Privacy Policy

Malta Discount Card Ltd ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what personal data we collect, why we collect it, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR) and applicable Maltese law.

Who we are

Malta Discount Card operates a discount card platform for establishments in Malta. For the purposes of the GDPR, we act as the data controller for the personal data described in this policy.

• Controller: Malta Discount Card Ltd, a company registered in Malta.
• Company registration number: C72373.
• Registered office: 33 Triq Papa Piju XII, Birkirkara, Malta.
• VAT registration number: MT23112027.
• Privacy contact: info@maltadiscountcard.com.

Personal data we collect

• Account data: name, email address, phone number, and profile details.
• Authentication data: passwords (stored only as secure hashes), one-time passcodes, and — where you sign in with Google — the identifier and tokens your provider returns.
• Purchase and delivery data: the name, email, phone number, and delivery address (or hotel/accommodation details) you provide at checkout.
• Payment data: processed by Stripe, our only payment provider. We do not store full card numbers; we retain payment references and status for accounting.
• Card and redemption data: the cards issued to you, when and where you redeemed a discount, and the savings recorded against the card.
• Technical data: IP address and basic usage information used for security and fraud prevention.

Giving us your name, email address and delivery details is a requirement of the contract: without them we cannot issue a card, email you its number or post it to you, so we could not accept your order. Everything else — a phone number, your profile details — is optional, and leaving it out costs you nothing but the feature it powers.

Information we get from someone else

Some of the personal data we hold reaches us from a person other than you:

• Additional and gift cardholders — where a buyer names you on a card, we receive your name and email address from that buyer, so that the card can be issued in your name and sent to you.
• People invited through a referral — where a member sends you an invitation, we receive the email address they entered, so that we can send the invitation and credit the referral.
• Members of the previous Malta Discount Card website — where your membership was created on the legacy site, we received your membership and cardholder details from that site so that your existing card keeps working on this platform.

In each case we use the data to run the card or the invitation and for nothing else, we keep it for the periods set out below, and every right in this policy applies to you exactly as it does to a buyer — including the right to ask us to erase it.

How we use your data, and on what basis

• Creating and managing your account and cards, processing payments and delivering cards — to perform our contract with you.
• Customer support and service messages (your card number, order and delivery updates) — to perform our contract with you.
• Keeping the platform secure and preventing abuse and fraud — our legitimate interest in a service that is not defrauded, weighed against your interests and limited to what that needs.
• Accounting, tax and other legal obligations — compliance with a legal obligation under Maltese law.
• Non-essential cookies — your consent, which you can withdraw at any time.

Cookies and your choices

Cookies and similar technologies are covered in detail by our Cookie Policy. In short: cookies that are strictly necessary to sign you in, secure the site and complete a purchase are always set; cookies in the Marketing and attribution category are set only if you allow it, and refusing takes exactly one click. You can change your decision at any time through Cookie Settings, which every page carrying our site footer has, and which the Cookie Policy page always has; withdrawing permission also deletes the cookies stored under it. The Cookie Policy also describes storage that sits outside this choice.

Data retention

We keep personal data only as long as necessary for the purposes above, and the periods below are maximums rather than targets — you can ask us to erase your data sooner at any time.

• Your account and profile — name, email address, phone number and delivery address are kept for no more than 24 months from the latest of: your last sign-in, your last discount redemption, and the expiry of your most recent card. At the end of that period we erase or anonymise them, so the account can no longer be linked to you. That is not a door closing: erasing or anonymising an account releases the email address with it, so you are free to come back and register again with the same address whenever you like, starting from a clean account.
• Accounting and tax records — the records we are required by Maltese law to keep, including the name on an invoice, are kept for 10 years from the end of the financial year the transaction belongs to. At the end of that period we reduce them to aggregated yearly totals; no individual transaction is retained.
• Short-lived authentication artifacts — one-time passcodes, password-setup tokens and sign-in relay values expire within minutes or hours and are purged automatically on a rolling basis.
• Security and fraud-prevention logs — kept only as long as needed to investigate abuse, and never longer than the account period above.

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Receive that data in a portable, machine-readable form, and have it sent to another controller where technically feasible.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data ("right to be forgotten").
• Object to or restrict certain processing.
• Object at any time to the use of your data for direct marketing, after which we stop using it for that purpose.
• Withdraw a consent you have given — including your cookie choice — at any time, without affecting processing carried out before you withdrew it.
• Lodge a complaint with the Maltese Information and Data Protection Commissioner (IDPC).

Signed-in users can export their data or request account erasure directly from their account settings. Erasure anonymizes your personal data while retaining the minimal financial records we are legally required to keep.

We do not make decisions about you by automated means alone, and we do not profile you in a way that produces legal or similarly significant effects.

Sharing your data

We share personal data with:

• Stripe — our only payment provider, which processes your payment and holds the card details we never see.
• Google — only if you choose to sign in with Google, to complete that sign-in. Google also serves the web fonts our pages use, so it receives the IP address of every visitor whether or not they sign in.
• Our hosting and email providers — to run the platform and send you service messages such as your card number and order confirmation.
• MaltaPost — the name and delivery address on an order, so that a physical card can be posted to you.
• Participating establishments — when an establishment scans your card, it sees the name on the card and, where the card belongs to an account, the email address and phone number on that account, together with how many discounts have been redeemed, the total saved and when the card was last used, so that it can honour the offer and reconcile it with us.
• Public authorities — where we are required by law to disclose data.

We do not sell your personal data and we do not share it with advertisers.

Transfers outside the EEA

Two of the recipients above are established in the United States: Stripe, which processes every payment, and Google, which handles Google sign-in and serves our web fonts. Where personal data reaches them outside the European Economic Area we rely on the European Commission's adequacy decision for the country or framework in question, or on the Commission's standard contractual clauses, so that your data keeps the protection the GDPR gives it. You can ask us which of the two safeguards applies to a particular transfer, and we will tell you.

Children

The platform is aimed at adults: the account is opened, the purchase is made and the contract is held by an adult. A card can be bought for a child, in which case the adult buyer remains the account holder and we hold nothing about the child beyond the name printed on the card and the discounts redeemed with it. We do not ask anyone for a date of birth.

Changes to this policy

We may update this Privacy Policy from time to time. The "last updated" date above reflects the latest revision.

Contact

For any privacy request or question, write to info@maltadiscountcard.com or reach us via the Contact page. We answer privacy requests within one month of receiving them, as the GDPR requires; if a request is unusually complex we may take up to two further months, and we will tell you within that first month if that happens and why.