Privacy Policy
Last updated: 29 September 2026
1. Who we are
Malta Hands ("Malta Hands", "we", "us") operates www.maltahands.com, a directory where Providers advertise local services in Malta and Customers find them.
You can contact us about privacy at privacy@maltahands.com.
2. Data we collect
From you directly
- Account data from Google Sign-In: your name, email address and profile picture. We never receive your Google password, and we do not ask for identity documents.
- Role and profile data: whether you are a Customer or a Provider. For Providers, we also hold your approval status and the advertisements you publish: service, cities served, description, price, opening hours, contact details and images.
- Contact-access records: when a signed-in Customer reveals a Provider's contact details, we record who revealed them, for which advertisement, and when. The Provider does not see who revealed their details.
- Reviews and reports: ratings, review text and photos, Provider responses, and reports about advertisements (the reason and a description).
- Technical data: a session cookie that keeps you signed in, and server logs (IP address, requested page, timestamp).
From public sources (Providers not yet registered)
To invite businesses to join, we may collect publicly available business contact details from public business directories, the Provider's own website or social media page, and supplier stockist lists. These details are the business name, service category, locality, business phone and business email.
We use these details only to contact the business once and invite it to join. We do not publish a Provider's advertisement until the Provider has created or claimed the listing and accepted our terms. If there is no reply within 60 days, or if the business asks us to, we delete these details. When we first contact a business, we tell it where we obtained the details and how to object.
3. Why we use your data and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating your account, publishing your advertisements, showing Provider contact details to Customers who request them, displaying reviews | Performance of a contract (our Terms of Use) |
| Moderating content, handling reports, approving or blocking Providers, keeping an admin audit log | Legitimate interest in keeping the directory safe and trustworthy |
| Security: session cookies and server logs | Legitimate interest in protecting the service; the session cookie is strictly necessary |
| Inviting publicly listed businesses to join (section 2) | Legitimate interest in growing a local services directory, assessed against the rights of the business owner |
| Analytics through Google Analytics | Your consent, given through the cookie banner |
| Keeping records needed for legal claims or obligations | Legal obligation, or legitimate interest in establishing and defending legal claims |
We do not make decisions about you based solely on automated processing, including profiling.
4. Cookies
We use a small number of cookies and similar technologies:
- Strictly necessary: these keep you signed in, keep the site secure and remember your cookie choices. The site cannot work properly without them, so they do not need your consent. They expire when you sign out or after a limited period.
- Analytics (optional): these help us understand how visitors use the site so we can improve it. We use them only if you click "Accept" in the cookie banner. They may collect information such as the pages you visit, how you arrived at the site, your approximate location, and your device and browser type. We do not use them for advertising. If you click "Reject", no analytics cookies are set.
You can change or withdraw your consent at any time through the "Cookie settings" link at the bottom of every page. If you withdraw consent, we stop using analytics cookies from that point on.
5. Who sees or receives your data
- Other users: your display name, reviews and, for Providers, published advertisements are visible on public pages. A Provider's contact details are shown only to signed-in Customers who choose to reveal them for a specific advertisement. They are not indexed by search engines.
- Processors acting on our instructions: our hosting provider, Netcup GmbH (Germany, EU), and our database provider, MongoDB Atlas (EU region). Both act under data processing agreements with us.
- Google: Google acts as the sign-in provider and, only if you consent, as the analytics provider.
- Authorities: only where the law requires it.
We do not sell personal data, and we do not share it with advertisers or data brokers.
6. International transfers
Our servers and database are in the EU. Google may process data in the United States. Google is certified under the EU–US Data Privacy Framework, and where needed we also rely on the European Commission's Standard Contractual Clauses.
7. How long we keep data
| Data | Retention period |
|---|---|
| Account and advertisements | While your account is active; deleted or anonymised within 30 days after you close it |
| Contact-access records | 12 months |
| Reviews | While the reviewed advertisement is online, or until the reviewer deletes them |
| Reports and moderation log | 24 months after the case is resolved |
| Server logs | 30 days |
| Contact details of businesses invited from public sources | 60 days if there is no reply; deleted immediately if the business objects |
We may keep specific records for longer only where we need them for a legal claim or to meet a legal obligation.
8. Reviews
Reviews must describe a genuine experience. They must not include personal details such as phone numbers or home addresses, insults, or unverified accusations. We may remove reviews that break these rules. Providers can respond to reviews and can report any review they think is unfair.
9. Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it;
- rectification of inaccurate data;
- erasure of your data, subject to section 7;
- restriction of processing;
- data portability;
- withdraw consent at any time, without affecting processing that took place before you withdrew.
Right to object: where we rely on legitimate interest, including when we have contacted your business from public sources, you can object at any time. We will then stop, unless we have compelling legitimate grounds or need the data for a legal claim.
To exercise any of these rights, email privacy@maltahands.com. We reply within one month. If you are unhappy with our reply, you can complain to Malta's Information and Data Protection Commissioner (IDPC).
10. Security
We protect your data with encrypted connections (HTTPS), access controls limited to authorised administrators, and processors that hold appropriate security certifications.
11. Age
Malta Hands is intended for users aged 18 or over. We do not knowingly collect data from children.
12. Changes
If we make significant changes to this policy, we will update this page and notify registered users.