Privacy Policy | Mdina Cathedral Museum

1. Data Controller

The data controller responsible for your personal data is the Mdina Cathedral Museum, operated by the Metropolitan Chapter of Malta, Archbishop’s Square, Mdina, Malta MDN 1061. Email: info@metropolitanchapter.com. Telephone: +356 2145 4697.

1. Data Controller

2. What Data We Collect

We may collect the following categories of personal data when you use this website:

Contact form submissions: your name, email address, and the content of your message.
Enquiry forms (Museum Office): name, email address, request type, preferred date, and message.
Analytics data: anonymised usage data collected via Google Analytics (GA4), including pages visited, time on site, device type, and approximate geographic location.
Cookie data: session identifiers and preference cookies as detailed in our Cookie Policy.

3. How We Use Your Data

We use your personal data for the following purposes:

To respond to your enquiries and contact form submissions.
To process event, group visit, and special request enquiries.
To improve the website and visitor experience through anonymised analytics.
To comply with legal obligations.

4. Legal Basis for Processing

We process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

Consent: where you have provided explicit consent (e.g. submitting a contact form or accepting analytics cookies).
Legitimate interests: to respond to genuine enquiries and to maintain the security and functionality of this website.
Legal obligation: where we are required to process data by applicable law.

5. Third-Party Processors

We use the following third-party services that may process your data:

Google Analytics (GA4): anonymised website usage analytics. Data is processed by Google LLC in accordance with their privacy policy. You may opt out via Google’s opt-out tools.
Google Site Kit: analytics integration plugin.
Wordfence Security: website security monitoring. May log IP addresses for security purposes.
Email hosting provider: used to receive and respond to contact form submissions.

6. Data Retention

We retain personal data for the following periods:

Contact and enquiry form data: retained for up to 2 years from the date of submission, or until the enquiry is resolved, whichever is sooner.
Analytics data: retained in accordance with Google Analytics default retention settings (up to 14 months).
Security logs: retained for up to 90 days.

7. Your Rights

Under GDPR, you have the following rights regarding your personal data:

Right of access: you may request a copy of the personal data we hold about you.
Right to rectification: you may request correction of inaccurate data.
Right to erasure: you may request deletion of your data where there is no lawful reason for us to continue processing it.
Right to data portability: you may request your data in a structured, machine-readable format.
Right to object: you may object to processing based on legitimate interests.
Right to restrict processing: you may request that we limit how we use your data.

To exercise any of these rights, please contact us at: info@metropolitanchapter.com

8. Cookies

This website uses cookies. Please refer to our Cookie Policy for full details of the cookies we use, their purpose, and how to manage your preferences.

9. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. This website uses HTTPS encryption for all data transmission.

10. Complaints

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the Malta Information and Data Protection Commissioner (IDPC):

Office of the Information and Data Protection Commissioner
Second Floor, Airways House
High Street, Sliema SLM 1549, Malta
Email: idpc.info@idpc.org.mt
Website: idpc.org.mt

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated revision date. We encourage you to review this policy periodically.

Last updated: April 2026

1. Data Controller

2. What Data We Collect

We may collect the following categories of personal data when you use this website:

Contact form submissions: your name, email address, and the content of your message.
Enquiry forms (Museum Office): name, email address, request type, preferred date, and message.
Analytics data: anonymised usage data collected via Google Analytics (GA4), including pages visited, time on site, device type, and approximate geographic location.
Cookie data: session identifiers and preference cookies as detailed in our Cookie Policy.

3. How We Use Your Data

We use your personal data for the following purposes:

To respond to your enquiries and contact form submissions.
To process event, group visit, and special request enquiries.
To improve the website and visitor experience through anonymised analytics.
To comply with legal obligations.

4. Legal Basis for Processing

We process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

Consent: where you have provided explicit consent (e.g. submitting a contact form or accepting analytics cookies).
Legitimate interests: to respond to genuine enquiries and to maintain the security and functionality of this website.
Legal obligation: where we are required to process data by applicable law.

5. Third-Party Processors

We use the following third-party services that may process your data:

Google Analytics (GA4): anonymised website usage analytics. Data is processed by Google LLC in accordance with their privacy policy. You may opt out via Google’s opt-out tools.
Google Site Kit: analytics integration plugin.
Wordfence Security: website security monitoring. May log IP addresses for security purposes.
Email hosting provider: used to receive and respond to contact form submissions.

6. Data Retention

We retain personal data for the following periods:

Contact and enquiry form data: retained for up to 2 years from the date of submission, or until the enquiry is resolved, whichever is sooner.
Analytics data: retained in accordance with Google Analytics default retention settings (up to 14 months).
Security logs: retained for up to 90 days.

7. Your Rights

Under GDPR, you have the following rights regarding your personal data:

Right of access: you may request a copy of the personal data we hold about you.
Right to rectification: you may request correction of inaccurate data.
Right to erasure: you may request deletion of your data where there is no lawful reason for us to continue processing it.
Right to data portability: you may request your data in a structured, machine-readable format.
Right to object: you may object to processing based on legitimate interests.
Right to restrict processing: you may request that we limit how we use your data.

To exercise any of these rights, please contact us at: info@metropolitanchapter.com

8. Cookies

This website uses cookies. Please refer to our Cookie Policy for full details of the cookies we use, their purpose, and how to manage your preferences.

9. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. This website uses HTTPS encryption for all data transmission.

10. Complaints

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the Malta Information and Data Protection Commissioner (IDPC):

Office of the Information and Data Protection Commissioner
Second Floor, Airways House
High Street, Sliema SLM 1549, Malta
Email: idpc.info@idpc.org.mt
Website: idpc.org.mt

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated revision date. We encourage you to review this policy periodically.

Last updated: April 2026