PRIVACY POLICY
Last Updated: [08/10/2025]
1. INTRODUCTION
This Privacy Policy governs the manner in which Stella Advisory Malta Ltd (hereinafter “the Company”, “we”, “us”, or “our”), a company duly registered and incorporated under the laws of Malta, collects, uses, maintains, and discloses information collected from users (hereinafter “User”, “you”, or “your”) of the stellaradvisorymalta.com website and any related services, features, or content offered by the Company (collectively, the “Service”).
This Privacy Policy applies to the Service and all products and services offered by Stella Advisory Malta Ltd. By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by the terms of this Privacy Policy.
This Privacy Policy is issued in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – “GDPR”), the Data Protection Act (Chapter 586 of the Laws of Malta), and all other applicable data protection legislation in the European Union and Malta.
2. DEFINITIONS
For the purposes of this Privacy Policy, the following terms shall have the meanings set forth below:
“Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
“Processing” means any operation or set of operations performed on Personal Data or sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
“Data Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data. For the purposes of this Privacy Policy, the Company is the Data Controller of your Personal Data.
“Data Processor” means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Data Controller.
“Data Subject” means any living individual who is the subject of Personal Data and who is using our Service.
“Service” means the stellaradvisorymalta.com website and any related services, applications, features, or content provided by the Company.
“Usage Data” means data collected automatically, either generated by the use of the Service or from the Service infrastructure itself, including but not limited to Internet Protocol addresses, browser types, browser versions, pages visited, time and date of visits, time spent on pages, unique device identifiers, and other diagnostic data.
“Cookies” means small data files stored on your device (computer, tablet, or mobile device) that contain information about your browsing activity.
“Third Party” means any natural or legal person other than the Data Subject, the Data Controller, the Data Processor, and persons who, under the direct authority of the Data Controller or Data Processor, are authorized to process Personal Data.
“Consent” means any freely given, specific, informed, and unambiguous indication of the Data Subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the Processing of Personal Data relating to them.
“Supervisory Authority” means an independent public authority established by an EU Member State to monitor the application of the GDPR and protect data protection rights.
In Malta, this is the Office of the Information and Data Protection Commissioner.
3. DATA CONTROLLER INFORMATION
Stella Advisory Malta Ltd
86A, Triq Leli Falzon
NXR2609, Naxxar
Malta
Email: hello@stellaradvisorymalta.com
Telephone: 00356 79657076
4. TYPES OF DATA COLLECTED
4.1 Personal Data
While using our Service, we may request that you provide certain personally identifiable information that can be used to contact or identify you. This Personal Data may include, but is not limited to:
4.2 Usage Data
We automatically collect certain information when you access and use our Service (“Usage Data”). This Usage Data may include:
4.3 Tracking and Cookies Data
We employ cookies and similar tracking technologies to monitor activity on our Service and store certain information. Technologies used may include:
You may instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to access or use certain portions of our Service. You can manage your cookie preferences through your browser settings.
For detailed information about the cookies we use and their purposes, please refer to our separate Cookie Policy.
4.4 Information from Third-Party Sources
We may receive information about you from third-party sources, including:
5. PURPOSES AND LEGAL BASIS FOR PROCESSING PERSONAL DATA
5.1 Purposes of Processing
Stella Advisory Malta Ltd processes your Personal Data for the following purposes:
5.2 Legal Basis for Processing under GDPR
In accordance with Article 6 of the GDPR, our legal basis for collecting and processing your Personal Data depends on the specific data collected and the context in which we collect it. We process your Personal Data only when we have a valid legal basis to do so:
a) Contractual Necessity (Article 6(1)(b) GDPR)
Processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract. This includes:
b) Consent (Article 6(1)(a) GDPR)
You have provided explicit, freely given, specific, informed, and unambiguous consent for us to process your Personal Data for one or more specific purposes, such as:
You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
c) Legitimate Interests (Article 6(1)(f) GDPR)
Processing is necessary for the purposes of our legitimate interests or those of a third party, except where such interests are overridden by your fundamental rights and freedoms. Our legitimate interests include:
We have conducted a legitimate interest assessment to ensure that our processing does not override your rights and interests.
d) Legal Obligation (Article 6(1)(c) GDPR)
Processing is necessary to comply with legal obligations to which we are subject under EU or Member State law, including:
e) Vital Interests (Article 6(1)(d) GDPR)
Processing is necessary to protect your vital interests or those of another natural person, particularly in emergency situations.
f) Public Interest (Article 6(1)(e) GDPR)
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (where applicable).
5.3 Special Categories of Personal Data
We do not generally process special categories of Personal Data as defined in Article 9 GDPR (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation) unless:
6. DATA SHARING AND DISCLOSURE
6.1 Service Providers and Data Processors
We may share your Personal Data with third-party service providers who perform services on our behalf. These Data Processors act on our instructions and are contractually bound under Data Processing Agreements compliant with Article 28 GDPR. Categories of processors include:
All Data Processors are required to:
6.2 Business Transfers
In the event that Stella Advisory Malta Ltd is involved in a merger, acquisition, reorganization, asset sale, bankruptcy, insolvency, or similar business transaction, your Personal Data may be transferred as part of that transaction. We will:
6.3 Legal Requirements and Protection of Rights
We may disclose your Personal Data if required to do so by EU or Member State law, or in response to valid requests by public authorities or regulatory bodies, including:
Any such disclosure will be limited to what is necessary and proportionate to fulfill the specific purpose.
6.4 Group Companies
We may share your Personal Data with companies within our corporate group for:
Such sharing is governed by intra-group data sharing agreements and appropriate safeguards.
6.5 With Your Consent
We may disclose your Personal Data for any other purpose with your explicit and informed consent.
6.6 Anonymized and Aggregated Data
We may share anonymized or aggregated data that does not constitute Personal Data and cannot be used to identify you. Such data is not subject to this Privacy Policy.
7. INTERNATIONAL DATA TRANSFERS
7.1 Transfers Outside the EEA
Your Personal Data may be transferred to, processed, and stored in countries outside the European Economic Area (EEA), including countries that may not provide an equivalent level of data protection as recognized under EU law.
7.2 Transfer Safeguards
When we transfer Personal Data outside the EEA, we ensure appropriate safeguards are in place in accordance with Chapter V of the GDPR, including:
a) Adequacy Decisions (Article 45 GDPR)
b) Standard Contractual Clauses (Article 46(2)(c) GDPR)
c) Binding Corporate Rules (Article 47 GDPR)
d) Approved Codes of Conduct and Certification Mechanisms (Article 46(2)(e) and
(f) GDPR)
e) Derogations for Specific Situations (Article 49 GDPR)
7.3 Right to Information
You have the right to obtain information about the safeguards we have put in place for international transfers. You may request a copy of the relevant safeguards by contacting us.
7.4 Transfer Impact Assessment
We conduct transfer impact assessments to evaluate whether the safeguards we rely upon ensure an adequate level of protection for your Personal Data, taking into account the laws and practices of the destination country.
8. DATA RETENTION
8.1 Retention Principles
Stella Advisory Malta Ltd will retain your Personal Data only for as long as necessary to fulfill the purposes for which it was collected, in accordance with Article 5(1)(e) GDPR (storage limitation principle). We determine retention periods based on:
8.2 Specific Retention Periods
a) Account and Customer Data
b) Transaction and Financial Records
c) Marketing and Communication Data
d) Usage and Analytics Data
e) Legal and Compliance Records
f) Contract-Related Data
g) Correspondence and Support Records
8.3 Deletion and Anonymization
Upon expiration of the retention period, we will:
8.4 Exceptions
We may retain Personal Data for longer periods if:
9. DATA SECURITY
9.1 Security Obligations
In accordance with Article 32 GDPR, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account:
9.2 Technical Security Measures
Our technical security measures include:
a) Encryption
b) Access Controls
c) Network Security
d) System Security
e) Data Protection
9.3 Organizational Security Measures
Our organizational security measures include:
a) Policies and Procedures
b) Personnel Security
c) Physical Security
d) Governance
9.4 Data Breach Response
In the event of a Personal Data breach, we will:
a) Internal Response (within 24 hours)
b) Notification to Supervisory Authority (within 72 hours)
c) Notification to Data Subjects (without undue delay)
d) Remediation and Prevention
9.5 Limitations and User Responsibilities
While we implement robust security measures, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security.
Your Responsibilities:
9.6 Security Audits
We conduct regular security audits and assessments, including:
10. YOUR DATA PROTECTION RIGHTS UNDER GDPR
10.1 Overview of Rights
As a Data Subject under the GDPR, you have the following rights regarding your Personal Data. These rights are not absolute and may be subject to limitations and conditions as specified in the GDPR.
10.2 Right of Access (Article 15 GDPR)
You have the right to obtain from us:
a) Confirmation of whether we process your Personal Data
b) Access to your Personal Data including:
c) A copy of your Personal Data (the first copy is provided free of charge; additional copies may incur a reasonable administrative fee)
10.3 Right to Rectification (Article 16 GDPR)
You have the right to obtain correction of inaccurate Personal Data concerning you without undue delay. You also have the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.
10.4 Right to Erasure / Right to be Forgotten (Article 17 GDPR)
You have the right to obtain erasure of your Personal Data without undue delay where one of the following grounds applies:
a) The Personal Data is no longer necessary in relation to the purposes for which it was collected
b) You withdraw consent on which processing is based and there is no other legal ground for processing
c) You object to processing under Article 21(1) and there are no overriding legitimate grounds for processing
d) You object to processing for direct marketing purposes under Article 21(2)
e) The Personal Data has been unlawfully processed
f) The Personal Data must be erased to comply with a legal obligation under EU or Member State law
g) The Personal Data was collected in relation to the offer of information society services to a child
Exceptions: This right does not apply where processing is necessary for:
10.5 Right to Restriction of Processing (Article 18 GDPR)
You have the right to obtain restriction of processing where one of the following applies:
a) You contest the accuracy of Personal Data (for a period enabling us to verify accuracy)
b) The processing is unlawful and you oppose erasure and request restriction instead
c) We no longer need the Personal Data for processing purposes, but you require it for legal claims
d) You have objected to processing pending verification of whether our legitimate grounds override yours
When processing is restricted, Personal Data may only be processed (except for storage) with your consent or for legal claims, protection of rights of another person, or important public interest reasons.
10.6 Right to Data Portability (Article 20 GDPR)
You have the right to:
a) Receive Personal Data concerning you in a structured, commonly used, and machine-readable format (e.g., CSV, JSON, XML)
b) Transmit that data to another controller without hindrance from us
c) Have Personal Data transmitted directly from us to another controller, where technically feasible
This right applies only where:
This right does not adversely affect the rights and freedoms of others.
10.7 Right to Object (Article 21 GDPR)
a) General Right to Object
You have the right to object, on grounds relating to your particular situation, to processing of Personal Data concerning you based on:
We shall no longer process Personal Data unless we demonstrate compelling legitimate grounds for processing which override your interests, rights, and freedoms, or for establishment, exercise, or defense of legal claims.
b) Direct Marketing Objection
You have the absolute right to object to processing of your Personal Data for direct marketing purposes at any time, including profiling related to direct marketing. When you object to direct marketing, we will cease processing for such purposes.
c) Scientific/Historical Research and Statistics
You have the right to object, on grounds relating to your particular situation, to processing for scientific or historical research purposes or statistical purposes under Article 89(1) GDPR, unless processing is necessary for a task carried out for reasons of public interest.
