1. Who is responsible for your data
The data controller is [COMPANY LEGAL NAME], [REGISTERED ADDRESS, MALTA], company registration number [REGISTRATION NUMBER].
For anything in this policy, write to privacy@maltamotors.com. [DPO CONTACT — DELETE THIS LINE IF NO DPO IS APPOINTED]
This policy covers maltamotors.com and the service behind it. It applies alongside the Terms & Conditions.
2. What we collect, and when
When you just look around
You do not need an account to browse or search, and we do not ask you to identify yourself to do it. Our web server records each request in a log — the time, the page, the response code, the browser's user-agent string and the IP address the request came from. That is ordinary server operation: it is how a fault gets diagnosed and how an attack gets noticed.
When you create an account
- your email address and a password (we store only a bcrypt hash of the password — the password itself is never written down anywhere);
- a display name, and optionally a phone number, a photo and a short bio;
- for a dealer account: the business name, address, website and logo;
- your language preference, whether you want email alerts for saved searches, and whether you have agreed to receive marketing email — with the date you agreed;
- for each active sign-in, a session record: a hash of the session token, the IP address and the browser user-agent it was created from, and its expiry. That record is what lets you stay signed in, and what lets a session be revoked.
When you publish an advert
Everything you type into the advert and every photograph you upload. An advert is a public document: it is visible to anyone, indexed by search engines, and shown with a preview when someone shares the link. The contact phone and email you provide for the advert can be revealed by anyone, without an account. Buyers can call, email or open WhatsApp using your number. Your account login email is not automatically published. Please do not put anything in the description or the photographs that you do not want to be public — a house number, a number plate you would rather not show, a face.
When you contact a seller
- your name, email address and, if you supply one, your phone number;
- the subject and text of your message, and the replies in that conversation;
- which vehicle it was about;
- the IP address and browser user-agent the enquiry was sent from. We keep these to investigate abuse of the enquiry form — spam runs, harassment, fraudulent approaches to sellers — and for nothing else.
Our own usage statistics
We count what happens on the site: an advert was viewed, an enquiry was sent, an advert was published or withdrawn. These records deliberately exclude the things that would make them personal — no name, no email address, no phone number, no message text, no subject line. The IP address is hashed with a secret salt before it is stored, so the stored value cannot be turned back into an address. This is the only measurement on the site; it runs on our own servers and the data goes nowhere else.
4. What we keep in your browser
Instead of cookies, the site uses your browser's local storage — data that stays on your device, is never attached to a request, and is never sent to us automatically. It is readable only by pages on maltamotors.com. Clearing your browser's site data removes all of it, which signs you out.
| Stored as | What it is for |
|---|---|
mm.access_token, mm.refresh_token,
mm.refresh_expires_at, mm.refresh.lock |
Keeps you signed in, and renews the session quietly in the background. Removed when you sign out. |
mm.favourites |
The vehicles you have hearted. Held in your browser, so you can save vehicles without an account. |
mm.saved-searches,
mm.saved-searches.owner |
Your saved searches and which account they belong to, so one person's searches never appear to the next person signed in on a shared computer. |
mm.recent.makes.<type>,
mm.recent.models.<type>.<make> |
The makes and models you last picked, per vehicle type, so they sit at the top of the list next time. One key per vehicle type, and one per make whose models you have chosen from. |
mm.activeTab |
Which tab you last had open on a page, so it is still selected when you come back. |
mm.reset-email |
Carries the address you typed from the sign-in page to the password-reset page, so you do not retype it. Stored for that tab only and erased as soon as it is read — deliberately not put in the URL, where it would end up in logs and history. |
5. Why we use it, and our legal basis
Under the GDPR every use of personal data needs a lawful basis. Ours are:
| What we do | Legal basis |
|---|---|
| Run your account, publish your adverts, deliver enquiries and replies, send saved-search alerts you asked for | Performance of our contract with you (Art. 6(1)(b)) |
| Keep the site secure: rate limits, abuse investigation, fraud prevention, server logs | Our legitimate interests in a service that is not overrun by fraud and abuse (Art. 6(1)(f)) — balanced by keeping these records short-lived and narrow |
| Measure how the site is used, with hashed IP addresses and no contact details | Our legitimate interests in understanding and improving the service (Art. 6(1)(f)). No consent banner is required because no cookie or similar identifier is stored on your device for this |
| Send you marketing email | Your consent (Art. 6(1)(a)), given by ticking the optional box — never a condition of registering, and withdrawable at any time |
| Keep records we are obliged to keep, and respond to lawful requests | Legal obligation (Art. 6(1)(c)) |
We do not make any decision about you by automated means that produces a legal effect or similarly significantly affects you. We do not profile you for advertising.
