PRIVACY, GDPR AND DATA PROTECTION POLICY

 

Data protection in Malta and Gozo is primarily governed by the General Data Protection Regulation (EU) 2016/679) (GDPR) which has been implemented into Maltese law by virtue of the Data Protection Act (Chapter 586 of the Laws of Malta) ('the Act').

GDPR is covered by the REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT 

Effective Date: 01/09/2026
Last Updated: 01/09/2026

A full detailed NDD and GDPR policy will be provided for every client with a signed service agreement.

HR Together is committed to protecting the privacy, confidentiality and security of personal data entrusted to us.

We provide Human Resources, administration and related professional support services to businesses and individuals in Malta. In providing these services, we may collect and process personal data relating to clients, prospective clients, employees, job applicants, contractors, suppliers and other individuals.

This Privacy and Data Protection Policy explains how we collect, use, store, disclose and protect personal data when you:

  • visit or interact with our website;

  • contact us regarding our services;

  • request a quotation or consultation;

  • engage us to provide HR or administration services;

  • provide documents or information through email, online forms or other electronic means; or

  • are an employee, applicant, contractor or other individual whose personal information is provided to us by one of our clients.

We process personal data in accordance with:

  • Regulation (EU) 2016/679 – the General Data Protection Regulation ("GDPR");

  • the Data Protection Act, Chapter 586 of the Laws of Malta; and

  • other applicable Maltese and European Union data protection legislation.

For data protection enquiries, please contact:

Data Protection Contact: Julie Maurice: julie@hr-together.com

Unless legally required, the business does not necessarily appoint a formal Data Protection Officer. Data protection enquiries may instead be directed to the contact identified above.

Because we provide HR and administration services, our role under data protection legislation will depend on the circumstances.

We generally act as a Data Controller where we determine why and how personal data is processed. This may include personal data relating to:

  • website visitors;

  • prospective clients;

  • our clients and client contacts;

  • suppliers and service providers;

  • persons who contact us directly;

  • billing and accounting contacts; and

  • marketing contacts, where applicable.

When a client engages us to provide HR or administration services and provides personal data relating to its employees, candidates, customers or other individuals, we may process that information on behalf of the client.

In these circumstances, the client will generally remain the Data Controller and we will act as its Data Processor.

Where required, processing will be governed by an appropriate Data Processing Agreement or contractual data protection provisions setting out, amongst other matters, the nature and purpose of processing, confidentiality requirements, security measures and our obligations when processing data on the client's behalf.

When acting as a processor, we will process personal data only in accordance with the documented instructions of the relevant client unless otherwise required by law.

Depending upon your relationship with us and the services requested, we may process personal data:

This may include:

  • name; address; email address; telephone/mobile number; date of birth; nationality; identification details; and professional or business contact details.

Where necessary to provide HR services, this may include:

  • CVs and employment applications; employment history; education and qualifications; employment contracts; job descriptions; salary and remuneration information; payroll-related information; attendance and leave information; performance information; training records; disciplinary and grievance documentation; termination documentation; references; recruitment information; and other employment-related records.

To provide Administration services and depending upon the service requested, this may include:

  • identification documents; passport or identity card information; residence and employment documentation; work permit documentation; correspondence; contracts and agreements; company records; invoices and payment records; and other documentation required to perform the agreed administrative service.

Special Categories of Personal Data

Certain HR assignments may require the processing of information considered particularly sensitive under the GDPR.

This may include information concerning:

  • health; disability; racial or ethnic origin; religious or philosophical beliefs; trade union membership; or other special category information where relevant.

We will only process special category personal data where there is an appropriate lawful basis and an additional condition permitting the processing under applicable data protection legislation.

We will not request sensitive personal information unless it is reasonably necessary for the service being provided.

Website and Technical Information

When you use our website, certain technical information may be collected automatically, including:

  • IP address; browser type; device information; operating system; pages visited; date and time of visits; referring website; and cookie or similar technology information.

Please refer to our Cookie Policy for further information.

We may receive personal data:

  • directly from you; through our website; by email, telephone or electronic messaging; during consultations or meetings; through contracts and service agreements;

  • from a client who has engaged us to provide HR or administrative services; from employees, applicants, contractors or representatives of a client;

  • from professional advisers or authorised representatives; from publicly available sources where appropriate; and

  • from third-party service providers where lawful and necessary.

Where personal data is provided to us by a client, the client is responsible for ensuring that it has an appropriate lawful basis for providing the information to us.

We may process personal data for purposes including:

  • responding to enquiries; providing quotations and proposals; 

  • establishing and managing client relationships; 

  • providing any and all contracted HR services;

  • providing any and all administration services; 

  • protecting our legal rights;

  • preventing fraud or misuse of our services;

  • maintaining the security of our website and systems;

  • complying with Maltese and EU legal obligations;

We will not use personal data for purposes incompatible with those for which it was originally collected unless permitted by law.

Depending upon the circumstances, we may rely on one or more of the following lawful bases:

Contract – processing is necessary to enter into or perform a contract with you.

Legal obligation – processing is necessary for us to comply with Maltese or EU law.

Legitimate interests – processing is necessary for our legitimate business interests or those of a third party, provided those interests are not overridden by your rights and freedoms.

