Privacy policy

The data controller responsible for your personal data is Malta Global License, Level 2, Triq il-Kastell, Valletta VLT 1199, Malta. For questions about this policy or our use of your data, contact us at [email protected] or via our Contact page.

We process personal data only where we have a lawful basis to do so. Our main bases are:

• (a) Legal obligation: We are required by law to process certain data (e.g. for licensing, registers, anti‑money laundering, or regulatory reporting).
• (b) Public task: Processing is necessary for the performance of our tasks as a public authority (licensing, supervision, enforcement).
• (c) Contract or pre-contractual steps: Where you apply for a license or engage with our services, processing may be necessary to perform or enter into a contract.
• (d) Legitimate interests: Where appropriate and not overridden by your rights, we may process data for our legitimate interests (e.g. improving our website, security, or internal operations).
• (e) Consent: In limited cases we may rely on your consent (e.g. for optional communications); you may withdraw consent at any time.

Depending on how you interact with us, we may collect the following categories of data:

• Identity and contact data: Name, title, job role, organisation, email address, postal address, telephone number. We collect this when you contact us, apply for a license, or are named as a contact or key person.
• Application and licensing data: Information submitted in licence applications, fit-and-proper forms, supporting documents, and correspondence. This may include background, qualifications, and financial information where required by law.
• Compliance and regulatory data: Information submitted in returns, reports, or notifications; correspondence about compliance; and data generated in the course of our supervision or enforcement activities.
• Complaint and enquiry data: Details you provide when making an enquiry, complaint, or request (including contact details and the content of your message).
• Technical and usage data: IP address, browser type and version, device information, and similar technical data when you use our website. We may use cookies or similar technologies as described in section 10.

We use personal data for the following purposes, in line with the legal bases set out above:

• • Assessing and processing licence applications, variations, and renewals.
• • Maintaining public registers (where the law requires publication of certain information).
• • Carrying out fit-and-proper assessments and ongoing supervision of licensees.
• • Handling enquiries, complaints, and correspondence.
• • Complying with legal obligations (e.g. AML/CFT, reporting to other authorities where permitted by law).
• • Exercising our enforcement functions and publishing outcomes where the law allows.
• • Operating and securing our website and improving our services.
• • Defending or exercising legal claims.

We do not sell your personal data to third parties. We do not use your data for marketing purposes unless you have opted in and we have a lawful basis to do so.

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Retention periods depend on the type of data and the legal or regulatory requirements that apply. For example, data relating to licence applications and licensing may be retained for the duration of the license and for a period after expiry or revocation as required by law or for legal claims. Correspondence and enquiry data are typically retained for a limited period after the matter is closed. Technical and website data may be retained for a short period. You may ask us about retention for your specific data by contacting us.

We may share personal data with:

• • Other regulators or public authorities where required or permitted by law (e.g. for cooperation, information exchange, or legal obligation).
• • Service providers who act on our behalf (e.g. IT, hosting, legal or professional advisers) under strict confidentiality and data processing agreements.
• • Courts or law enforcement where we are required to do so by law or to protect our legal rights.

Information that we are required to publish (e.g. on public registers) will be disclosed in accordance with the law. We do not otherwise disclose your personal data to third parties unless we have a lawful basis and, where required, have informed you or obtained your consent.

We are based in Malta and generally process data within the European Economic Area (EEA). If we transfer personal data outside the EEA, we will ensure that appropriate safeguards are in place (e.g. adequacy decision, standard contractual clauses, or other mechanisms recognised by applicable data protection law). You may request details of such safeguards by contacting us.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include access controls, encryption where appropriate, and training of staff. No transmission over the internet or electronic storage can be guaranteed to be completely secure; we encourage you to use secure channels when sending us sensitive information.

Under applicable data protection law, you may have the following rights in relation to your personal data:

• • Access: To request a copy of the personal data we hold about you.
• • Rectification: To request correction of inaccurate or incomplete data.
• • Erasure: To request deletion of your data in certain circumstances (e.g. where it is no longer necessary or where you withdraw consent). This right may be limited where we are required to retain data by law.
• • Restriction: To request that we restrict processing in certain circumstances.
• • Data portability: Where processing is based on contract or consent, to receive your data in a structured, commonly used format where technically feasible.
• • Objection: To object to processing based on legitimate interests or, where applicable, to processing for direct marketing.
• • Withdraw consent: Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us using the details in section 12. We will respond within the timeframe required by law. You also have the right to lodge a complaint with a supervisory authority (e.g. the data protection authority in your country or in Malta).

Our website may use cookies and similar technologies to enable certain functionality, maintain security, and understand how the site is used. Essential cookies are necessary for the operation of the site. We may also use analytics cookies to improve our services; where required by law we will obtain your consent for non-essential cookies. You can adjust your browser settings to refuse or delete cookies; some features of the site may not work correctly if you do so. For more detail on the cookies we use, see our cookie notice (if published) or contact us.

We may update this Privacy Policy from time to time to reflect changes in our practices, the law, or our services. The updated version will be posted on this page with a revised “Last updated” date. Where changes are material, we may notify you by email or by a notice on our website. We encourage you to review this policy periodically.

For any questions about this Privacy Policy, our use of your personal data, or to exercise your rights, please contact Malta Global License: