Privacy Policy

1. Who We Are

Dr Josianne Cardona Gatt – Advocate ("we", "us", "our") is the data controller responsible for the personal data described in this Policy, in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, or "GDPR") and the Data Protection Act (Chapter 586 of the Laws of Malta).

Registered office: 16, Duke of Edinburgh Street, Hamrun, Malta. Email: cardonagatt.legal@gmail.com. Telephone: +356 99826016.

2. Personal Data We Collect

When you submit our contact form, we collect: your full name, email address, telephone number (optional), organisation (optional), the service area you are enquiring about, your message, and your preferred method of response.

When you browse the website, and only once you consent via the cookie banner, analytics cookies collect technical and usage data such as your approximate location, device and browser type, pages viewed, and time spent on the site.

Our contact form is protected by Cloudflare Turnstile, which processes limited technical signals (such as browser and device characteristics) to distinguish genuine visitors from automated bots. This is essential to the form's operation and is not used for tracking or advertising.

3. How and Why We Use Your Personal Data

We process personal data submitted through the contact form to respond to your enquiry and take any steps you request in connection with a potential engagement, on the basis of our legitimate interest in providing legal services and, where applicable, taking pre-contractual steps at your request.

We process analytics cookie data solely to understand how the website is used and to improve it, on the basis of your consent, which you may withdraw at any time.

We process limited technical data via Cloudflare Turnstile to protect the contact form from automated abuse, on the basis of our legitimate interest in the security and integrity of the website.

4. Cookies

You can change your analytics cookie choice at any time using the "Manage Cookie Preferences" link at the foot of this page.

• Essential cookies (Cloudflare Turnstile): required to protect the contact form from spam and automated abuse. These cannot be disabled, as the form cannot function securely without them.
• Analytics cookies (Google Analytics 4): only set after you actively accept via the cookie banner shown on your first visit. Used in aggregate to understand site traffic and behaviour.
• We do not use cookies for advertising, retargeting, or cross-site tracking.

5. Third-Party Service Providers

We rely on a small number of trusted service providers to operate this website, each of whom processes personal data solely on our instructions and only to the extent necessary to provide their service to us:

• Supabase — securely stores contact-form submissions.
• Resend — delivers an internal email notification of new enquiries to the practice only; no marketing or automated emails are sent to you.
• Cloudflare (Turnstile) — protects the contact form from spam and automated abuse.
• Google Analytics 4 — website usage analytics, only once you consent via the cookie banner.

6. International Data Transfers

Some of the providers listed above may process personal data outside the European Economic Area. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

7. How Long We Keep Your Data

We retain contact-form submissions for as long as necessary to respond to your enquiry, maintain appropriate professional and file records, and meet any applicable retention obligations under Maltese law and the Chamber of Advocates' professional conduct rules, after which the data is securely deleted or anonymised.

8. Your Rights Under the GDPR

You have the right to access the personal data we hold about you, request its rectification or erasure, restrict or object to its processing, request its portability, and withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at cardonagatt.legal@gmail.com. You also have the right to lodge a complaint with Malta's Information and Data Protection Commissioner (IDPC), the supervisory authority responsible for GDPR enforcement in Malta, if you believe your data protection rights have been infringed.

9. Data Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including encrypted transmission and access-controlled storage with our service providers.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The "Last updated" date at the top of this page indicates when it was last revised.

11. Contact Us

For any questions about this Privacy Policy or how we handle your personal data, contact us at cardonagatt.legal@gmail.com, call +356 99826016, or write to 16, Duke of Edinburgh Street, Hamrun, Malta.