Consent – where we have asked you to provide specific, freely given consent for a particular processing activity.

Vital interests – where processing is necessary to protect someone's vital interests in exceptional circumstances.

Where special category personal data is processed, we will also identify an appropriate condition under Article 9 GDPR or other applicable legislation.

Where we rely upon consent, you may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing undertaken before consent was withdrawn.

Our clients may provide us with personal information relating to their employees, former employees, applicants, contractors or other individuals.

Where we process employee information solely on behalf of a client, the client normally remains responsible for determining the lawful basis for processing and for providing appropriate privacy information to affected individuals.

We will process such information only for the purposes agreed with the client and in accordance with the applicable contract and Data Processing Agreement.

We do not sell personal data.

We may disclose personal data where necessary to:

  • our professional advisers;

  • accountants or auditors;

  • IT and hosting providers;

  • cloud software providers;

  • payroll or HR systems where relevant;

  • payment providers;

  • professional service providers;

  • public authorities;

  • courts or tribunals;

  • regulators;

  • law enforcement bodies; or

  • other parties where disclosure is required or permitted by law.

Where third-party processors process personal data on our behalf, appropriate contractual and data protection safeguards will be implemented where required.

We will seek to store and process personal data within Malta, the European Economic Area ("EEA") or jurisdictions recognised by the European Commission as providing an adequate level of data protection wherever reasonably practicable.

Some technology, cloud, communication or other service providers may process information outside the EEA.

Where personal data is transferred outside the EEA to a country which has not been recognised as providing adequate protection, we will ensure that an appropriate lawful transfer mechanism is used where required, and agreement in the form of international data transfer consent document is signed by all parties 

We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Access to personal information is restricted to persons who reasonably require access for legitimate business purposes.

We will retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including satisfying legal, contractual, accounting and reporting obligations.

Retention periods will be in line with regulatory guidelines.

Where we process HR information on behalf of a client, personal data will be returned, deleted or retained following termination of the service in accordance with the relevant Data Processing Agreement, contractual instructions and applicable law.

Information that is no longer required will be securely deleted, destroyed or anonymised, subject to applicable legal requirements.

Subject to the GDPR and any applicable limitations or exemptions, all of the subject data rights apply 

Not every right applies in every circumstance.

Where we process personal data solely on behalf of one of our clients, requests concerning that information may need to be referred to the relevant client as Data Controller.

Requests concerning your personal data should be submitted to:

Email: julie@hr-together.com

We may need to verify your identity before responding to a request.

Requests will be handled within the time periods required by applicable data protection legislation.

We do not make decisions producing legal or similarly significant effects about individuals solely through automated processing unless expressly stated otherwise and permitted by law.

If this changes, affected individuals will be provided with the information required by applicable data protection legislation.

Where artificial intelligence or automated tools are used to assist in providing HR or administrative services, we will consider the nature and sensitivity of personal information before using such systems.

Confidential, employee or special category personal data will not be entered into public or unauthorised AI systems.

Where an AI or automated service provider processes personal data on our behalf, we will assess the data protection arrangements applicable to that service and implement appropriate contractual and organisational safeguards where required.

AI-assisted output relating to HR matters will remain subject to appropriate human review where necessary.

Our website may use cookies or similar technologies for essential website functions, security, analytics or other purposes.

Non-essential cookies requiring consent will not be placed before the appropriate consent has been obtained.

Users must be provided with an appropriate method of accepting, rejecting and, where applicable, managing non-essential cookies.

Further information should be provided in our separate Cookie Policy.

Where we send direct marketing communications, we will do so only where permitted by applicable law.

Where consent is required, marketing communications will only be sent after the appropriate consent has been obtained.

You may unsubscribe from marketing communications at any time by contacting us.

Withdrawing from marketing communications will not prevent us from sending necessary communications relating to an existing contract or service.

We maintain procedures for identifying, assessing and responding to suspected personal data breaches.

Where a personal data breach is likely to result in a risk to individuals' rights and freedoms, we will notify the competent supervisory authority in accordance with applicable legal requirements.

Where a breach is likely to result in a high risk to affected individuals, we will also notify those individuals where required by law.

Where we act as a Data Processor, we will notify the relevant Data Controller of a personal data breach affecting information processed on its behalf without undue delay and in accordance with our contractual obligations.

Third-Party Websites

Our website may contain links to third-party websites. We aim to use legitimate websites only however we cannot be responsible for all content or external links on third party websites. We are not responsible for the privacy practices of independent third-party websites. Users should review the privacy notices applicable to those websites before providing personal information.

We encourage you to contact us first if you have concerns regarding how we process your personal data so that we can investigate the matter.

You also have the right to lodge a complaint with the competent data protection supervisory authority.

For businesses established in Malta, the supervisory authority is:

Office of the Information and Data Protection Commissioner (IDPC)
Floor 2, Airways House
High Street
Sliema SLM 1549
Malta

Changes to This Policy

We may amend this Privacy and Data Protection Policy from time to time to reflect changes in our services, technology, business operations or legal obligations.

The current version will be published on this website and the "Last Updated" date will be amended accordingly.

Contact Us