Privacy Policy

This policy explains how Malta Conformity Assessment Ltd. ("MCA", "we", "us") processes personal data when you visit www.maltaca.com, contact us through the website, book a meeting or use our online services. It is written to meet the information requirements of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Maltese Data Protection Act (Cap. 586).

1. Who is responsible for your data

The controller of your personal data is:

Malta Conformity Assessment Ltd., Notified Body 3132 under Regulation (EU) 2017/745, designated by the Malta Medicines Authority.

• Head office: Malta Life Sciences Park, Sir Temi Zammit Buildings, Office LS2.1.11, San Gwann SGN 3000, Malta
• Email: info@maltaca.com · Phone: +356 21 38 08 75

For any question about this policy or about your personal data, write to info@maltaca.com with "Data protection" in the subject line.

2. What data we collect and why

2.1 When you send us a message

The contact form asks for your first and last name, company name, telephone number with country code, email address, subject, the service area your enquiry relates to (main and sub category, optional) and your message. You confirm that you have read this policy and may separately agree to receive our newsletter.

Together with your message, the form sends a small amount of technical context: the browser language, the time zone set on your device, the page or campaign that brought you to our website (for example UTM campaign parameters or a Google Ads click identifier, if present) and the referring page.

We use this data to answer your enquiry, to prepare a quotation or pre-application information, to plan the next steps of a certification and to keep a record of our correspondence. The campaign information helps us understand which channels bring enquiries, so that we can improve how we inform manufacturers about our services.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in managing enquiries and measuring the effectiveness of our communication (Art. 6(1)(f) GDPR).

2.2 Newsletter

If you tick the newsletter box, we use your name and email address to send you occasional news about our services, regulatory developments and announcements. You can withdraw this consent at any time by using the unsubscribe link in any newsletter or by writing to info@maltaca.com.

Legal basis: your consent (Art. 6(1)(a) GDPR).

2.3 Booking an online meeting

Meetings are booked through Calendly, which opens in a window on our website when you choose to book. Calendly collects the details you enter there (such as your name, email address and any answers to booking questions) and shares them with us so that we can hold the meeting. Calendly processes this data under its own privacy policy.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

2.4 Applicants and certificate holders

When an enquiry leads to an application or a certification, we process the data of the manufacturer's contact persons as part of the certification agreement and our obligations as a Notified Body under Regulation (EU) 2017/745, including the records we must keep and make available to the designating authority.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).

2.5 Protecting the website and the contact form

To keep the contact form free from spam and automated abuse, it uses Google reCAPTCHA. reCAPTCHA is loaded only when you start using the form and evaluates information about your browser and device, including your IP address, which is sent to Google. Our web server also records technical log data (IP address, date and time, requested page, browser type) for security and troubleshooting.

Legal basis: our legitimate interest in the security and proper operation of the website (Art. 6(1)(f) GDPR).

2.6 Website statistics

With your consent we use Google Analytics to understand how visitors use the website, for example which pages are viewed and whether the contact form is used. Google Analytics is managed through Google Tag Manager and only stores cookies on your device after you choose "Accept all" or enable analytics in the cookie settings. Without your consent, Google tags may send limited signals without cookies and without identifiers that recognise you, which Google uses to report aggregated traffic. Details are in our Cookie Policy.

Legal basis: your consent for cookies (Art. 6(1)(a) GDPR); our legitimate interest in aggregated, cookieless measurement (Art. 6(1)(f) GDPR).

3. Who receives your data

Your data is accessible only to MCA staff who need it for the purposes above. We also use the following recipients, who act on our instructions or as independent controllers where stated:

• Customer relationship management (CRM): messages sent through the contact form are recorded in our CRM system, where our team follows up enquiries.
• SZUTEST group companies: MCA belongs to the SZUTEST group. Our Istanbul Branch and group companies support us with customer service, IT, software and CRM operations and may access enquiry data for these purposes.
• Website hosting and email: the providers that host our website and deliver our email.
• Google: Google Ireland Limited and Google LLC for Google reCAPTCHA, Google Tag Manager and Google Analytics.
• Calendly: Calendly LLC, when you book an online meeting.
• Authorities: the Malta Medicines Authority, the European Commission and other competent authorities, where we are required by law to provide information.

We do not sell your personal data and we do not use it for automated decision-making or profiling with legal or similarly significant effects.

4. Transfers outside the European Economic Area

Some recipients are located outside the European Economic Area: Google LLC and Calendly LLC in the United States, and SZUTEST group companies in Türkiye. Where personal data is transferred to such countries, we ensure that the transfer is protected by an appropriate safeguard under Chapter V GDPR, in particular an adequacy decision such as the EU-U.S. Data Privacy Framework for certified recipients, or the European Commission's Standard Contractual Clauses. You can ask us for information about these safeguards at info@maltaca.com.

5. How long we keep your data

• Enquiries: we keep enquiries for as long as they are needed to answer you and to follow up on a possible application.
• Applicants and certificate holders: for the duration of the certification and afterwards for the retention periods required by Regulation (EU) 2017/745, our designation and our quality management system.
• Newsletter: until you unsubscribe or withdraw your consent.
• Google Analytics: event data is kept for 2 months; analytics cookies expire after at most 2 years.
• Cookie choice: your cookie settings are remembered for 180 days.
• Server logs: kept for a limited period for security purposes and then deleted.

6. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected and incomplete data completed;
• have your data erased where there is no longer a reason to keep it;
• restrict the processing of your data in certain cases;
• receive the data you provided to us in a structured, machine-readable format (data portability);
• object to processing based on our legitimate interests;
• withdraw your consent at any time, without affecting processing carried out before the withdrawal. For cookies, use "Cookie settings" at the bottom of any page.

To exercise your rights, write to info@maltaca.com. We will answer within one month. We may ask you to confirm your identity before we act on your request.

You also have the right to lodge a complaint with the Information and Data Protection Commissioner (IDPC) in Malta (www.idpc.org.mt) or with the supervisory authority of the EU country where you live or work.

7. Security

We protect personal data with appropriate technical and organisational measures. The website is served only over encrypted HTTPS connections, the contact form is protected against automated abuse, administrative access is restricted and monitored, and our staff are bound by confidentiality obligations that also follow from our role as a Notified Body.

8. Children

Our website and services are intended for businesses. We do not knowingly collect personal data from children.

9. Changes to this policy

We may update this policy when our services or legal requirements change. The current version is always available on this page, with the date of the last update at the top.