Last updated: September 2026
MaltaPilot is fully committed to complying with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Maltese Data Protection Act (Cap. 586). As a platform operated from Malta and serving individuals in the European Union, GDPR applies to all our data processing activities.
MaltaPilot acts as the data controller for all personal data collected through the platform. This means we determine the purposes and means of processing your personal data.
Contact: support@maltapilot.com
We process personal data under the following lawful bases as defined in Article 6 of the GDPR:
Contract Performance — Art. 6(1)(b)
Processing necessary to deliver our services: account management, subscription handling, booking radar, document vault, form auto-fill, employer tools.
Consent — Art. 6(1)(a)
Push notifications, SMS alerts, email alerts, cookie preferences. Consent can be withdrawn at any time through profile settings or by contacting us.
Legitimate Interest — Art. 6(1)(f)
Security monitoring, fraud prevention, service analytics and improvement. We conduct balancing tests to ensure our interests do not override your rights.
Legal Obligation — Art. 6(1)(c)
Tax and accounting records for paid subscriptions, as required by Maltese law.
Right of Access (Art. 15)
You can request a complete copy of all personal data we hold about you. We will provide it within 30 days in a commonly used electronic format.
Right to Rectification (Art. 16)
You can correct any inaccurate data directly through your profile page, or contact us for assistance.
Right to Erasure (Art. 17)
You can request deletion of your account and all personal data. We will complete erasure within 30 days, except where retention is required by law (e.g., tax records).
Right to Data Portability (Art. 20)
You can request your data in a structured, machine-readable format (JSON or CSV) to transfer to another service.
Right to Restrict Processing (Art. 18)
You can request that we limit how we process your data while a complaint or dispute is being resolved.
Right to Object (Art. 21)
You can object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds.
Right to Withdraw Consent (Art. 7(3))
Where processing is based on consent (notifications, cookies), you can withdraw consent at any time. Withdrawal does not affect the lawfulness of prior processing.
To exercise any right, email support@maltapilot.com with your request. We will verify your identity and respond within 30 days.
We use the following third-party processors, each bound by Data Processing Agreements (DPAs) ensuring GDPR compliance:
| Processor | Purpose | Location |
|---|---|---|
| Stripe | Payment processing | EU/US (SCCs) |
| Backblaze | Document vault storage | US (SCCs) |
| Twilio | SMS alerts | US (SCCs) |
| Authentication (OAuth) | EU/US (SCCs) | |
| Hostinger | Server hosting | EU |
SCCs = Standard Contractual Clauses as approved by the European Commission for international data transfers.
We conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities, including document storage, sensitive permit data handling, and cross-border data transfers.
In the event of a personal data breach that poses a risk to your rights and freedoms, we will:
• Notify the IDPC within 72 hours of becoming aware of the breach (Art. 33)
• Notify affected individuals without undue delay if the breach poses a high risk (Art. 34)
• Document all breaches and remedial actions taken
Our lead supervisory authority is the Information and Data Protection Commissioner (IDPC) in Malta:
Website: idpc.org.mt
Email: idpc.info@idpc.org.mt
Address: Level 2, Airways House, High Street, Sliema SLM 1549, Malta
Phone: +356 2328 7100
For any GDPR-related queries or to exercise your data rights:
Email: support@maltapilot.com
We aim to respond to all requests within 30 days.