasks||CCTV footage (deleted after 7 days)||Legitimate Interests|
|To ask vistors to enter their name and surname when entering Our premises||Login details (deleted after 7 days)||Legitimate Interests Legal Obligations|
ONGOING RECIPIENTS OF OUR SERVICES:
|PURPOSE OF THE PROCESSING||CATEGORIES OF PERSONAL DATA||LEGAL BASIS FOR PROCESSING|
|To be able to continue providing You with (some or all of) Our services||Registration Data Contact Details Financial Information Other Communication Data Incorporation/Declaration Data||Contractual Necessity Official Authority Public Interest Legal Obligations|
|Maintain records on our systems||Registration Data Contact Details Financial Information Incorporation/Declaration Data Other Communication Data||Contractual Necessity Legal Obligations|
|Continue to manage Our relationship with you||Registration Data Contact Details Financial Information Incorporation/Declaration Data Other Communication Data Transaction and Usage data||Contractual necessity Compliance with the legal obligations|
|To pass on certain information to public authorities (including the Malta Financial Services Authority and National Statistics Office) & compile internal statistics and reports||Registration Data Incorporation/Declaration Data|
|Legal Obligation Public Interest Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (within the limits permitted by law).|
|To process and manage payments transactions (where applicable)||Financial Information Registration Data||Contractual necessity|
|To help you with your specific concerns/requests, including any requests/applications relating to any entity||Registration Contact Details Incorporation/Declaration Data Financial Information (depending on request)||Contractual Necessity Official Authority Public Interest Legal Obligations|
- OTHER SPECIFIC PROCESSING OPERATIONS
Register of Companies:
|Evaluating any request to register any corporate entity or partnership and to be able to keep an accurate database of companies and partnerships (including their members) in line with Our obligations at law (Cap 386 and Subsidiary Legislation 386.18)||Incorporation/Declaration Data|
Contact details of shareholders, directors, company secretaries and/or other members Police conduct and/or certificate of good standing
|Compliance with the legal obligations Contractual Necessity Official Authority Public Interest|
Register of Beneficial Owners:
|PURPOSE OF THE PROCESSING||CATEGORIES OF PERSONAL DATA||LEGAL BASIS FOR PROCESSING|
|To be able to keep an accurate database of beneficial owners of legal entities in line with Our obligations at law (S.L 386.19)||Name Date of Birth Nationality Country of Residence Incorporation/Declaration Data ID Number Beneficial Interest/Role||Compliance with legal obligations Official Authority Public Interest|
|Disclosures Re Companies To disclose relevant details of the beneficial owners of companies to an entity/ies requesting the same (where permitted or required and subject to applicable restrictions).||For entities listed in Subsidiary Legislation 386.19 (7) (1) (a) (certain national competent authorities, the Malta FIAU, national tax authorities, etc.) that request information about the beneficial owners of companies: All the above categories of personal data shall be disclosed by Us in a timely manner, without any restriction and without alerting the company/ies concerned. For entities listed in S.L. 386.19 (7) (1) (b) (subject persons): All the above categories of personal data may be disclosed by Us provided that the request We receive must relate to purposes of carrying out due diligence. For members of the general public as per S.L. 386.19 (7) (1) (c) requesting information on companies, MBR may disclose: name, the month and year of birth, the nationality, the country of residence; and the extent and natureof the beneficial interest of the beneficial owners of a company||Compliance with Legal Obligations (S.L. 386.19 (7)) NB – access to subject persons and the general public may not be granted by MBR, in full or in part, where in exceptional circumstances to be justified by means of documentary evidence and to be determined on a case by case basis, access to such beneficial ownership information would expose the beneficial owner to the risk of fraud, kidnapping, blackmail, violence or intimidation, or where the beneficial owner is a minor or otherwise incapable.|
Should We need to process Your data for a new purpose in the future, which is entirely unrelated to the above, We will inform You of such processing in advance and You may exercise Your applicable rights (as explained below) in relation to such processing.
Finally, do note that without certain Personal Data relating to You, We may not be in the position to provide some or all of the services You expect from Us (including company registration/incorporation and requests for information from Us) or even to guarantee the full functionality of Our Site.
