Gozo Your Own Way Ltd. processes personal data to carry out its lawful day to day operation and business affairs. This statement outlines how that data is used, stored, transferred, who has access to it and why.

1. Gozo Your Own Way Ltd. will collect and process your data gained from booking requests (by email, booking platform or other) and consent forms in a lawful, transparent way to aide in the course of processing your booking. Data gathered via the booking process and on the consent form will be handled in a way that would reasonably be expected and will be used only for legitimate purposes in regard to your booking. In the general course of business, your data will not be passed to other organisations or agencies other than required by law or with your consent.

2. In processing your personal data, Gozo Your Own Way Ltd. will comply with the General Data Protection Regulations (EU) 2016/679, the Data Protection Act 2018 – Chapter 586 of the Laws of Malta (and any regulations made thereunder), and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended), as well as any other data protection laws that apply from time to time (together with the “Data Protection Laws“).

3. Gozo Your Own Way Ltd. will notify the customer if a third party becomes involved and inform you who that third party is. In this circumstance we will seek additional consent.

4. Your consent to data processing can be withdrawn at any time.

5. Data that is processed by Gozo Your Own Way Ltd. will only be processed for specified reasons and purposes. Data will not be processed in a way that is incompatible with any original purpose.

6. Data minimisations: Gozo Your Own Way Ltd. will only collect data that is adequate and relevant to the organisation of kayak tours or relevant services.

7. Gozo Your Own Way Ltd. will take steps to ensure that data is kept accurate and that the source of any personal data provided is clear, and due consideration is given as to whether it is necessary to update the information.

8. Gozo Your Own Way Ltd. will not store data any longer than is necessary. Data is usually stored on office computers, online databases and portable devices such as smart phones, tablets and in hard copy at our office. Data is stored for various lengths of time depending on the purpose of that data. Data may be archived or securely deleted. The retention of some data will be required for a longer period as required by Maltese tax law.

9. Data will be processed confidentially and securely protected against unauthorised or unlawful data processing, accidental loss, destruction, or damage. Gozo Your Own Way Ltd. has technical and organisational measures in place to protect and prevent personal data from being compromised.

10. Data breach: Gozo Your Own Way Ltd. will report any breach in data which exposes (or could expose) personal data. If there is a data breach, it will be reported to the Data Protection Regulator within 72 hours. After which Gozo Your Own Way Ltd. will conduct an investigation into how the data can be recovered, will prevent further loss of data, will identify the risks arising from the breach and will contact the appropriate parties in addition to the DPR.

11. Data subject rights: A subject/client may request to ascertain whether or not the company holds any of their personal data, whether or not it is being processed, and for what purpose.

12. Data erasure: Clients have a right ‘to be forgotten.' This is subject to certain conditions such as data no longer being relevant for its original purpose, or when a person has withdrawn their consent.

13. The right to rectification: An individual or organisation may seek to have personal data that is held by Gozo Your Own Way Ltd. corrected without undue delay – especially where the data concerned is out of date or inaccurate.

14. The right of restriction: This means that an individual or organisation can seek to restrict any personal data we hold.

15. The right to object to processing: You have the right to object to Gozo Your Own Way Ltd. processing data where certain conditions apply (legitimate interests). Individuals have the right to restrict Gozo Your Own Way Ltd. from using their data on certain media channels (Facebook, lnstagram, etc) or through direct marketing which includes profiling to the extent that a person may become identified.

16. Portability: Individuals can request that the data they have already provided (in a machine readable format) be transferred to a third party, subject to conditions.

17. Complaints: Individuals and organisations have the right to lodge a complaint with the Data Protection Regulator.