Privacy Policy

Gozo Vacations is the controller responsible for personal information collected through this website. Questions about this policy or the use of your information can be sent to hello@gozo.vacations.

This policy covers the public website, contact enquiries and mailing list registrations. A separate agreement or notice may apply if a business relationship or booking arrangement is later formed.

Information you provide

• Your name, email address, telephone number and message when you use the contact form.
• Preferred dates, guest numbers and enquiry type when you choose to provide them.
• Your first name, last name, email address and consent choice when you join the mailing list.
• Information included in correspondence about travel, partnerships or other enquiries.

Information collected automatically

• IP address, browser, device, request time, pages requested and basic diagnostic information.
• Security events and error records needed to protect and maintain the website.
• Information generated when you interact with an embedded map or an external link.

We do not use personal information for automated decisions that produce legal or similarly significant effects.

Contact form submissions are stored securely within the WordPress website and are also sent by email to the Gozo Vacations team. This allows us to reply and maintain a record of the enquiry.

Mailing list details are stored in the site CRM. We record the consent choice used to subscribe. Each marketing message should provide a way to unsubscribe. You may also withdraw consent by emailing us.

Please do not submit sensitive personal information through a general contact form unless it is genuinely necessary. Never send payment card details, passwords or passport images through the form.

The site and its hosting systems may use essential cookies or similar storage needed for security, administration, performance and features you request. WordPress also uses cookies for authorised editors who sign in.

Server and security logs may record an IP address, browser information, request time, requested pages and error details. These records help us detect malicious activity, investigate faults and keep the site available.

Some village pages include embedded Google Maps. When a map loads or you interact with it, Google may receive your IP address, device and browser information, map interactions and location information depending on your settings. Google handles that information under its own Privacy Policy.

If optional analytics, advertising or other nonessential technologies are introduced, this policy and any consent controls will be updated before they are used where consent is required.

We share personal information only where necessary with trusted providers that support website hosting, security, technical maintenance, forms, CRM functions and email delivery. We may also disclose information to professional advisers or public authorities where there is a valid legal reason.

Some providers, including Google and email infrastructure providers, may process information outside Malta or the European Economic Area. Where this happens, we rely on the safeguards, approved transfer mechanisms or adequacy decisions used by those providers as required by applicable law.

External websites linked from Gozo Vacations control their own privacy practices. Please read their policies before providing information to them.

How long we keep information

• Contact enquiries are normally kept for up to 24 months after the last meaningful communication.
• Mailing list details are kept until you unsubscribe or withdraw consent. A minimal suppression record may remain so that we continue to respect your choice.
• Routine server and security logs are normally kept for up to 90 days, unless they are needed for an active investigation.
• Information may be kept longer where required for a contract, legal obligation, dispute or legal claim. Backup copies expire through the normal backup schedule.

How we protect information

We use reasonable organisational and technical measures including access controls, software maintenance, security monitoring and restricted administration. No internet service can guarantee absolute security, but we review risks and act when a problem is identified.

Depending on the circumstances, European data protection law may give you the right to:

• Be informed about how your personal information is used.
• Request access to the information held about you.
• Ask for inaccurate or incomplete information to be corrected.
• Ask for information to be erased or its use restricted in certain circumstances.
• Object to certain processing based on legitimate interests.
• Receive information you provided in a portable format where the legal conditions apply.
• Withdraw consent at any time, without affecting earlier lawful processing.
• Complain to a data protection authority.

We may need to verify your identity before acting on a request. We will respond within the period required by law, normally one month.

Children

This site is not directed at children under 16 and we do not knowingly collect their personal information. A parent or guardian who believes a child has submitted information should contact us so it can be reviewed and removed where appropriate.

To ask a privacy question, exercise a right or withdraw mailing list consent, contact Gozo Vacations at hello@gozo.vacations. Please describe your request clearly and do not send identity documents unless we ask for them through an appropriate method.

You may also complain to Malta’s Office of the Information and Data Protection Commissioner. Current contact and complaint information is available on the official IDPC website.

We may update this policy when the site, its services or legal requirements change. The date at the top shows the latest published revision.