Privacy policy

XEMX is the controller of the personal data described here, under Regulation (EU) 2016/679 (GDPR) and the Maltese Data Protection Act.

What we collect. Account details you give us (name, email, phone). Booking and payment records. Messages sent through the platform. Analytics events describing how the site is used.

Analytics and IP addresses. We never store a full IP address. We keep a truncated prefix and a salted hash, used to estimate location at country level and to detect abuse. Analytics only run after you consent.

Why we process it. To operate your account and bookings (contract), to keep the platform safe (legitimate interest), to send marketing where you have opted in (consent), and to meet legal obligations.

How long. Account data for as long as your account exists plus six years for accounting records. Analytics events for 14 months.

Your rights. Access, rectification, erasure, restriction, portability and objection. Write to the address on the contact page. You may complain to the Office of the Information and Data Protection Commissioner (IDPC) in Malta.

This is a template. Have it reviewed before launch.