Privacy notice

How I handle personal data when you visit this website or contact me.

Who I am

This website is run by Dr Aron Mifsud Bonnici, practising as Mifsud Bonnici Advisory, 40/1 Old Mint Street, Valletta VLT 1514, Malta ("I", "me"). I am the controller of the personal data described in this notice. You can contact me at info@mb.com.mt. The legal notice gives the practising address and who is responsible for this website.

I handle personal data in line with the General Data Protection Regulation (Regulation (EU) 2016/679) and the Data Protection Act (Cap. 586 of the laws of Malta).

Who this notice is for

It covers people who visit this website or contact me, including through the enquiry form, before they become clients.

It does not cover the personal data of clients once they instruct me. That is covered in my engagement terms. Nor does it describe in detail my professional duty of secrecy, which applies to everything you tell me.

What I collect, why, and the legal basis

Your enquiry

If you send an enquiry through the form, or contact me by email, I collect your name, your email address, your telephone number if you give one, who you are writing as, the topic you choose, the name of your employer or the other party if you give it, how you found me if you choose to tell me (an optional question on the form, with a short follow-up for some of the answers), and what you write in your message. I use it to reply, to understand whether I can help and to arrange a first conversation. The legal basis is taking steps at your request before a contract (article 6(1)(b) of the GDPR), and my legitimate interest in answering enquiries (article 6(1)(f)). I use the answer about how you found me only to understand which channels reach people, on the basis of my legitimate interest in understanding how people find me (article 6(1)(f)).

Before I can accept a matter, I run a conflict check, to make sure that acting for you would not conflict with my duties to a current or former client. For this I use the names you give me (yours, your employer's or the other party's, and anyone else with a significant role in the matter), only for that check and to reply to you. The legal basis is my legitimate interest in running conflict checks (article 6(1)(f)). The enquiries and confidentiality notice explains what to send me and how I treat it.

Please give only what is needed to explain your situation, and do not send documents until we have spoken and the conflict check is done. Employment matters can involve sensitive information, such as your health or trade union membership. If you include it, you do so voluntarily, and I use it only to deal with your enquiry. The legal basis is that it is needed to establish, exercise or defend legal claims (article 9(2)(f)).

Technical data when you visit the site

The hosting provider records technical data, such as your IP address, the date and time, the pages requested and your browser type, in server logs. I use it to keep the site secure and working, and to prevent abuse. The legal basis is my legitimate interest in running and protecting the site (article 6(1)(f)).

The enquiry form uses a security check to tell people from automated programs. It is run by my website hosting provider and has the same legal basis.

Cookies and visit statistics

Visit statistics run only if you accept them in the cookie banner. They are collected without cookies and without identifying you. The legal basis is your consent (article 6(1)(a)), which you can withdraw at any time with the Cookie settings link at the foot of every page. See the cookie notice.

Who I share it with

I do not sell personal data. Only I see your enquiry. I use trusted service providers to run the site and handle email:

• a website hosting and security provider, which hosts the site, protects it from abuse, runs the security check on the form and delivers form submissions to me (and, if you accept them, provides cookie-free visit statistics);
• an email delivery service, which sends your enquiry to me as an email; and
• an email and office software provider, which hosts my email.

These providers act on my instructions and only for these purposes, under data processing terms. You can ask me for more information about them. I may also disclose personal data where the law requires it, or where it is necessary to establish, exercise or defend legal claims.

Transfers outside the European Economic Area

Some of these providers are based outside the European Economic Area, for example in the United States. Where that happens, I rely on safeguards the law recognises, such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

How long I keep it

If you send an enquiry and do not become a client, I keep it for 12 months, so that I can deal with any follow-up, and then delete it. The exception is a matter I decline: there I keep only a limited record that a conflict check was run and the matter declined. If you become a client, I keep your records for as long as my professional and legal duties require. Server logs are kept for a short period set by the hosting provider.

Keeping it secure

The site uses an encrypted connection (HTTPS). I take reasonable steps to protect personal data from loss, misuse or unauthorised access.

Your rights

You have the right to:

• ask for a copy of the personal data I hold about you;
• ask me to correct data that is wrong or incomplete;
• ask me to delete your data, in some circumstances;
• ask me to restrict how I use it, in some circumstances;
• object to my use of it where I rely on my legitimate interests;
• receive the data you gave me in a commonly used format, where that applies; and
• withdraw your consent at any time, where I rely on it. This does not affect what I did before.

To use any of these rights, write to me at info@mb.com.mt. I may need to confirm who you are first. I will reply within one month.

I do not make decisions about you by automated means.

Complaints

If you are not happy with how I handle your data, please tell me first so I can put it right. You also have the right to complain to the Office of the Information and Data Protection Commissioner in Malta, or to the data protection authority in the country where you live.

Changes to this notice

I will update this notice if what I do changes. The date at the top shows when it was last updated.