10.8 Right Not to be Subject to Automated Decision-Making (Article 22 GDPR)
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless such decision:
a) Is necessary for entering into or performance of a contract
b) Is authorized by EU or Member State law with suitable safeguards
c) Is based on your explicit consent
Where automated decision-making is permitted, you have the right to:
10.9 Right to Withdraw Consent (Article 7(3) GDPR)
Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent:
10.10 Right to Lodge a Complaint (Article 77 GDPR)
You have the right to lodge a complaint with a supervisory authority, in particular:
Malta Supervisory Authority:
Office of the Information and Data Protection Commissioner
Level 2, Airways House
High Street, Sliema SLM 1549
Malta
Telephone: +356 2328 7100
Email: idpc.info@idpc.org.mt
Website: https://idpc.org.mt
EU Data Protection Authorities:
A list of supervisory authorities across the EU can be found at: https://edpb.europa.eu/about-edpb/about-edpb/members_en
This right is without prejudice to any other administrative or judicial remedy.
10.11 Exercising Your Rights
How to Exercise Your Rights:
To exercise any of your data protection rights, please contact us using the information provided in Section 3 or Section 20.
Your Request Should Include:
Verification of Identity:
To protect your privacy and security, we may require verification of your identity before processing requests. This may include:
Response Timeframe:
We will respond to your request:
If we extend the response period, we will inform you within one month of receiving your request and explain the reasons for the delay.
Free of Charge:
Exercising your rights is generally free of charge. However, we may charge a reasonable administrative fee or refuse to act on a request if it is:
If we refuse your request, we will explain the reasons and inform you of your right to complain to a supervisory authority.
Limitations:
There may be legal reasons why we cannot fulfill certain requests (e.g., legal obligations to retain data, establishment of legal claims). We will explain any such limitations in our response.
11. THIRD-PARTY SERVICES
11.1 Use of Third-Party Services
We use carefully selected third-party service providers to enhance our Service. These providers are located within the EEA or have appropriate safeguards in place for international data transfers.
11.2 Analytics Services
Google Analytics
We use Google Analytics, a web analytics service provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
Purpose: To analyze how users interact with our Service and improve user experience
Data Collected:
Legal Basis: Contractual necessity (Article 6(1)(b) GDPR) for processing payments
Payment Processors Used:
Data Processing Agreement: We maintain Data Processing Agreements with all payment processors in accordance with Article 28 GDPR
11.5 Communication Services
We may use third-party email and communication platforms to send you service-related communications, newsletters, and marketing materials.
Services Used:
Legal Basis:
Your Rights: You can unsubscribe from marketing communications at any time using the unsubscribe link in emails or by contacting us directly.
11.6 Customer Relationship Management (CRM)
We use CRM systems to manage customer relationships, track interactions, and improve our services.
Purpose: To maintain customer records, track service history, and provide better support
Legal Basis: Legitimate interests (Article 6(1)(f) GDPR) in managing customer relationships and contractual necessity (Article 6(1)(b) GDPR)
11.7 Social Media Plugins
Our Service may include social media features and plugins (e.g., Facebook, LinkedIn, Twitter buttons) that enable you to share content or interact with social media platforms.
Data Collection: These features may collect your IP address, pages visited, and set cookies. Social media features are either hosted by the respective third party or hosted directly on our Service.
Legal Basis: Legitimate interests (Article 6(1)(f) GDPR) in enabling social sharing and engagement
Your Rights: Your interactions with social media plugins are governed by the privacy policies of the respective social media platforms. We encourage you to review their privacy policies.
11.8 Third-Party Service Provider Obligations
All third-party service providers:
11.9 Changes to Third-Party Services
We may change or add third-party service providers from time to time. We will update this Privacy Policy to reflect any significant changes and ensure all providers meet our data protection standards.
12. COOKIES POLICY
12.1 What Are Cookies
Cookies are small text files placed on your device when you visit our Service. They help us provide you with a better experience by remembering your preferences and understanding how you use our Service.
12.2 Types of Cookies We Use
a) Strictly Necessary Cookies
These cookies are essential for the operation of our Service. They enable core functionality such as security, network management, and accessibility.
b) Analytical/Performance Cookies
These cookies allow us to analyze how visitors use our Service, enabling us to improve functionality and performance.
c) Functional Cookies
These cookies enable enhanced functionality and personalization, such as remembering your preferences and settings.
d) Targeting/Advertising Cookies
These cookies are used to deliver relevant advertisements and track advertising campaign effectiveness.
12.3 Cookie Consent
In accordance with the ePrivacy Directive (Directive 2002/58/EC) and Maltese law, we obtain your consent before placing non-essential cookies on your device.
Cookie Consent Banner:
Granular Control: You can accept or reject cookies by category (analytical, functional, advertising) through our cookie consent banner.
12.4 Managing Cookies
Browser Settings:
You can control and manage cookies through your browser settings. Most browsers allow you to:
Browser-Specific Instructions:
Opt-Out Tools:
12.5 Impact of Disabling Cookies
If you disable or reject cookies, some features of our Service may not function properly. Strictly necessary cookies cannot be disabled without severely affecting the functionality of the Service.
12.6 Third-Party Cookies
Third-party service providers (such as Google Analytics and Google Ads) may place cookies on your device when you use our Service. We do not control these cookies, and they are subject to the third party’s privacy policy.
12.7 Do Not Track Signals
Some browsers include a “Do Not Track” (DNT) feature. Currently, there is no industry-wide standard for responding to DNT signals. Our Service does not currently respond to DNT signals, but we respect your cookie preferences set through our cookie consent banner.
13. CHILDREN’S PRIVACY
13.1 Age Restriction
Our Service is not intended for, and we do not knowingly collect Personal Data from, children under the age of 16 years (“Children” or “Minors”), in accordance with Article 8 GDPR.
13.2 Parental Consent
If we become aware that we have collected Personal Data from a child under 16 without verification of parental consent, or if a parent or guardian becomes aware that their child has provided us with Personal Data without consent, we will:
13.3 Verification Measures
We implement age verification measures where appropriate to prevent children from providing Personal Data without parental consent.
13.4 Reporting
If you are a parent or guardian and believe that your child has provided us with Personal Data without your consent, please contact us immediately using the contact information in Section 20. Please provide:
13.5 Educational Settings
If we offer services in educational or school settings that may involve children under 16, we will:
14. DATA PROTECTION IMPACT ASSESSMENTS (DPIA)
In accordance with Article 35 GDPR, we conduct Data Protection Impact Assessments when we introduce new processing operations that are likely to result in a high risk to the rights and freedoms of individuals.
14.1 When We Conduct DPIAs
We conduct DPIAs for processing operations that involve:
14.2 DPIA Process
Our DPIA process includes:
14.3 Consultation
Where a DPIA indicates that processing would result in high risk in the absence of measures to mitigate the risk, we consult with the Office of the Information and Data Protection Commissioner before commencing processing.
15. AUTOMATED DECISION-MAKING AND PROFILING
15.1 Automated Processing
We may use automated processing and profiling techniques to:
15.2 Profiling Activities
Profiling involves automated processing of Personal Data to evaluate certain personal aspects, such as:
15.3 Legal Basis
Our automated decision-making and profiling activities are based on:
15.4 Solely Automated Decisions with Legal or Similar Significant Effects
We do not currently engage in solely automated decision-making that produces legal effects or similarly significantly affects you, as contemplated by Article 22 GDPR. If we introduce such processing in the future, we will:
15.5 Your Rights
You have the right to:
16. MARKETING COMMUNICATIONS
16.1 Types of Marketing
We may send you marketing communications about our services, special offers, news, and other information we believe may interest you, including:
16.2 Legal Basis
Existing Customers (Soft Opt-In):
If you are an existing customer, we may send you marketing communications about similar products or services based on legitimate interests (Article 6(1)(f) GDPR), provided you have not opted out. This is known as the “soft opt-in” under the ePrivacy Directive.
New Customers and Newsletter Subscribers:
For individuals who are not existing customers, we will only send marketing communications based on your explicit consent (Article 6(1)(a) GDPR).
16.3 Consent
When we obtain your consent for marketing communications, we ensure it is:
16.4 Opt-Out and Unsubscribe
You have the absolute right to opt out of marketing communications at any time:
Unsubscribe Methods:
Processing Time: We will process your opt-out request within 5 business days.
Service Communications: Please note that opting out of marketing does not affect essential service communications (e.g., account notifications, transaction confirmations, security alerts), which we send based on contractual necessity.
16.5 Suppression List
When you opt out, we retain your contact information on a suppression list to ensure we don’t inadvertently send you marketing communications in the future. This retention is based on our legitimate interests in complying with your preferences.
16.6 Third-Party Marketing
We do not sell, rent, or share your Personal Data with third parties for their own direct marketing purposes without your explicit consent.
17. LINKS TO THIRD-PARTY WEBSITES
17.1 External Links
Our Service may contain links to third-party websites, applications, services, or resources that are not owned, operated, or controlled by Stella Advisory Malta Ltd.
17.2 No Responsibility
We have no control over, and assume no responsibility for:
17.3 Third-Party Privacy Policies
When you click on a third-party link and leave our Service, you are subject to the privacy policy and terms of service of that third party. We strongly advise you to:
17.4 Disclaimer
The inclusion of any link does not imply:
17.5 Liability
We are not liable for:
18. BUSINESS CONTINUITY AND DATA PORTABILITY
18.1 Backup and Recovery
We maintain regular backups of Personal Data to ensure business continuity and disaster recovery. Backups are:
18.2 Data Portability Procedures
To facilitate your right to data portability under Article 20 GDPR, we can provide your Personal Data in the following machine-readable formats:
18.3 Service Continuity
We have implemented business continuity plans to ensure continued protection of your Personal Data in the event of:
19. CHANGES TO THIS PRIVACY POLICY
19.1 Right to Modify
We reserve the right to modify, update, or replace this Privacy Policy at any time to reflect:
19.2 Notification of Changes
Material Changes:
For material changes that significantly affect your rights or how we process your Personal Data, we will notify you by:
Non-Material Changes:
For minor or administrative changes, we will:
19.3 Review and Acceptance
Your Responsibilities:
Continued Use:
Your continued use of the Service after any modifications to this Privacy Policy constitutes your acknowledgment and acceptance of the changes, unless the changes require your explicit consent under applicable law.
19.4 Withdrawal Following Changes
If you do not agree with any changes to this Privacy Policy, you have the right to:
19.5 Version History
We maintain a version history of this Privacy Policy. Previous versions are available upon request for transparency and accountability purposes.
20. CONTACT INFORMATION AND COMPLAINTS
20.1 Contact Us
If you have any questions, concerns, requests, or complaints regarding this Privacy Policy or our data processing practices, please contact us:
Stella Advisory Malta Ltd
86A, Triq Leli Falzon
NXR2609, Naxxar
Malta
Email: hello@stellaradvisorymalta.com
Telephone: 00356 79657076
Office Hours:
Monday to Friday: 8:00am till 5pm
We respond to emails within 2 business days
20.2 Response Timeframes
We are committed to addressing your inquiries promptly:
20.3 Complaints and Disputes
If you are dissatisfied with how we have handled your Personal Data or responded to your requests, you may:
Step 1: Contact Us Directly
Raise your concern with us first using the contact information above. We will:
Step 2: Escalate to Data Protection Officer
If your concern is not resolved to your satisfaction, you may escalate to our Data Protection Officer (if appointed).
Step 3: Lodge a Complaint with Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority at any time, without exhausting internal complaint procedures first.
