Privacy Policy

1. Who we are (Data Controller)

For the purposes of the GDPR, Christian Azzopardi, trading as Bookify Malta, is the data controller for personal data submitted through this website:

• Operator: Christian Azzopardi, trading as Bookify Malta
• Registered address: Gcoe, Triq il-Mithna, Qala, Gozo, Malta
• Malta VAT number: MT30087118
• Country of establishment: Malta
• Contact: info@bookify.mt · legal@bookify.mt · +356 7956 1688

2. Information we collect

When you submit our onboarding or contact form, we collect the personal data you choose to provide:

• Business name
• Contact name
• Email address
• Phone number (optional)
• Location (e.g. town or region)
• Type of business
• Plan preference
• Your preferred contact method and any notes you choose to add

We also collect, automatically and transiently, your IP address for rate-limiting and security purposes. We do not collect data through advertising networks, tracking pixels, or third-party analytics on this site.

When you submit a directory request — a listing claim, a correction report or a removal request — we also collect the information described in section 6.8: your name, your relationship to the business, contact details, the requested action, your verification preference, the reasons for your request, supporting information and any evidence you choose to submit.

We also collect limited directory information from lawful public sources to operate the Bookify Directory, as described in section 6 below.

3. How we use your information

We process your data to:

• Respond to your enquiry and provide information about Bookify Malta;
• Set up and onboard your salon or barber business;
• Communicate with you about your account or request, using your preferred contact method;
• Detect and prevent fraud, abuse and security incidents;
• Comply with legal obligations including tax and accounting requirements.

4. Legal basis for processing (GDPR Article 6)

We rely on the following lawful bases:

You may withdraw consent at any time by emailing us. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.

5. Who we share your data with (Sub-processors)

When you submit the form, your data is sent to our server and delivered by email to info@bookify.mt. In the course of that delivery the following may process your data as processors on our behalf:

We do not sell your data and we do not share it for marketing purposes. A complete list of all subprocessors (covering both the website and the platform) is on our Subprocessor List.

6. Directory information

Bookify Malta operates a public directory of salons, barbers and beauty businesses in Malta and Gozo (the “Directory”). This section explains how we collect, use and protect directory information. It applies to unclaimed listings (businesses that are not Bookify customers) and to directory profiles of businesses that choose to be listed.

6.1 What we collect

For unclaimed listings we collect limited factual information from lawful public sources: the business or trading name; business category; locality; opening hours where sufficiently reliable; a link to the business’s Google Maps listing; and the date the information was last checked. We do not collect phone numbers, email addresses, logos, photos, services, prices or review text for unclaimed listings. Where available we publish the business’s public Google Maps rating and review count, always shown with the review count and the source named (see section 6.2). Where a listing identifies a natural person (for example, a sole trader trading under a personal name), we treat that information as personal data and apply section 6.4.

6.2 Sources

We prefer information provided directly by the business’s authorised representative, followed by the business’s official website, its official social media pages, official Maltese public registers (where reuse is lawful), and independently documented public information such as signage. We do not build the Directory by copying Google Maps, Facebook or Instagram search results, competitor directories, commercial databases or review platforms. A link to a business’s Google Maps listing is a link only; it is not a source for copying the displayed information. Ratings and review counts, where displayed, come from the business’s public Google Maps profile and are shown with the source named and the number of reviews; we do not copy or republish review text and we do not scrape or aggregate review platforms.

6.3 Why we process it (legal basis)

• Operating a useful local business directory — legitimate interests (Art. 6(1)(f) GDPR), subject to a documented Legitimate Interests Assessment;
• Publishing and maintaining directory profiles of businesses that choose to be listed — performance of our agreement with the business, or the business’s consent where applicable;
• Handling claims, corrections and removal requests — legitimate interests and our legal obligations;
• Article 14 transparency notices where a listing identifies a natural person — legal obligation and legitimate interests.

We have completed a Legitimate Interests Assessment covering the purpose, necessity and balancing of directory processing, including safeguards such as a minimal field set, no unclaimed contact details, prominent unclaimed notices and free correction and removal. A summary is available on request from legal@bookify.mt.

6.4 Transparency for sole traders and individuals

Where directory information identifies a natural person and was not obtained directly from them, Article 14 GDPR requires us to provide transparency information. Before publishing such a listing, we send a neutral notice (to a lawfully available contact route) setting out the categories of information, the source, the purpose, the lawful basis, the legitimate interests pursued, the recipients, the retention period and the rights available, including how to object or request removal. This notice contains no marketing or sales content. Where no lawful contact route exists, a listing that clearly involves personal information is not published.

6.5 Publication and search engines

Approved listings are published at bookify.mt/directory/ and may be indexed by search engines. Unclaimed listings carry a prominent notice stating that the business has not claimed or verified the page and is not affiliated with, endorsed by or represented by Bookify Malta. When a listing is removed, we remove it from the website, sitemaps and internal search, and we request removal from search-engine caches where appropriate.

6.6 Retention and suppression

Directory listing information is kept while the listing is published. Source and provenance records are kept for the periods set out in our Data Retention & Deletion Schedule. After removal we keep only a minimal suppression record (normalised business name, limited location identifier, previous listing ID, request date and reason category) so that the business is not accidentally republished, and we review suppression records periodically.

6.7 Your rights over directory information

If you operate a listed business, you may request a correction or the removal of your listing free of charge and without creating an account, using the routes in our Correction & Removal Policy. As a data subject you may exercise the rights in section 14 of this policy, ask us where we obtained the information about you, and complain to the Information and Data Protection Commissioner.

6.8 Directory request forms — claims, corrections and removals

When you claim, correct or request removal of a directory listing, we collect your name, relationship to the business, contact details, requested action, verification preference, reasons, supporting information and any evidence you choose to submit. Because you submit this data directly to us, this section provides the transparency information required by Article 13 GDPR.

Claim form. Your name, your role with the business, the business email address and phone number, your contact email for our response, your preferred verification method (business email, official social account or business phone) and your confirmation that you are authorised to represent the business.

Correction form. Your name, your relationship to the business (owner, authorised representative, customer or other), the field you believe is wrong, the correct information, your reason, and your contact email for our response, together with any supporting evidence you choose to submit.

Removal form. Your name, your relationship to the business (for example, that you represent the business, that the business is closed, that the wrong business is listed, or that the listing raises a privacy or safety concern), your reason, and your contact email for our response, together with any supporting evidence you choose to submit.

Legal basis. We rely on the following lawful bases:

• Receiving and responding to your request — legitimate interests (Art. 6(1)(f)), because you made the request at your own initiative; for claims, taking steps at your request towards managing the claimed profile (Art. 6(1)(b));
• Verifying your authority before changing a listing — legitimate interests (Art. 6(1)(f)), to prevent fraudulent claims and unauthorised changes;
• Honouring corrections, removals and lawful objections — legal obligation and legitimate interests (Art. 6(1)(c) and (f));
• Keeping records of requests and disputes for accountability and legal defence — legitimate interests and legal obligation (Art. 6(1)(f) and (c)).

Retention. Claim and verification records are kept for 12 months after the claim decision; any identity documents submitted for verification are deleted promptly after verification and are never published. Correction and removal request records are kept while the listing is published and, where they relate to a dispute or objection, for up to 3 years from the last related event, then deleted (see section 8 and our Data Retention & Deletion Schedule). After removal we keep only the minimal suppression record described in section 6.6.

You may ask us to delete your request and its records at any time by emailing legal@bookify.mt, unless we are required by law to keep them (see section 14).

7. International transfers

Your data is stored and processed within the EU. Where any subprocessor operates outside the EU/EEA, we rely on EU Standard Contractual Clauses (Commission Decision (EU) 2021/914), an applicable adequacy decision, or other safeguards permitted under Chapter V GDPR. You may request a copy of the relevant safeguards by emailing legal@bookify.mt.

8. Data retention

We keep personal data only for as long as needed:

You can ask us to delete your form submission at any time by emailing legal@bookify.mt, and we will do so unless we are required by law to keep it. After an account deletion, retained tax records are pseudonymised by nulling or hashing identifiable fields where technically feasible.

9. Security

We use industry-standard technical and organisational measures: HTTPS in transit (TLS 1.2+), encryption at rest, hashed passwords, rate-limiting on sensitive endpoints, and user-supplied content is HTML-escaped before being included in notification emails. No method of transmission over the internet is fully secure, however.

10. Data breach notification

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Information and Data Protection Commissioner of Malta within 72 hours as required by Article 33 GDPR, and where the risk is high we will notify affected individuals without undue delay (Article 34 GDPR).

11. Children’s privacy

This website is not directed at children under 16 and our forms are intended for business owners and adults. We do not knowingly collect personal data from children under 16. If you believe a child has submitted personal data, contact us at legal@bookify.mt and we will delete it.

12. Automated decision-making

We do not engage in automated decision-making that produces legal or similarly significant effects on you within the meaning of Article 22 GDPR.

13. Cookies and similar technologies

This website uses essential cookies required for security and basic functionality. Non-essential analytics cookies are loaded only after you consent via the cookie banner displayed on your first visit. For full details, including cookie types, purpose, duration and how to withdraw consent, see our Cookie Policy.

14. Your rights under GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you;
• Rectify — correct inaccurate or incomplete data;
• Erase (“right to be forgotten”) — request deletion of your data, subject to legal retention obligations;
• Restrict — restrict processing in certain circumstances;
• Portability — receive your data in a machine-readable format;
• Object — object to processing based on legitimate interests;
• Withdraw consent — for any processing based on consent, at any time;
• Lodge a complaint — with the supervisory authority (see below).

To exercise any of these rights, email us at legal@bookify.mt. We will respond within 30 days as required by the GDPR.

You also have the right to lodge a complaint with the supervisory authority: the Information and Data Protection Commissioner of Malta, Level 2, Airways House, Triq il-Kbira, HMR 1100, Floriana, Malta (idpc.org.mt, +356 2328 7100).

15. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be notified by a prominent notice on the website.

16. Contact

For any privacy-related questions, requests or complaints:

• Email: legal@bookify.mt
• Phone: +356 7956 1688
• Postal: Christian Azzopardi t/a Bookify Malta, Gcoe, Triq il-Mithna, Qala, Gozo, Malta

Version history