Privacy Policy

What personal data MaltaList collects, how we use it, who processes it on our behalf, and the rights you have under the GDPR and Maltese data protection law.

Last updated: 28 September 2026.

1. Data We Collect

When you use MaltaList, we may collect the following:

Account data: sign-in is social only, so Google, Apple, Microsoft or Facebook shares your name, email address and, where available, your profile photo. With Sign in with Apple you can hide your email and Apple gives us a private relay address instead. We never receive or store a password
Linked sign-in methods: which providers are connected to the same account
Listing data: the title, description, price, photos, category, region and location details you provide when posting an ad, and any business profiles you link the ad to
Business data: business name, contact details, opening hours, services, photos and location
Saved ads: the listings you save as favourites
Contact preferences: the phone number or email you choose to publish on a listing, and whether each is shown
Business claims: the claim, how you verified it, and any evidence you submit
Usage data: pages visited, search queries, and aggregate event counts such as listing views and search impressions
Analytics device data: a hashed IP address (never the raw IP), a random browser identifier and your browser's user-agent string
Sign-in and security logs: the date and time, the provider used, your IP address and your browser or device. Unlike the analytics data, these logs keep the actual IP address, which we use to keep accounts secure and to investigate fraud and abuse

2. How We Use Your Data

We use your personal data to:

Create and manage your account and your linked sign-in methods, including merging two accounts you control into one
Publish and display your listings and business profiles
Let buyers and sellers contact each other (contact details are masked until a viewer passes a spam check)
Verify business-ownership claims, which includes sending a one-time code to the business's published phone number or email address with your display name and email so the business can see who is requesting access
Send service emails, such as the outcome of moderation and replies to enquiries, to the contact email you choose in your account settings
Screen new and edited listings against our Terms, including with an AI moderation provider, before they go live. A human moderator reviews anything the automated check flags, so no listing is rejected by automated means alone
Detect and prevent fraud, spam or abuse, including suspending or deleting accounts and content that break our Terms
Understand how the service is used so we can improve it (analytics, only with your consent)

We do not sell your personal data to third parties, and we do not send you unsolicited marketing. With your consent, we use the Meta (Facebook) Pixel and Google Ads conversion tracking to measure how well our own ads perform and to reach people with similar interests; you can decline this at any time in Cookie settings without affecting your use of MaltaList.

3. Third-Party Services

MaltaList relies on service providers that may handle some of your data on our behalf. We share only what each needs to do its job, under appropriate data-processing terms, and we never sell your data. We name the services you directly choose or consent to; other providers are described by category.

Sign-in providers (Google, Apple, Microsoft, Facebook): when you choose one to sign in, your name, email and, where available, profile photo are shared with us
Google Analytics (consent required): measures how the site is used, and loads only after you accept analytics cookies
Google reCAPTCHA (consent required): protects the contact form, the report forms and the reveal-contact button from abuse. Until you accept anti-spam cookies, those features stay disabled
Meta (Facebook) Pixel (consent required): measures how our ads perform and helps us reach people with similar interests, on the website after you accept marketing cookies and through the Meta SDK in our apps. Meta may process this data outside the EU or EEA under appropriate safeguards (Standard Contractual Clauses)
Google Ads (consent required): records when a visit came from one of our Google ads, after you accept marketing cookies
Maps: location maps are drawn with map tiles we host ourselves, built from OpenStreetMap data and delivered by our cloud provider. No other third party is contacted when a map loads, and no cookie is set. Map data © OpenMapTiles © OpenStreetMap contributors. The map design is based on the Positron style by MapTiler and OpenMapTiles contributors, derived from CartoDB Basemaps, used under CC BY 4.0
Cloud infrastructure: a cloud provider hosts our application, databases and image storage, and delivers our service emails. This data is processed within the EU
Address and place search: address and business lookups are performed by our servers through a third-party places provider, so your browser does not contact it directly and no cookie is set
SMS: a one-time code for a business claim is sent by text through an SMS provider, processed in the EU
AI content moderation: a listing's text and photos are sent to an AI moderation provider to check it against our Terms. The provider processes this solely to return a moderation result, does not use it to train its models, and retains it only for a limited period. This may involve a transfer outside the EU or EEA under appropriate safeguards (Standard Contractual Clauses)
Error monitoring: technical error and crash reports are captured on our own self-hosted infrastructure. It sets no cookies and by default does not include personal data such as your IP address
Internal alerts: our moderation team receives operational notifications through a private third-party messaging channel, which may include the name, email address and message text a moderator needs in order to act. This may be processed outside the EU or EEA; we send only what the alert needs

4. Cookies and Consent

We use one strictly necessary session cookie that needs no consent. Google Analytics, Google reCAPTCHA, the Meta (Facebook) Pixel and Google Ads are non-essential and load only after you opt in, and the advertising trackers stay off unless you turn them on, even if you previously accepted all cookies. You can accept, reject or change these choices at any time in Cookie settings, which is also available from the footer.

5. Data Retention

We retain your personal data for as long as your account is active. You can delete your account at any time from your account settings, and a moderator may suspend or delete an account that breaks our Terms. Deleting your account immediately and permanently removes it, along with all your listings, business profiles and saved items, and cannot be undone. Sign-in security logs are kept only as long as needed for fraud and abuse prevention.

Raw engagement events, the individual page views, search impressions and contact clicks behind our statistics, are recorded with a hashed IP and a random browser identifier and are automatically deleted after 90 days. Beyond that we keep only monthly totals per listing or business, which are plain counts and contain no personal data.

6. Your Rights (GDPR)

If you are in the European Union or European Economic Area, you have the following rights:

Right of access: request a copy of the personal data we hold about you
Right to rectification: correct inaccurate or incomplete data
Right to erasure: request deletion of your personal data
Right to data portability: receive your data in a machine-readable format
Right to object: object to certain types of processing
Right to withdraw consent: where processing relies on consent, such as analytics, withdraw it at any time

To exercise any of these rights, contact us at info@maltalist.mt.

7. Data Security

We take reasonable technical and organisational measures to protect your data, including HTTPS encryption in transit, encrypted storage at rest, and restricted access controls. No online service can guarantee absolute security.

8. Children's Privacy

MaltaList is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with their data, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email or by a notice on the platform. Continued use of MaltaList after changes constitutes acceptance of the updated policy.

10. Contact

For any privacy-related questions or requests, please contact us at info@maltalist.mt.