20.4 Supervisory Authority Contact Information
Malta – Office of the Information and Data Protection Commissioner (IDPC)
Address:
Office of the Information and Data Protection Commissioner
Level 2, Airways House
High Street
Sliema SLM 1549
Malta
Contact:
Telephone: +356 2328 7100
Fax: +356 2328 7198
Email: idpc.info@idpc.org.mt
Website: https://idpc.org.mt
Office Hours:
Monday to Friday: 08:00 – 16:30
How to Lodge a Complaint with IDPC:
Other EU Supervisory Authorities:
If you reside in another EU Member State, you may lodge a complaint with the supervisory authority in:
A complete list of EU data protection authorities: https://edpb.europa.eu/about-edpb/about-edpb/members_en
20.5 Alternative Dispute Resolution
We are committed to resolving disputes fairly and efficiently. If you are not satisfied with our response or the supervisory authority’s handling of your complaint, you may have access to alternative dispute resolution mechanisms or judicial remedies under applicable law.
20.6 Language
This Privacy Policy is drafted in English. In the event of any discrepancy between the English version and any translation, the English version shall prevail, except where prohibited by local law.
21. LEGAL FRAMEWORK AND GOVERNING LAW
21.1 Applicable Data Protection Laws
This Privacy Policy and our data processing practices comply with:
21.2 Territorial Scope
This Privacy Policy applies to processing of Personal Data:
21.3 Governing Law
This Privacy Policy and any disputes arising from or related to it shall be governed by and construed in accordance with the laws of Malta and the European Union, without regard to conflict of law provisions.
21.4 Jurisdiction
Any disputes arising under this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Malta, without prejudice to your right to lodge a complaint with a supervisory authority or pursue judicial remedies under Article 79 GDPR in any EU Member State.
21.5 Severability
If any provision of this Privacy Policy is found to be invalid, illegal, or unenforceable by a court of competent jurisdiction, such provision shall be severed, and the remaining provisions shall continue in full force and effect.
APPENDIX: DEFINITIONS AND ABBREVIATIONS
AML – Anti-Money Laundering
CRM – Customer Relationship Management
DPIA – Data Protection Impact Assessment
DPO – Data Protection Officer
EEA – European Economic Area (EU Member States plus Iceland, Liechtenstein, and Norway)
GDPR – General Data Protection Regulation (Regulation (EU) 2016/679)
IDPC – Information and Data Protection Commissioner (Malta)
IP Address – Internet Protocol Address
KYC – Know Your Customer
PCI-DSS – Payment Card Industry Data Security Standard
TLS/SSL – Transport Layer Security / Secure Sockets Layer
EFFECTIVE DATE: 08/10/2025
VERSION: 2.0
DOCUMENT OWNER: Stella Advisory Malta Ltd
LAST REVIEWED: 08/10/2025
ACKNOWLEDGMENT
This Privacy Policy has been prepared in accordance with the General Data Protection Regulation (GDPR) and applicable Maltese data protection laws. It represents our commitment to protecting your Personal Data and respecting your privacy rights.
By using our Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.
For questions or concerns about this Privacy Policy, please contact us using the information provided in Section 20.
END OF PRIVACY POLICY Legitimate interests (Article 6(1)(f) GDPR) in understanding and improving our Service
Data Retention: Google Analytics data is retained for 26 months
IP Anonymization: We have enabled IP anonymization (anonymizeIP) so that IP addresses are truncated within EU Member States
Data Processing Agreement: We have a Data Processing Agreement with Google in accordance with Article 28 GDPR
Your Rights:
Google’s Privacy Policy: https://policies.google.com/privacy
11.3 Advertising and Remarketing
Google Ads (formerly Google AdWords)
We use Google Ads remarketing services provided by Google Ireland Limited to advertise to you on third-party websites after you have visited our Service.
Purpose: To show relevant advertisements to users who have previously visited our Service
Data Collected:
Legal Basis:
Data Retention: Google Ads cookies typically expire after 90 days
Your Rights:
Google’s Privacy Policy: https://policies.google.com/privacy
11.4 Payment Processing
We use third-party payment processors to handle payment transactions securely. Our
payment processors are PCI-DSS compliant and certified.
Important Information: