This Privacy Policy explains how Gozo Harbour Reviews (referred to as “we”, “us” or “our”) collects, uses and protects personal data when you visit our website, make a booking enquiry, or rent one of our holiday apartments. We are committed to protecting your privacy and processing your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Data Protection Act (Chapter 586 of the Laws of Malta).

Our website is not intended for minors. We do not knowingly collect personal data relating to children. If you have reason to believe that a minor has provided us with personal data, please contact us immediately at dpo@saw.com.mt and we will take steps to address this.

Please note that this Privacy Policy applies to bookings and enquiries made directly through our website. Where you book through a third-party platform such as Airbnb or Booking.com, that platform’s own privacy policy will apply to the data they collect from you.

If you have any questions regarding this policy or how we handle your data, please contact us at: dpo@saw.com.mt.

1. Updates

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The latest version will always be available on this website. Where changes are material, we will notify you by email or by a prominent notice on the website and, where required, seek your re-acceptance of the updated policy. For all other changes, your continued use of the website after the revised date constitutes your acceptance of those changes. We encourage you to review this page periodically. This policy was last reviewed in April 2026.

2. What Amounts to Personal Data?

Personal data means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

We collect personal data when you submit a booking enquiry through our website, complete a booking and payment, or otherwise communicate with us directly.

3. How Do We Collect Personal Data?

We collect personal data through the following methods:

4. That Personal Data Do We Process?

We process the following categories of personal data:

We do not process special categories of personal data (such as health, biometric, religious or ethnic data), nor do we process data relating to criminal convictions or offences.

5. How Do We Use Your Personal Data?

We use your personal data for the following purposes:

We do not use your personal data for advertising, behavioural tracking, or any purpose not listed above.

6. Legal Bases of Processing Personal Data

We rely on the following legal bases for processing your personal data:

7. Recipients

We share your personal data with the following third-party recipients:

We do not sell, rent or share your personal data with any other third parties for their own purposes. We do not permit our data processors to use your personal data other than for the purposes we specify. In the event of a corporate merger, acquisition or sale of assets, your personal data may be transferred to any successor entity, which will be required to honour the commitments made in this Privacy Policy.

8. Automated Decision-Making and Profiling

We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects on you.

Please note that Stripe, our payment processor, may carry out automated fraud screening as part of its payment processing services. This is carried out by Stripe acting as an independent data controller in fulfilment of its own legal and regulatory obligations. For further information, please refer to Stripe’s Privacy Policy at stripe.com/privacy.

9. Data Retention

We retain personal data only for as long as is necessary for the purposes for which it was collected. When personal data is no longer required, it is securely deleted or anonymised. The appropriate retention period is determined by the nature of the data, the purpose of processing, and any applicable legal obligations.

10. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

To exercise any of the above rights, please contact us at dpo@saw.com.mt We will respond to all legitimate requests without undue delay and in any event within one month of receipt. We may need to verify your identity before processing your request. Where a request is made on your behalf by a third party, we may also ask for proof of authorisation.

You also have the right to lodge a complaint with the supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement. See Section 12 for details of our Lead Supervisory Authority.

11. Keeping Your Data Secure

We take appropriate technical and organisational measures to protect your personal data from accidental loss, unauthorised access, use, alteration or disclosure. Payment card data is handled exclusively by Stripe and is not stored on our systems. Access to booking and guest data is restricted to authorised personnel only.

Please note that the transmission of information over the internet is never completely secure. While we take all reasonable steps to protect your data, we cannot guarantee the security of data transmitted to our website.

We have adopted procedures to deal with any actual or suspected personal data breach. Where a breach is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by applicable law.

12. Complaints

If you have a concern about the way we handle your personal data, we encourage you to contact us in the first instance at dpo@saw.com.mt so that we may address your concern directly.

You also have the right to lodge a complaint with our Lead Supervisory Authority, the Information and Data Protection Commissioner (IDPC), which is the Maltese authority responsible for data protection matters:

Address: Level 2, Airways House, High Street, Sliema, Malta

Email: idpc.info@idpc.org.mt

Website: https://idpc.org.mt

Telephone: +356 2328 7100

13. Provision of Personal Data Relating to Third Party Data Subjects

If you provide us with personal data relating to another individual: for example, a fellow guest staying in the apartment: you confirm that you are authorised to share that data on their behalf and that you have informed them of how their data will be used in accordance with this Privacy Policy. We will process such data only for the purposes of managing the booking.

International Transfers

Several of our third-party service providers are based in the United States, which has not been the subject of a general adequacy decision by the European Commission. The transfer of personal data to these organisations is carried out on the basis of Standard Contractual Clauses approved by the European Commission, which provide appropriate safeguards for the protection of your personal data. For further information on countries recognised by the European Commission as providing an adequate level of data protection, please refer to the European Commission’s list of adequate countries.

The relevant providers and their privacy policies are as follows: