Key points
- We collect only what we need to answer you, run calls and projects, and keep this site secure. We never sell personal data.
- Analytics and marketing cookies stay off unless you switch them on in the cookie banner.
- You can ask to see, correct or delete your data at any time by emailing hello@haystack.mt.
- If you are unhappy with how we handle your data, you can complain to Malta’s Information and Data Protection Commissioner.
01
Who we are
This website is operated by Haystack Ltd, a company registered in Malta with company number C93790 and VAT number MT27064714, whose registered office is at 103, Archbishop Street, Valletta, Malta and whose office is at SOHO Savoy Gardens, Triq D’Argens, Gżira, Malta (“Haystack”, “we”, “us”). We are the controller of the personal data described in this policy. For any question about your data, email hello@haystack.mt or call +356 9926 1998.
02
The information we collect
Information you give us. When you send an enquiry, ask for a quote, request a product demo, book a call, enquire about funding or subscribe to our newsletter, we collect the details you enter. That is usually your name, work email, company, phone number if you give one, and your message. When you book a call we also record the time you chose.
Information collected automatically. Like most websites, our servers record technical data such as your IP address, browser type and the pages requested, which we use to keep the site running and secure. If you allow analytics cookies, Google Analytics also records how you use the site (pages visited, time on page, the site that referred you, general location and device type).
Information from clients. When we deliver a project we may process personal data that belongs to our client, such as their customers or staff. In that case we act on the client’s instructions as their processor under a written agreement, and the client’s own privacy notice applies.
03
How we use it and our legal basis
- Answering enquiries, quotes and demo requests: to take steps you ask for before a possible contract, and our legitimate interest in responding to people who contact us.
- Booking and running calls: to take steps you ask for before a possible contract.
- Delivering projects, invoicing and support: to perform our contract with you.
- Sending our newsletter: your consent, which you can withdraw at any time using the unsubscribe link or by emailing us.
- Analytics and measuring marketing: your consent, given through the cookie banner.
- Protecting the site from spam and abuse: our legitimate interest in keeping our forms and booking system secure, for example by limiting repeated submissions.
- Keeping business records: to meet our legal obligations, including accounting and tax rules in Malta.
04
Booking a call with us
Our booking system checks our team’s Google Calendar for free times and creates the meeting in Google Calendar with a Google Meet link. Google sends the invitation, which includes your name, email address and the details you entered, to you and to the member of our team hosting the call. Google processes this data under its own terms and privacy policy.
05
Who we share it with
We share personal data only with service providers who help us run our business, under agreements that require them to protect it and use it only on our instructions. These are:
- our website hosting provider, Pressable, part of Automattic;
- Google, for email (including the notifications and replies sent from our website forms), calendar, video calls and, if you consent, Google Analytics;
- Cloudflare, if we use its Turnstile check to stop spam on our forms.
We may also share data with our professional advisers, or with public authorities where the law requires it. We do not sell or rent personal data to anyone.
06
International transfers
Some of these providers are based, or store data, outside the European Economic Area. Where that happens we rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified companies, or on the Commission’s Standard Contractual Clauses, together with any extra safeguards that are needed.
07
How long we keep it
- Enquiries, quotes and booking records: up to 24 months after our last contact, unless you become a client.
- Client and project records: for as long as we work together, and afterwards for as long as the law requires, typically up to 10 years for accounting and tax records.
- Newsletter subscriptions: until you unsubscribe.
- Analytics data: up to 14 months.
- Security logs: for short periods, only as long as needed to protect the site.
08
Your rights
Under the General Data Protection Regulation you have the right to access your personal data, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time without affecting processing that took place before. To use any of these rights, email hello@haystack.mt. We will reply within one month.
You also have the right to complain to the Information and Data Protection Commissioner, Malta’s supervisory authority, at idpc.org.mt. We would appreciate the chance to put things right first, so please contact us before you do.
09
Cookies
We use essential cookies to run the site and, only with your consent, analytics and marketing cookies. Our Cookie Policy lists them, and you can change your choice at any time using the Cookie settings link at the bottom of every page.
10
AI and your data
We do not use the personal data you send through this website to train artificial intelligence models. How we handle data in the AI systems we build for clients is explained in our AI Use and Transparency Policy.
11
Security
We protect personal data with encrypted connections, access controls, limits on repeated form submissions and regular updates to our systems. No method of transmission over the internet is completely secure, but we work to protect your information and to respond quickly if something goes wrong.
12
Children
Our website and services are aimed at businesses and are not directed at children under 16. We do not knowingly collect their personal data.
13
Changes to this policy
We may update this policy when our services or the law change. The date at the top of this page shows when it was last updated, and we will tell clients and subscribers about significant changes.
14
Contact us
Haystack Ltd (C93790), SOHO Savoy Gardens, Triq D’Argens, Gżira, Malta. Registered office: 103, Archbishop Street, Valletta, Malta. Email hello@haystack.mt or call +356 9926 1998.
