Privacy Policy

1. Who is responsible for your data

Controller: Cristiano Blanco, 1044 Pender Gardens, Triq Gort, St Julian's STJ 1900, Malta.
Contact for all data protection matters: info@expatvoice.mt

ExpatVoice is not yet a legal entity. Until the Voluntary Organisation is enrolled, Cristiano Blanco is personally the data controller. When the Voluntary Organisation is established, it will become the controller and we will update this page and notify you.

2. Our core promises

1. We never sell your data. Not now, not later, not to anyone.
2. We never share your data with third parties for their own marketing or lead generation. This commitment is permanent and survives any transfer of the project to another entity.
3. We never publish your personal data. Reports are analysed as patterns, never as named individuals.
4. Reports are encrypted in your browser before they reach us. Our hosting provider cannot read them. Their AI tools cannot read them. Only the ExpatVoice team can.
5. We collect the minimum. You can report an issue completely anonymously.

To be precise about promises 1 and 2: like every website, we use service providers (hosting, analytics, bot protection) who process data on our instructions only. That is different from sharing your data with someone who wants to sell you something. We do the first. We will never do the second.

3. What we collect, why, and on what legal basis

We keep each purpose in a separate database table, with its own legal basis and its own retention period. We do not mix them.

(a) Reporting an issue, /report-issue

• What: Category, locality, nationality (optional), and your free-text description. Optionally, an email address, only if you tick the box asking to be contacted.
• What we do NOT collect: your name. Ever. Nor your IP address, nor your browser fingerprint.
• Encryption: Your title, description and (if given) email are encrypted in your browser using public-key cryptography before being transmitted. The private key required to read them is held offline by the ExpatVoice team and exists nowhere on any server. Neither our hosting provider, nor its AI tooling, nor its infrastructure suppliers can read the content of your report.
• Why: To identify patterns in the problems expats face in Malta, and to act on them constructively.
• Legal basis: Your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR). Reports may reveal information about ethnic origin, health, or political opinions, which are "special categories" of data under Art. 9 GDPR. That is why we ask you to give a separate, specific consent, and why we encrypt what you send.
• Retention: After 12 months the encrypted content and the nationality field are permanently destroyed. Only category, locality and month are kept, as anonymous statistics that can no longer be linked to any person.
• Withdrawing consent: Save the reference code shown when you submit (e.g. EV-4823). Email it to us and we will delete the report. Because the report is anonymous, the code is the only way we can find it.

(b) Joining the community, /get-involved

• What: First name, last name, email, and optionally nationality, locality, residence status and your interests.
• Why residence status? Because which elections you can vote in depends on it. It is always optional and includes a "prefer not to say" option.
• Why: To build the ExpatVoice community, invite you to events, and tell you about civic opportunities relevant to you.
• Legal basis: Your consent (Art. 6(1)(a)).
• Retention: Until you ask us to remove you, or until the initiative ends.

(c) Newsletter

• What: Email address.
• Legal basis: Your consent. One-click unsubscribe in every email.
• Retention: Until you unsubscribe; deleted within 6 months of unsubscribing.

(d) Sharing your story, /stories

• What: Your name, email, story, and your chosen display preference (full name / first name / pseudonym / anonymous). The content is encrypted, as with reports.
• Legal basis: Your explicit consent, given through a separate consent form.
• Retention: Until you withdraw consent. You can withdraw at any time and we will remove the story.
• Default: We default to a pseudonym. Telling your story should not cost you your job or your permit.

(e) Contacting us, /contact

• What: Name, email, message.
• Legal basis: Legitimate interest (Art. 6(1)(f)), answering your message.
• Retention: 12 months.

4. What we do NOT do

• ❌ We do not track you across the web.
• ❌ There is no Meta Pixel, no Google Analytics and no advertising tracker of any kind on this site.
• ❌ We do not build profiles of you.
• ❌ We make no automated decisions with legal or similarly significant effects (Art. 22 GDPR).
• ❌ We do not use your personal data to train AI models, and our tooling cannot read the encrypted content you send us.

5. Analytics

We use Plausible Analytics, an EU-hosted, privacy-first service. It sets no cookies, does not use browser fingerprinting, and does not collect personal data. It tells us how many people read a guide, nothing about who they are. This is why this site has no cookie consent banner: there is nothing to consent to.

6. Bot protection

Our forms are protected by Cloudflare Turnstile, which distinguishes humans from automated bots. It processes your IP address for that purpose. Unlike other CAPTCHA services, Turnstile sets no cookies and does not track you across websites, which is precisely why we chose it.

7. Who processes data on our behalf

Each is bound by a data processing agreement under Art. 28 GDPR.

International transfers: Your data is stored in the European Union (Frankfurt). We do not transfer personal data outside the EU/EEA for storage. Where a processor operates a component outside the EEA, it is covered by an adequacy decision or by Standard Contractual Clauses, and, for reports and stories, the content is in any case encrypted and unreadable to them.

8. Security

• Reports and stories are encrypted in your browser with public-key cryptography (X25519 sealed box). The private key is held offline by the ExpatVoice team and exists on no server.
• All data is transmitted over HTTPS.
• Database access is restricted at row level: the public interface can write to the database but cannot read from it.
• Access to readable data is limited to named administrators, and requires the private key.
• We will notify the IDPC within 72 hours of becoming aware of a personal data breach that presents a risk, and we will notify you directly where the risk to you is high.

9. Children

This site is not directed at people under 16. We do not knowingly collect their data. If you believe we have, write to us and we will delete it.

10. Your rights

Under the GDPR and the Data Protection Act (Chapter 586 of the Laws of Malta) you have the right to:

• access the data we hold about you;
• rectify inaccurate data;
• erase your data ("right to be forgotten");
• restrict or object to our processing;
• data portability, receive your data in a machine-readable format;
• withdraw consent at any time, without affecting processing carried out before withdrawal;
• lodge a complaint with the supervisory authority.

Write to info@expatvoice.mt. We will respond within one month. It is free.

⚠️ One honest limitation. If you submitted an anonymous report and did not keep the reference code, we have no way of identifying which report is yours, so we cannot retrieve or delete it. This is a direct consequence of designing the system not to know who you are. We think it is the right trade-off, but you should know about it.

11. Complaints

Office of the Information and Data Protection Commissioner (IDPC)
Floriana, Malta · idpc.org.mt

You can complain to the IDPC at any time. You do not need to contact us first, though we would appreciate the chance to fix it.

12. Changes

We will post any changes here and update the date. If a change is significant, we will tell the people whose data we hold, directly.