DATA WHICH WE MAKE PUBLICLY AVAILABLE:
MBR is required by Article (1) (d) of the Companies Act (Cap 401 of the Laws of Malta), as well as by the Companies Act (System of Interconnection of Registers) Regulations (S.L 386.18 of the Laws of Malta) to make certain information, which You may provide to Us inter alia for the purposes of company incorporation, including any personal data (such as those pertaining to the name and address of the directors of a company) relating thereto, publicly available. Thus, whenever MBR makes such information public it relies on its legal obligation to do so as a legal basis for processing personal data.
The personal data that we make public in relation to all companies, commercial partnerships as well as other legal organisations registered with Us includes the following:
- A list of shareholders, directors, company secretaries and other persons vested with administration including such details as:
- Residential address
- Business Occupation
When a company is stricken off the register, the MBR shall immediately delete all personal data relating to such company from Our online portal, and such data shall therefore no longer be available to the public. Please note that although such personal data will no longer be available to the public, MBR will still retain such information, and this according to Our retention policy.
For more background information, please read the sections WHAT ARE PERSONAL DATA and WHAT ABOUT INFORMATION RELATING TO COMPANIES? Above.
Please see the table above regarding the Register of Beneficial Owners for more information regarding the rules for how We may disclose information regarding ultimate beneficial owners of companies and how, in certain instances, we are obliged to do so.
ACCURACY OF PERSONAL DATA
All reasonable efforts are made to keep any Personal Data We may hold about You up-to-date and as accurate as possible. You can check the information that We hold about You at any time by contacting Us in the manner explained below. If You find any inaccuracies, we will correct them and where required and in accordance with the law (provided that the law permits such deletion), delete them as necessary. Please see below for a detailed list of Your legal rights in terms of any applicable data protection law.
TRANSFERS TO THIRD COUNTRIES
As a general rule, the data We process about You (collected via the Site, any of our Apps or otherwise) will be stored and processed within the European Union (EU)/European Economic Area (EEA) or any other non-EEA country deemed by the European Commission to offer an adequate level of protection (the so-called ‘white-listed’ countries listed here: https://ec.europa.eu/info/law/law-topic/data-protection_en).
In some cases, it may be necessary for Us to transfer Your Personal Data to a non-EEA country not considered by the European Commission to offer an adequate level of protection (for example to one or more of Our data processors located there).
In such cases, apart from all appropriate safeguards that We implement, in any case, to protect Your Personal Data, we have put in place additional adequate measures. For example, We have ensured that the recipient is bound by the EU Standard Contractual Clauses (the EU Model Clauses) designed to protect Your Personal Data as though it were an intra-EEA transfer. You are entitled to obtain a copy of these measures by contacting Us as explained below
You will be aware that data sent via the Internet may be transmitted across international borders even where sender and receiver of information are located in the same country. We cannot be held responsible for anything done or omitted to be done by You or any third party in connection with any Personal Data prior to Our receiving it including but not limited to any transfers of Personal Data from You to Us via a country having a lower level of data protection than that in place in the European Union, and this, by any technological means whatsoever (for example, WhatsApp, Skype, Dropbox etc.).
Moreover, we shall accept no responsibility or liability whatsoever for the security of Your data while in transit through the Internet unless Our responsibility results explicitly from a law having effect in Malta.
- For the purpose of preventing, detecting or suppressing fraud (for example, if You provide false or deceptive information about Yourself or attempt to pose as someone else, We may disclose any information We may have about You in Our possession so as to assist any type of investigation into Your actions);
- in the event of MBRbeing involved in a restructure, transfer or absorption into another Government department (or similar event analogously applicable to Government agencies);
- to protect and defend Our rights (including the right to property), safety, or those of Our affiliates, of Users of Our Site, of Our members or even Your own;
- to protect against abuse, misuse or unauthorised use of Our Site;
- for any purpose that may be necessary for the performance of any agreement You may have entered into with Us (including the request for provision of services by third parties) or in order to take steps at Your request prior to entering into a contract;
- to comply with any legal obligations such as may arise by way of response to any Court subpoena or order or similar official request for Personal Data; or
- as may otherwise be specifically allowed or required by or under any applicable law, for example, under anti-money laundering legislation or as part of MBR’s obligation to make certain information available to the public through the system of interconnection of EU Business registers at https://e-justice.europa.eu/content_business_registers_at_european_level-105–maximize-en.do (S.L 386.18));
SHARING OF PERSONAL DATA WITH OTHER CATEGORIES OF RECIPIENTS
Any such authorised disclosures will be done in accordance with the Data Protection laws (for example all Our processors are contractually bound by the requirements in the said Data Protection Laws, including a strict obligation to keep any information they receive confidential and to ensure that their employees/personnel are also bound by similar obligations). The said service providers (Our processors) are also bound by a number of other obligations (in particular, Article 28 of the GDPR).
