Upscale Malta ProcurementUPSCALEPROCUREMENT · MALTA
Legal

Privacy Policy

Last updated: [CONFIRM: date of publication]

Draft for review. This policy is a working draft prepared for Upscale Malta. Highlighted fields must be completed and the full text reviewed by a qualified adviser before the site is launched.

1. Who we are

This website is operated by Upscale Malta, a Malta-based procurement venture (the "Controller", "we", "us"). Legal entity name: [CONFIRM: registered legal name]. Registered address: [CONFIRM: registered address]. Contact for privacy matters: procurement@upscalemalta.com.

2. What personal data we collect

We collect only what you choose to send us through our forms, together with limited technical information:

  • Enquiry and quotation forms: name, business email, telephone (optional), company or organisation, role, product requirements, estimated quantities, delivery location, tender reference (if applicable) and any message you write.
  • Supplier enquiry forms: company details, manufacturing capabilities, product categories, export experience and the compliance documentation you say you hold.
  • Technical data: the page you submitted from, the time of submission, and a consent record. We do not use advertising trackers.
  • Analytics (optional): only if you opt in through our cookie settings. See our Cookie Policy.

Please do not send sensitive personal data (for example health, financial account or government identification numbers) through these forms.

3. How and why we use your data

  • To respond to your enquiry, prepare a quotation or assess a supplier's suitability.
  • To keep a record of enquiries and the steps taken, for business administration.
  • To maintain the security of the website, including protection against automated spam.

Legal basis: [CONFIRM: legal basis for each purpose, e.g. legitimate interests, contract or steps prior to a contract, consent].

4. Who we share data with

We do not sell personal data. Enquiries are stored in the secure enquiry system we use for this site and are accessible only to authorised Upscale Malta personnel. [CONFIRM: all processors, their roles and data-processing agreements]. We may disclose information where required by law.

5. International transfers

[CONFIRM: where data is hosted and whether any transfer outside the EEA takes place, and the safeguards used].

6. How long we keep data

[CONFIRM: retention period for enquiries, quotations and supplier records, and the deletion process]. Enquiries that do not lead to a business relationship will be deleted or anonymised within that period.

7. Your rights

Under the EU General Data Protection Regulation (GDPR) and Maltese law, you have the right to access, correct or erase your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time. To exercise these rights, email procurement@upscalemalta.com. You may also lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC) in Malta.

8. Security

We use access controls, encrypted connections (HTTPS) and limited administrator access. [CONFIRM: security measures actually in place at launch]. No online system is completely secure, and we cannot guarantee the security of information sent over the internet.

9. Changes to this policy

We may update this policy. The date at the top shows when it last changed. [CONFIRM: notification approach for material changes].