Home Privacy

Privacy

Last updated 31 October 2026

This notice explains what personal data MaltaBusinessDirectory.com collects and why. The data controller is Malta Business Directory, The Strand, Malta (“we”). Contact: hello@maltabusinessdirectory.com.

Visitors

We don't use advertising or tracking cookies, and we don't run third-party analytics. We count views of each listing and clicks on its phone, website, email and directions links, as plain totals per day; nothing about you is stored with them. To limit abuse we use a one-way hash of your IP address, kept for no more than two days. Our forms may use Cloudflare Turnstile to block bots.

If you send a business a message, your name, email, phone and message go to that business so it can reply, and a copy stays with us for 30 days. Maps load from Google Maps only when you choose to show one, and Google then receives your IP address.

The only cookie the site itself sets is mbd_session, when a business owner signs in. It keeps you signed in for up to 30 days and is strictly necessary for that, so we don't ask for consent.

Businesses and the people who list them

• Listing details (business name, address, phone, website, business email, hours, photos) are published on the site, because that is the point of a directory. Basis: our agreement with you (GDPR art. 6(1)(b)).
• Your own name, role and email are used to confirm the listing, to let you sign in and manage it, and to email you about it. They are not published. Basis: our agreement with you.
• Payments are handled by Stripe, which receives your card details directly. We keep a record of what you bought and when, for our accounts (legal obligation, art. 6(1)(c)).
• We don't sell or rent personal data, and we don't sell contact lists.

Who processes data for us

• Cloudflare (hosting, database, photo storage, bot check)
• Brevo (sending our emails)
• Stripe (payments)
• Google (maps, only when you open one)

Some of these companies may process data outside the EU under the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

How long we keep it

Listings stay while they're live and are deleted from public view as soon as they're removed. Unconfirmed submissions are deleted after 14 days, sign-in links after 2 days, copies of sent emails after 30 days. Payment records are kept as long as Maltese accounting law requires.

Your rights

You can ask to see, correct or delete your personal data, to restrict or object to its use, or to get a copy of it. Email us and we'll answer within a month. You can also complain to the Information and Data Protection Commissioner in Malta (idpc.org.mt).