Privacy Policy

Last updated: 18 October 2026

1. Who controls your personal data

Kollox Ltd is the data controller for personal data processed through this website.

Kollox Ltd
Company number: C51783
VAT number: MT20250112
Greystone, Flat 2, Sqaq San Isidoru
Mġarr, MGR1271, Malta
Email: [email protected]

2. Personal data we process

Enquiries and business communications

If you use our contact form, email us or contact us through WhatsApp, we may process your name, email address, telephone number, business name, selected service, message and subsequent correspondence.

Purpose and legal basis: taking steps at your request before entering into a contract, or performing a contract with you (Article 6(1)(b) GDPR). Where you contact us on behalf of a company or the enquiry is not a step towards a contract with you, we rely on our legitimate interest in answering and managing genuine business communications (Article 6(1)(f) GDPR).

Required contact-form fields are marked with an asterisk. We need them to understand and answer your enquiry; if you do not provide them, the form cannot be submitted. Optional fields can be left blank. Do not send passwords, payment-card details or sensitive personal information through the enquiry form. We do not use an enquiry as consent to a marketing mailing list.

If an enquiry becomes a client relationship, we also process the information needed to administer that agreement. Processing necessary to meet applicable tax, accounting or other record-keeping duties relies on the relevant legal obligation (Article 6(1)(c) GDPR), rather than optional analytics consent.

Personal offer schedule

The homepage uses a first-party kollox_offer cookie to remember a personal recurring price schedule in this browser for up to 180 days. It contains a signed start timestamp, not your name or email, and is separate from optional analytics. Discounted prices apply for three days, followed by seven days at regular prices before the discount returns. Removing or blocking the cookie, or changing browser/device, can start a new schedule. Selected package enquiries record the applicable server-verified price. See the offer terms and cookie details.

Website security and technical records

Our hosting systems may record IP address, requested URL, date and time, browser information, referrer and security events. The contact form also uses a temporary session cookie, anti-spam timing and rate-limiting records.

Purpose and legal basis: operating, securing and troubleshooting the website and preventing abuse, based on our legitimate interests (Article 6(1)(f) GDPR).

Basic aggregate statistics

Independently of optional analytics consent, our server increments daily totals for pages it renders and enquiries accepted by our email server. The statistics file contains only the date, fixed public page labels and counts. This counter does not store IP addresses, browser details, referrers, query strings, contact details, cookies, visitor identifiers or individual browsing histories. It does not read or write information on your device.

These totals help us understand overall demand and whether the enquiry service is being used. They are request counts, not unique visitor counts: repeated requests and bots may count, while pages served entirely from a cache do not reach this counter. No individual can be identified from the aggregate statistics file. The separate technical records described above remain subject to their own purposes and safeguards.

Consent preference

We store your individual optional-service choices in your browser’s local storage for up to 180 days. This preference is used to remember your request and prevent the consent banner appearing on every page. No optional service is selected by default.

Optional analytics

You can allow audience measurement and interaction/session replay separately, reject both, or accept both in Cookie settings. A service is not loaded until you permit it:

Legal basis: your consent (Article 6(1)(a) GDPR). You can reject these services and still use the website. You can also withdraw consent through Cookie settings.

3. External links

WhatsApp and other external links open services operated by third parties. If you follow a link, that provider processes information under its own privacy terms. Merely displaying our WhatsApp link does not load WhatsApp tracking on this website.

4. Who receives personal data

Recipients may include our hosting and email service providers, authorised IT support, and—only after the relevant consent—the optional analytics services listed above. Our enquiry handler is configured to send mail through Brevo’s SMTP service, which processes message content and delivery information. See Brevo’s privacy information and Microsoft’s privacy statement for their respective processing. We may disclose information where required by law or to establish, exercise or defend legal claims.

Where a provider acts as our processor, GDPR requires an appropriate processing agreement. Provider documentation does not replace our responsibility to select suitable providers and check our own configuration.

We do not sell or rent personal data.

5. International transfers

Microsoft and other service providers may process information outside the European Economic Area. International processing must be assessed against the actual provider arrangements and the GDPR transfer rules, including an applicable adequacy decision or appropriate safeguards such as Standard Contractual Clauses where required. You can ask [email protected] for information about the safeguards relevant to your data and how to obtain a copy. This notice does not claim that every provider stores data exclusively in Malta or the EU.

6. How long we keep information

• Enquiry correspondence is kept while the request is active and while follow-up is reasonably needed. We assess whether an enquiry is closed, whether it has become a client record and whether there is a specific legal or dispute-related need to retain it.
• Client and transaction records are retained for the contract and any period required by Maltese tax, accounting or other applicable law.
• Technical records follow the hosting and security systems’ retention settings. Active investigations or legal preservation needs may require selected records to be kept longer. The form’s rate limiter uses a hashed IP address and attempt timestamps; hashes remain personal data where they can be linked to a person. Only attempts within the previous hour affect its limits.
• Basic aggregate statistics cover a rolling 90-day reporting window. Older daily totals are removed when the next count is recorded.
• Optional analytics data follows the retention settings configured in those services and their applicable policies.
• Your browser consent preference expires after 180 days unless you change it sooner. The security session cookie normally lasts for the browser session, subject to your browser’s session-restoration behaviour.

7. Your GDPR rights

Depending on the circumstances, you may request access, correction, erasure, restriction or portability. You have a right to object, on grounds relating to your particular situation, to processing based on legitimate interests; we must then assess whether the legal conditions for continuing that processing are met. You may withdraw consent at any time without affecting processing already carried out lawfully.

Email [email protected] to make a request. We may ask for proportionate information to confirm your identity. We normally respond within one month, subject to the extensions permitted by GDPR.

For a practical explanation and cookie controls, visit our GDPR & Cookie Choices page.

8. Complaints

You may complain to Malta’s Information and Data Protection Commissioner (IDPC) if you believe your personal data has been processed unlawfully. Visit the IDPC complaint page. We would appreciate the opportunity to address your concern first, but you do not have to contact us before approaching the IDPC.

9. Security, children and automated decisions

We use proportionate technical and organisational safeguards, including HTTPS, access controls, input validation and anti-abuse controls. No internet service can guarantee absolute security.

This website is directed at businesses and is not intended for children. We do not use website data for automated decisions that produce legal or similarly significant effects.

10. Changes and contact

We may update this policy when our services or legal obligations change. The date at the top identifies the current version.

Questions about this policy or our data practices can be sent to [email protected].