Data-Subject Rights Guide
Last updated: August 2026 · v1.0 · For anyone whose data Bookify Malta processes
Who are you?
- I’m a salon client. First, contact the salon you booked with — they are normally the data controller. If they do not respond, email legal@bookify.mt and we will assist.
- I’m a salon owner or staff member. Email legal@bookify.mt. We’ll verify your identity and process your request.
- I submitted a contact or onboarding form. Email legal@bookify.mt. We handle your data under our Website Privacy Policy.
Your rights under the GDPR
Right of access (Art. 15)
You can ask us whether we process your personal data and, if so, request a copy. We will confirm the categories of data, the purposes of processing, the recipients, and the retention period.
Right to rectification (Art. 16)
If the data we hold about you is inaccurate or incomplete, you can ask us to correct it. For salon clients, contact your salon first — they can update your details directly.
Right to erasure (Art. 17)
You can ask us to delete your personal data. We will do so unless we are required by law to keep it (e.g. tax records that must be retained for 7 years under Maltese law). For salon owners, see our Account Deletion Guide.
Right to restriction (Art. 18)
You can ask us to restrict processing while we verify the accuracy of your data, while you object to processing, or where processing is unlawful but you prefer restriction to deletion.
Right to data portability (Art. 20)
Where processing is based on consent or a contract and is carried out by automated means, you can request your data in a structured, machine-readable format (typically JSON or CSV). For salon owners, you can export your data before deleting your account.
Right to object (Art. 21)
You can object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests. You can object to direct marketing at any time and we will stop immediately.
Right to withdraw consent (Art. 7(3))
Where processing is based on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.
How to exercise your rights
Email legal@bookify.mt with:
- The right you wish to exercise
- Enough information for us to identify you (your name and the email address associated with your account or enquiry)
- Any relevant details that will help us locate your data
We may ask you to verify your identity before processing your request. This is to prevent someone else from accessing, changing, or deleting your data.
Response times
We aim to respond to all rights requests within 30 days as required by the GDPR. If your request is complex, or if you have made multiple requests, we may extend this by up to two further months. We will inform you of any extension within the first 30 days, together with the reasons for the delay.
Limitations and exceptions
Your GDPR rights are not absolute. We may decline or partially fulfil a request where an exemption applies — for example, if fulfilling your request would disclose another person’s personal data, or if a legal obligation requires us to retain certain records. If we decline your request, we will explain why and inform you of your right to complain to the IDPC.
Complaints
If you are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority: the Information and Data Protection Commissioner of Malta, Level 2, Airways House, Triq il-Kbira, HMR 1100, Floriana, Malta (idpc.org.mt, +356 2328 7100).
Request template (optional)
You do not need to use a template. A simple email is enough. But if you prefer, here is one you can copy: