Privacy & Data Protection Notice
Last updated: 24 July 2026
1. Definitions
In this Privacy & Data Protection Notice (this “Notice”), the below terms shall have the following meanings:
(a) “Applicable Laws” shall mean the GDPR and the DP Act;
(b) “Consent” means any freely given, specific, informed and unambiguous indication of Your wishes by which You (by a statement or by a clear affirmative action) signify agreement to the Processing of Your Personal Data;
(c) “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Your Personal Data;
(d) “Data Subject” means any identified or identifiable natural person to whom Personal Data relates;
(e) “DP Act” shall mean Chapter 586 of the Laws of Malta (the Data Protection Act) and the subsidiary legislation thereunder, as may be amended from time to time;
(f) “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
(g) “Personal Data” means any information relating to an identified or identifiable natural person;
(h) “Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; and
(i) “Processor” means the natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller.
2. Introduction
This Notice applies to the Processing of Personal Data of individuals who access or use the website https://autosales.com.mt/ (the “Website”) (each individually a Data Subject, “You” or “Your”) by the website operator, Auto Sales Limited, a Maltese limited liability company having company registration number C 491 and its registered office at Mosta Road, Lija, Malta (the “Controller”). It is the aim of this Notice to give You information on how the Controller collects and Processes Your Personal Data when You visit or use the Website, and to set out the data protection principles the Controller applies when doing so.
The Controller does not knowingly collect data relating to minors, since this Website is not intended for minors.
3. Contact Details
Should You wish to contact the Controller for any reason with respect to the Processing of Your Personal Data, You may do so using the below details.
Auto Sales Limited
Email address: [email protected]
Telephone number: +356 2143 3601
Business address: Mosta Road, Lija, LJA 9011, Malta
You may also wish to contact Our Data Protection Officer by post at Mosta Road, Lija, LJA 9011, Malta, or by email at [email protected].
4. Complaints
You have the right to make a complaint with respect to the Processing of Your Personal Data at any time to any supervisory authority. The supervisory authority in Malta is the Office of the Information and Data Protection Commissioner (the “IDPC”), the contact details of which are as follows:
Name: Information and Data Protection Commissioner
Address: Floor 2, Airways House, Triq il-Kbira, Tas-Sliema SLM 1549, Malta
Email: [email protected]
Landline: +356 2328 7100
We would appreciate the chance to deal with Your concerns before You approach the IDPC, so We kindly ask that You contact Us in the first instance.
5. Your Personal Data
In the context of this Notice, the Controller may process different kinds of Personal Data about You, which have been grouped together below:
(a) Identity Data includes Your first name and last name.
(b) Contact Data includes Your email address and mobile or telephone number.
(c) Bookings and Requests Data includes the details of bookings You may request through the Website, such as bookings for an in-store appointment, test drive or service, and details of any other requests You may submit through the Website, such as requests for parts or quotations.
(d) Recruitment Data includes Your CV, cover letter and references, information relating to Your employment history, and any other information You may provide Us with via the Careers Application Form on the Website.
(e) Cookie Data includes information collected via cookies and similar technologies placed on the Website, as further detailed in Our Cookies Policy.
6. How is Your Personal Data Collected?
The Controller may collect Your Personal Data in the following manner:
Direct interactions: You may give the Controller Your Personal Data through a form submitted on the Website or by corresponding with the Controller by post, phone, email, or otherwise.
Cookies on the Website: The Controller may collect Personal Data about You via the cookies placed on the Website, as further detailed in Our Cookies Policy.
7. Purposes and Lawful Bases for the Processing of Your Personal Data
We have set out below, in table format, a description of all the ways We plan to use Your Personal Data, and which of the legal bases (in terms of the Applicable Laws) We rely on to do so. We have also identified Our legitimate interests, where appropriate.
Note that We may process Your Personal Data on more than one lawful basis, depending on the specific purpose for and context in which We are using Your Personal Data. Please contact Us (see Section 3 above) if You need details about the specific legal basis We are relying on to Process Your Personal Data, where more than one legal basis has been set out in the table below.
| Purpose of Processing | Category/ies of Personal Data | Lawful basis/es for processing |
|---|---|---|
| To process and respond to Your queries, requests, feedback, complaints, or any other communication received via post, phone, email, the various forms on Our Website, or otherwise | Identity Data; Contact Data; Bookings and Requests Data | (a) Our legitimate interests to: (i) efficiently respond to queries, requests, feedback, complaints, and any other communications received in relation to Our business; and (ii) efficiently process requests for parts or quotations or for bookings for in-store appointments, services or test drives. (b) Where You enquire about or request Our products or services, necessity for Us to take steps at Your request prior to entering into a contract with You or with the corporate entity You represent. |
| To assess Your suitability for employment when You express an interest in joining Our Company via the Careers Application Form on Our Website | Identity Data; Contact Data; Recruitment Data | (a) Adherence to Our legal obligations, particularly in ensuring, as Your prospective employer, that We are legally permitted to employ You. (b) Our legitimate interests: (i) to remain organised and administer Our workforce smoothly; (ii) to exercise Our rights or defend Ourselves in the case of any litigious disputes or criminal proceedings; (iii) to facilitate communication with You as Our prospective employee; and (iv) to ensure that We employ suitable personnel. |
| To add You to Our database and communicate with You about Our products and/or services and deliver relevant advertisements to You, such as through Our newsletters | Identity Data; Contact Data | (a) Your Consent. (b) Where You are an existing or past client of the Company, and only insofar as the marketing and advertising relates to similar products or services to those You have procured from Us in the past, Our legitimate interest to address effective and relevant marketing and advertising to Our existing and past clients. |
| To administer Our Website | Cookie Data | (a) Our legitimate interest to administer Our Website efficiently and securely. (b) Your Consent. |
8. Automated Decision-Making and Profiling
The Controller does not use Your Personal Data to carry out any automated decision-making or profiling. In the event that the Controller decides to carry out any such automated decision-making or profiling in the future, You shall be informed prior to Your Personal Data being used in such a manner.
9. Disclosures of Your Personal Data
In the course of the Controller's business, the Controller works with third parties, typically service providers or subcontractors, who may also be the Controller's Processors. In particular, the Controller may have to share Your Personal Data with the third parties set out below.
| Recipient | Description |
|---|---|
| Third-Party Manufacturers / Brand Owners | Third-party manufacturers and brand owners of the products advertised on the Website. |
| IT Service Providers | Service providers that manage and/or provide support in relation to the Controller's Website and IT systems. |
| Marketing Service Providers | Service providers that assist the Controller in marketing Our products and services. |
| Third-Party Consultants and Professional Advisors | Service providers that assist the Controller in various matters relating to the Controller's business, including lawyers, accountants and insurers. |
| Regulators, Courts, Law Enforcement and Other Authorities | Entities that may require the disclosure of the Controller's Processing activities in certain circumstances, such as the executive police. |
The Controller will, in usual circumstances, not disclose Your Personal Data to third parties without Your Consent. There may, however, be times where the Controller needs to disclose Your Personal Data to third parties without Your Consent, such as when abiding by a court order, and the Controller shall only do so in accordance with the law, including the Applicable Laws.
The Controller requires all third parties to respect the security of Your Personal Data and to treat it in accordance with the law, including the Applicable Laws. The Controller does not allow third-party service providers to use Your Personal Data for their own purposes and only permits them to Process Your Personal Data for specified purposes and in accordance with the Controller's instructions.
10. International Transfers
The Controller generally does not transfer Your Personal Data to persons or entities outside the EU and the European Economic Area (the “EEA”).
In the event of any such transfer of Your Personal Data to countries outside the EU/EEA, the Controller shall ensure that a lawful basis for the transfer exists and that appropriate safeguards are implemented for the protection of Your Personal Data, in accordance with the Applicable Laws.
11. Data Retention
The Controller will retain Your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, reporting, contractual, or operational requirements.
In determining the appropriate retention period for Personal Data, the Controller takes into account the nature, scope, and sensitivity of the Personal Data, the potential risk of harm resulting from unauthorised use or disclosure, the purposes for which the Personal Data is processed, whether those purposes can be achieved through other means, and any applicable legal or regulatory obligations.
Where specific laws require the Controller to retain certain categories of Personal Data for a prescribed period, the Controller will retain such Personal Data for the period required by the applicable legislation.
The Controller may also retain Personal Data where necessary for the establishment, exercise, or defence of legal claims, or where contractual obligations may give rise to claims, disputes, or proceedings involving the Controller. In such cases, the Personal Data will be retained for the duration of the applicable limitation or prescriptive periods and for any additional period reasonably necessary to resolve such matters.
Where Personal Data is collected through correspondence, enquiries, requests for quotations, test-drive bookings, service bookings, parts requests, or other interactions with the Controller, such Personal Data will be retained for as long as necessary to process and respond to the relevant request and to manage any subsequent customer relationship arising from that request.
Where Personal Data is processed for marketing purposes on the basis of Your Consent, including Your Identity Data and Contact Data added to Our database to communicate with You about Our products and services and to deliver relevant advertisements to You, the Controller will retain such Personal Data for as long as You remain subscribed to Our marketing communications and have not withdrawn Your Consent or objected to such Processing. There is no fixed retention period for such data beyond this; upon withdrawal of Your Consent or objection, the Controller shall delete such data without undue delay. The Controller may nonetheless periodically review its marketing databases and may delete, anonymise, or seek renewed confirmation from individuals who have not engaged with marketing communications for an extended period of time, in accordance with the principle of storage limitation under the Applicable Laws.
Where Personal Data is collected in connection with a recruitment process and the applicant is not employed by the Controller, such Personal Data will generally be retained for a period of six (6) months following the conclusion of the recruitment process, for defence of employment-related legal claims and for future recruitment opportunities where Consent has been obtained, unless a longer retention period is required by law or the applicant has consented to retention of their Personal Data for future employment opportunities. In the event that You are employed by Our Company, any further Processing of Your Personal Data shall be governed by a separate privacy notice to be provided to You upon Your employment with the Company.
For information regarding the retention periods applicable to Cookie Data, please refer to Our Cookies Policy.
If You contact the Controller by post, phone, email, or otherwise, the Controller will retain Your Personal Data for as long as necessary to respond to Your correspondence (such as handling Your query or complaint). If You submit requests for parts or quotations or for bookings for in-store appointments, services or test drives through the forms on the Website, the Controller will retain Your Personal Data for as long as necessary to respond to Your requests and manage Your bookings, as may be applicable.
12. Your Legal Rights
In terms of the Applicable Laws, as a Data Subject and for as long as the Controller retains Your Personal Data, You have the following rights in relation to such Personal Data:
(a) Access – You have the right to request access to Your Personal Data and information related to the Processing thereof, as well as obtain a copy thereof;
(b) Rectification – You have the right to request the rectification of any inaccuracies or any missing Personal Data of Yours;
(c) Erasure – You have the right to request the erasure of Your Personal Data;
(d) Restriction – You have the right to request the restriction of the Processing of Your Personal Data in cases explicitly provided for by law, including if You believe that the Controller is unlawfully Processing Your Personal Data or that the Personal Data the Controller holds about You is inaccurate;
(e) Portability – You have the right to request that the Controller provide You with Personal Data which it holds about You in a structured, commonly used and machine-readable format (except where such Personal Data was provided to the Controller in handwritten format, in which case, upon Your request, such Personal Data will be provided to You in such handwritten format). Where technically feasible, You may also request that the Controller transmit such Personal Data to a third-party Controller indicated by You;
(f) Objection – You have the right to object to the Processing of Your Personal Data where the Controller is relying on legitimate interests for such Processing;
(g) Automated decision-making and profiling – You have the right to object to a decision taken solely on the basis of automated Processing, including profiling, which has an impact on You or significantly affects You;
(h) Withdrawal of consent – if You have provided Consent for the Processing of Your Personal Data, You have the right to withdraw that Consent at any time, which will not affect the lawfulness of the Processing carried out prior to such withdrawal; and
(i) Information about the source – where the Personal Data the Controller holds about You was not provided to the Controller directly by You, You also have the right to receive any available information as to the source of such Personal Data.
If You wish to exercise any of the rights set out above, please contact the Controller using the details set out in Section 3 above.
You will not have to pay to exercise any of the above-listed rights. However, the Controller may charge a reasonable fee if Your request is clearly unfounded, repetitive or excessive.
Please note that none of the above-listed rights are absolute and such rights must generally be weighed against the Controller's own legal obligations and legitimate interests. If the Controller is permitted, and if a decision is taken to override Your Data Subject request, You shall be informed by the Controller accordingly.