In certain cases, the recipients of Your personal data with whom we share personal data will not be acting on Our behalf but will be acting in their own capacity as entities/data controllers separate and independent from Us (e.g. Government agencies, Malta Financial Services Authority, Financial Intelligence Analysis Unit etc.). We are not responsible for whatever these entities may do with Your personal data and encourage You to read through their respective privacy policies to find out more about how they handle Your personal data.
YOUR PERSONAL DATA WILL NEVER BE SHARED WITH THIRD PARTIES FOR THEIR MARKETING PURPOSES.
|CATEGORY OF RECIPIENT||PURPOSE OF PROCESSING|
|Cloud Service Providers||Hosting of data under state-of-the-art security protocols and our exclusive control|
|IT Service Providers||Maintenance and support of our IT systems/Website(s) – with restricted access and under our strict controls|
|Auditors||Compliance with our auditing obligations – with access granted only to essential personal data|
|Legal Advisors||Compliance with our legal obligations or when necessary for the establishment, exercise or defence of legal claims.|
|Other EU Member State Business Registers under the Business Registers Interconnection System (Directive 2017/1132/EU) and Regulation 2015/884)||Compliance with Our legal obligations|
|Other Government agencies, departments or entities (including the Malta Financial Services Authority and the National Statistics Office) Credit Reference Agencies (eg. Malta Association of Credit Management or CreditInfo) The Malta Police Force||Compliance with legal obligations, in the public interest and/or our exercise of official authority As necessary in the public interest Compliance with legal obligations and/or in the public interest.|
The personal information which We may hold (and/or transfer to any affiliates/partners/subcontractors as the case may be) will be held securely in accordance with Our internal security policy and the law.
We use reasonable efforts to safeguard the confidentiality of any and/or all Personal Data that We may process relating to You and regularly review and enhance Our technical, physical and managerial procedures so as to ensure that Your Personal Data is protected from:
-improper use or disclosure
-unlawful destruction or accidental loss.
To this end We have implemented security policies, rules and technical and organisational measures to protect the Personal Data that We may have under Our control. All our members, staff and data processors (including specific subcontractors, including cloud service providers established within the European Union), who may have access to and are associated with the processing of Personal Data, are further obliged (under contract) to respect the confidentiality of Our Users’ or recipients’ Personal Data as well as other obligations as imposed by the Data Protection Laws.
Despite all the above, we cannot guarantee that a data transmission or a storage system can ever be 100% secure. For more information about Our security measures please contact Us in the manner described below.
As stated above, the said service providers (Our data processors) are also bound by a number of other obligations in line with the Data Protection Laws (particularly, Article 28 of the GDPR).
We will retain Your Personal Data only for as long as is necessary (taking into consideration the purpose for which they were originally obtained). The criteria We use to determine what is ‘necessary’ depends on the particular Personal Data in question and the specific relationship We have with You (including its duration).
Our normal practice is to determine whether there is/are any specific EU and/or Maltese law(s) permitting or even obliging Us to keep certain Personal Data for a certain period of time (in which case We will keep the Personal Data for the maximum period indicated by any such law). For example, the Companies Act (Register of Beneficial Owners) Regulations (S.L 386.19) obliges us to retain Personal Data relating to beneficial owners until the lapse of 5 years after the name of the concerned company has been struck off the register.
Incorporation/Declaration Data (as defined above) will be kept for as long as the legal entity is active. Once the entity is struck off, only minimal information will be kept publicly accessible and this, in line with the principle of data minimisation.
We would also have to determine whether there are any laws and/or contractual provisions that may be invoked against Us by You and/or third parties and if so, what the prescriptive periods for such actions are. In this case, We will keep any relevant Personal Data that We may need to defend Ourselves against any claim(s), challenge(s) or other such action(s) by You and/or third parties for such time as is necessary.
Where Your Personal Data are no longer required by Us (in line with all applicable laws), We will either securely delete or anonymise the Personal Data in question.
Please note that certain laws oblige Us to disclose some personal to other Government entities (for example, the Malta Financial Services Authority and National Statistics Office) or to other EU Member State Business Registries as part of the Business Registers Interconnection System in which case, such entities (as separate controllers) would then determine their own retention policies (which in such cases may be much longer than those described above).
PROCESSING FOR RESEARCH AND STATISTICAL REASONS
Research and statistics using User or recipient information is only carried out so that We may understand Our Users’ and/or recipients’ needs, to develop and improve Our services/activities and/or for tasks carried out in the public interest or under the exercise of official authority representative of MBR’s purpose. In any case, where applicable, We will always ensure to obtain any consent We may legally require from You beforehand. As in all other cases, We will also ensure to implement all appropriate safeguards as may be necessary.
LINKS TO THIRD PARTY SOURCES
Links that We provide to third-party sources (such as websites) are clearly marked and We are not in any way whatsoever responsible for (nor can We be deemed to endorse in any way) the content of such sources (including any applicable privacy policies or data processing operations of any kind). We suggest that You should read the privacy policies of any such third-party sources (including the websites and respective policies or data processing operations of any kind).
When You visit Our Site, we collect certain categories of Personal Data automatically using cookies and similar technologies.
The Site and Our online services (entering into contracts with MBR) are not intended to be used by any persons under the age of eighteen (18) and therefore We will never intentionally collect any Personal Data from such persons unless under a specific legal exemption. If You are under the age of consent, please consult and get Your parent’s or legal guardian’s permission to use the Site and to use Our services.
We shall consider that any Personal Data of persons under the age of eighteen (18) received by Us, shall be sent with the proper authority and that the sender can demonstrate such authority at any time, upon Our request.
With respect to personal data of minors that We process as part of Our legal obligations (for example, where a minor or minors appear as shareholder(s) and/or ultimate beneficial owner(s)), such personal data will be processed by Us with additional layers of protection as required by law. For example, when members of the public enquire about the beneficial owner of a company/ies, should this owner be a minor, we are not obliged to disclose the said information. On the contrary We will examine the facts of the case very carefully before making any disclosure (in whole or in part) and in any case, the general principles of the GDPR will be adhered to at all times.
We do not rely on any decisions taken solely by automated means (in other words, without significant human intervention) – including any profiling. Should this position change in the future (and only as We may be legally permitted to do), You will be notified accordingly.
YOUR RIGHTS UNDER THE DATA PROTECTION LAWS
Before addressing any request, you make with us, we may first need to verify Your identity. In all cases We will try to act on Your requests as soon as reasonably possible.
As explained in the Retention Periods section above, We may need to keep certain Personal Data for compliance with Our legal retention obligations but also to complete transactions that You requested prior to the change or deletion that You requested.
Your various rights at law include:
Your Right of Access
You may, at any time request Us to confirm whether or not We are processing Personal Data that concerns You and, if We are, You shall have the right to access that Personal Data and to the following information:
- What Personal Data We have,
- Why We process them,
- Who We disclose them to,
- How long We intend on keeping them for (where possible),
- Whether We transfer them abroad and the safeguards We take to protect them,
- What Your rights are,
- How You can make a complaint,
- Where We got Your Personal Data from and
- Whether We have carried out any automated decision-making (including profiling) as well as related information.
Upon request, We shall (without adversely affecting the rights and freedoms of others including Our own) provide You with a copy of the Personal Data undergoing processing within one month of receipt of the request, which period may be extended by two months where necessary, taking into account the complexity and number of the requests. We shall inform You of any such extension within one month of receipt of the request, together with the reasons for the delay.
Your Right to Rectification
You have the right to ask Us to rectify inaccurate Personal Data and to complete incomplete Personal Data concerning You. We may seek to verify the accuracy of the data before rectifying it.
Your Right to Erasure (The Right to be Forgotten)
You have the right to ask Us to delete Your Personal Data and We shall comply without undue delay but only where:
- The Personal Data are no longer necessary for the purposes for which they were collected; or
- You have withdrawn Your consent (in those rare instances where We process on the basis of Your consent) and We have no other legal ground to process Your Personal Data; or
- You shall have successfully exercised Your right to object (as explained below); or
- Your Personal Data shall have been processed unlawfully; or
- There exists a legal obligation to which We are subject; or
- Special circumstances exist in connection with certain children’s rights.
In any case, we shall not be legally bound to comply with Your erasure request if the processing of Your Personal Data is necessary:
- for compliance with a legal obligation to which We are subject (including but not limited to Our duty to retain an accurate database of company records and Our data retention obligations);
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in so far as your exercise of this right to erasure is likely to render impossible or seriously impair the achievement of the objectives of such processing;
- for the establishment, exercise or defence of legal claims.
There are other legal grounds entitling Us to refuse erasure requests although the two instances above are the most likely grounds that may be invoked by Us to deny such requests.
Your Right to Data Restriction
You have the right to ask Us to restrict (that is, store but not further process) Your Personal Data but only where:
- The accuracy of Your Personal Data is contested (see the right to data rectification above), for a period enabling Us to verify the accuracy of the Personal Data; or
- The processing is unlawful, and You oppose the erasure of Your Personal Data; or
- We no longer need the Personal Data for the purposes for which they were collected but You need the Personal Data for the establishment, exercise or defence of legal claims; or
- You exercised Your right to object and verification of Our legitimate grounds to override Your objection is pending.
Following Your request for restriction, except for storing Your Personal Data, we may only process Your Personal Data:
- Where We have Your consent (if any exists); or
- For the establishment, exercise or defence of legal claims; or
- For the protection of the rights of another natural or legal person; or
- For reasons of important public interest.
Your Right to Data Portability
You have the right to ask Us to provide Your Personal Data (that You shall have provided to Us) to You in a structured, commonly used, machine-readable format, or (where technically feasible) to have it ‘ported’ directly to another data controller, provided this does not adversely affect the rights and freedoms of others. This right shall only apply where:
Your Right to Withdraw Consent (when We rely on consent)
In the rare instances where We may have relied on Your consent to process Your personal data (which, in any case, we would have obtained in the manner required by the GDPR), You may withdraw any such consent at any time in a manner that is as easy as when You first provided the said consent to Us.
Your Right to Object to Certain Processing
In those cases where We only process Your Personal Data when this is 1.) necessary for the performance of a task carried out in the public interest or in the exercise of Our official authority OR 2.) when processing is necessary for the purposes of the legitimate interests pursued by a third party, You shall have the right to object to processing of Your Personal Data by Us. Where an objection is entered, the processing of data shall cease, unless We as data controller provide compelling and legitimate grounds requiring the continuation of the data processing which outweigh the objections You may have raised.
For the avoidance of all doubt, when We process Your Personal Data when this is necessary for the performance of a contract, when necessary for compliance with a legal obligation to which We are subject or when processing is necessary to protect Your vital interests or those of another natural person, this general right to object shall not subsist.
Your Right to lodge a Complaint
You also have the right to lodge complaints with the appropriate Data Protection Supervisory Authority. The competent authority in Malta is the Office of the Information and Data Protection Commissioner (OIDPC).
We kindly ask that You please attempt to resolve any issues You may have with Us first (even though, as stated above, you have a right to contact the competent authority at any time).
WHAT WE MAY REQUIRE FROM YOU
As one of the security measures We implement, before being in the position to help You exercise Your rights as described above We may need to verify Your identity to ensure that We do not disclose to or share any Personal Data with any unauthorised individuals.
TIME LIMIT FOR A RESPONSE
We try to reply to all legitimate requests within one month from receiving them. In some particular cases (for example, if the matter is particularly complex or if You send Us multiple requests), it may take Us longer than a month. In such cases, we will notify You accordingly and keep You updated.
If You have any questions/ comments about privacy or should You wish to exercise any of Your individual rights, please contact Us at: info.mbr.@mbr.mt or by writing to Malta Business Registry, AM Business Centre, Triq il-Labour, Zejtun ZTN 2401 by phoning Us using telephone number
MBR’s Data Protection Officer is Dr. Geraldine Ann Spiteri Lucas who can be contacted directly at email@example.com