7. Where it is stored
All of it is stored on servers in the European Union ([HOSTING PROVIDER AND DATA-CENTRE LOCATION]), on machines we operate ourselves. Backups are written to the same location.
We do not transfer personal data outside the European Economic Area. If that ever changes we will update this policy first and name the safeguard relied on.
8. How long we keep it
| What | Kept for |
|---|---|
| Your account and profile | Until you ask us to delete it |
| A published advert | Live for 90 days, then it expires and leaves search. The record and its photographs stay with your account so you can re-publish, and go when the account goes |
| Enquiries and the messages in them | 24 months after the last message in that conversation |
| The IP address and user-agent recorded with an enquiry | Deleted with the enquiry |
| Sign-in session records | Deleted 7 days after the session expires or is revoked |
| Saved searches | Until you delete them. The log of which alerts were already sent: 90 days |
| Usage statistics (hashed IP, no contact details) | 25 months |
| Web-server and application logs | 14 days |
| Backups | 7 daily, 4 weekly and 6 monthly copies. A deletion reaches the live system at once and ages out of the backups on that schedule |
9. Your rights
Under the GDPR you can ask us to:
- show you the personal data we hold about you, and give you a copy;
- correct anything wrong or incomplete;
- delete it — including your whole account;
- restrict what we do with it while a dispute about it is resolved;
- hand it over to you, or to another service, in a machine-readable form;
- stop using it where we rely on legitimate interests — you can object, and we must then show a compelling reason to continue or stop;
- withdraw consent to marketing email at any time. Every marketing email also carries an unsubscribe link, and withdrawing does not affect anything sent before.
How to ask. Some of this you can do yourself: edit your profile, delete a saved search, turn off alerts. For the rest — taking down an advert, a copy of your data, deletion of your account, or an objection — write to privacy@maltamotors.com from the address on the account. There is no self-service button for account deletion yet; we do it by hand, and we answer within one month. It is free.
Two honest limits. Deleting your account does not retract messages already delivered to a seller's inbox — we cannot reach into someone else's mailbox. And a conversation has two sides: erasing your side of an exchange may leave the other person's copy of what they wrote.
If you are not satisfied with how we have handled it, you can complain to Malta's supervisory authority, the Information and Data Protection Commissioner (idpc.org.mt), or to the authority in the EU country where you live.
10. How we protect it
- The whole site is served over HTTPS and nothing is offered over plain HTTP; browsers are told to refuse the insecure version for a year (HSTS).
- Passwords are stored as bcrypt hashes. Session, password-reset and email-verification tokens are stored as SHA-256 hashes — we hold no copy of any of them that could be used to sign in as you.
- A strict Content-Security-Policy means the browser will not load a script, stylesheet, font or image from another origin, which is what makes the “no third-party code” promise enforceable rather than a matter of trust. The only exceptions it allows are images your own browser has generated: the previews of photos you are about to upload, which never leave your device until you publish the advert.
- Sign-in, registration and the enquiry form are rate-limited per IP address to slow credential stuffing and spam.
- Usage statistics never receive an IP address in the clear, and never receive message content or contact details — that separation is enforced in the code and covered by tests.
- Access to the servers is restricted to named administrators using key-based authentication, and backups are held on the same restricted infrastructure.
No system is perfect. If a breach ever puts your rights at risk we will notify the IDPC within 72 hours and tell you directly where the law requires it. If you find a weakness, please tell us at security@maltamotors.com.
11. Children
This service is for adults. You must be 18 or over to hold an account, and we do not knowingly collect data from children. If you believe a child has given us personal data, write to privacy@maltamotors.com and we will delete it.
12. Changes to this policy
When this policy changes, the date at the top of the page changes with it. If a change materially affects how we use your data we will tell registered users by email before it takes effect — we will not quietly widen what we do with data you have already given us.
13. Contact
Data protection questions, and any request about your rights: privacy@maltamotors.com.
Everything else: support@maltamotors.com.
Security reports: security@maltamotors.com.
Postal address: [REGISTERED ADDRESS, MALTA].
Supervisory authority: Information and Data Protection Commissioner, Floriana, Malta — idpc.org.mt.