Last updated: September 2026
MaltaPilot is a digital platform operated from Malta that assists third-country nationals with their immigration and work permit process. We are the data controller for the personal data processed through maltapilot.com.
Contact: support@maltapilot.com
We collect the following categories of personal data:
Account data: Name, email address, phone number (optional), password (hashed — we never store plaintext passwords).
Profile data: Nationality, employer name, profession, sector, location in Malta.
Permit data: Permit expiry date, insurance expiry date, lease expiry date, passport expiry date. These are used to generate countdown alerts and reminders.
Documents: Files you upload to the document vault (passport copies, contracts, declarations). These are stored encrypted on secure cloud servers.
Forum content: Posts, comments, and likes you make on the community forum.
Usage data: Pages visited, features used, login times, browser type, IP address. Collected for security and service improvement.
Payment data: Processed securely by Stripe. We do not store your card number, CVV, or full payment details on our servers. We store only your Stripe customer ID and subscription status.
Notification data: Push notification endpoints, SMS preferences, email preferences.
Employer data: Company name, registration number, VAT number, company address, employee roster information.
We use your personal data for the following purposes:
Service delivery: To provide our core services — booking radar, document management, form auto-fill, countdown alerts, housing verification, and employer tools.
Notifications: To send you booking slot alerts (push, SMS, email) based on your preferences. SMS is sent only to Premium subscribers who have explicitly opted in.
Account management: To manage your subscription, process payments through Stripe, and provide customer support.
Security: To detect and prevent fraud, unauthorized access, and abuse of the platform.
Improvement: To analyze usage patterns and improve our services. We do not sell your data to third parties for marketing purposes.
Under GDPR, we process your data based on:
Contract performance (Art. 6(1)(b)): Processing necessary to deliver our services and manage your subscription.
Consent (Art. 6(1)(a)): For optional notifications (push, SMS, email alerts). You can withdraw consent at any time through your profile settings.
Legitimate interest (Art. 6(1)(f)): For security monitoring, fraud prevention, and service improvement.
Legal obligation (Art. 6(1)(c)): For tax and accounting records related to paid subscriptions.
We share your data only with the following third parties, strictly as needed to provide our services:
Stripe: Payment processing. Stripe is PCI-DSS Level 1 compliant. See stripe.com/privacy.
Backblaze B2: Encrypted document storage for the vault feature. See backblaze.com/company/privacy.
Twilio: SMS alert delivery for Premium subscribers. See twilio.com/legal/privacy.
Google: Authentication via Google Sign-In (if you choose this method). See policies.google.com/privacy.
Hostinger: Server hosting infrastructure. See hostinger.com/legal/privacy-policy.
We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.
Active accounts: Data is retained as long as your account is active.
Cancelled subscriptions: Your account and data remain accessible. Only paid features are disabled.
Deleted accounts: Data is permanently deleted within 30 days of account deletion request. Backups may retain encrypted copies for up to 90 days.
Payment records: Retained for 7 years as required by Maltese tax law.
Forum posts: Remain visible after account deletion but are anonymized (author name replaced with "Deleted User").
As a data subject under GDPR, you have the right to:
Access: Request a copy of all personal data we hold about you.
Rectification: Correct inaccurate or incomplete data via your profile page or by contacting us.
Erasure: Request deletion of your account and all associated data ("right to be forgotten").
Portability: Request your data in a machine-readable format (JSON/CSV).
Restriction: Request that we limit processing of your data in certain circumstances.
Objection: Object to processing based on legitimate interest.
Withdraw consent: For consent-based processing (notifications), withdraw at any time through your profile settings.
To exercise any of these rights, email support@maltapilot.com. We will respond within 30 days as required by GDPR.
We implement appropriate technical and organizational measures to protect your data:
• HTTPS encryption on all connections
• Passwords hashed using bcrypt with salt rounds
• Documents encrypted at rest in cloud storage
• Database access restricted to application servers only
• Regular security updates and monitoring
• Stripe handles all payment card data (PCI-DSS Level 1)
Some of our service providers (Stripe, Backblaze, Twilio) may process data outside the EU/EEA. In such cases, we ensure adequate safeguards are in place, including Standard Contractual Clauses (SCCs) as approved by the European Commission.
MaltaPilot is not intended for individuals under 18 years of age. We do not knowingly collect data from minors. If we discover that a minor has created an account, we will delete it promptly.
If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Information and Data Protection Commissioner (IDPC) in Malta:
Website: idpc.org.mt
Email: idpc.info@idpc.org.mt
Phone: +356 2328 7100
We may update this policy from time to time. We will notify users of material changes via email. The "Last updated" date at the top reflects the most recent revision.
For privacy-related questions or to exercise your rights:
Email: support@maltapilot.com
Website: maltapilot.com