Privacy Policy

ND Web Design (“we”, “us”, or “our”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website or engage with our services, and sets out your rights in relation to that data.

We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”) and applicable Maltese data protection legislation. By using our website or providing us with your personal data, you acknowledge that you have read and understood this Policy.

For the purposes of applicable data protection law, ND Web Design is the data controller responsible for your personal data. We are a web design studio based in Malta. If you have any questions about this Policy or how we handle your data, you may contact us using the details on our contact page.

We may collect and process the following categories of personal data:

• Information you provide to us. When you complete our contact form or otherwise communicate with us, we may collect your name, business name, email address, telephone number, and the contents of your message or enquiry.
• Technical and usage information. When you visit our website, certain information may be collected automatically, such as your device type, browser, approximate location derived from your IP address, and how you interact with the site. This information helps us operate, secure, and improve our website.

We do not knowingly collect special categories of personal data through our website. Please do not submit sensitive information to us unless specifically requested and necessary.

We process your personal data only where we have a lawful basis to do so, including:

• To respond to your enquiries and provide information you request, on the basis of taking steps at your request prior to entering into a contract, and our legitimate interest in responding to communications.
• To provide and administer our services, on the basis of performance of a contract with you.
• To operate, secure, and improve our website, on the basis of our legitimate interests in running a safe and effective online presence.
• To comply with legal obligations, where processing is necessary to meet our legal or regulatory duties.
• For marketing communications, only where you have given your consent, which you may withdraw at any time.

Our website may use cookies and similar technologies that are strictly necessary for the site to function, as well as, where you consent, technologies that help us understand how the site is used. You can manage or disable non-essential cookies through your browser settings or any cookie controls we provide. Disabling certain cookies may affect the functionality of the website.

We do not sell your personal data. We may share your personal data only in the following limited circumstances:

• Trusted service providers. We engage carefully selected third-party providers who process data on our behalf to help us operate our business and deliver our services. Such providers act under our instructions and are bound by contractual obligations of confidentiality and data protection, and may only process your data for the purposes we specify.
• Legal and regulatory requirements. We may disclose data where required to do so by law, court order, or a competent authority, or to establish, exercise, or defend legal claims.
• Business transfers. In the event of a reorganisation, merger, or transfer of our business, data may be transferred as part of that transaction, subject to appropriate safeguards.

We provide our service providers only with the information necessary for them to perform their functions, and we require them to maintain appropriate security and confidentiality measures.

Where personal data is transferred outside the European Economic Area, we take appropriate steps to ensure that it continues to benefit from an adequate level of protection, including by relying on recognised adequacy decisions or implementing approved safeguards such as standard contractual clauses.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. Enquiry and contact data is retained for a reasonable period to allow us to respond and maintain our business records, after which it is securely deleted or anonymised. The criteria used to determine retention periods include the nature of the data, the purposes of processing, and applicable legal obligations.

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. While we take reasonable steps to safeguard your data, no method of transmission over the internet or electronic storage is entirely secure, and we cannot guarantee absolute security.

Subject to applicable law, you have the following rights in relation to your personal data:

• Right of access: to obtain confirmation of whether we process your data and a copy of that data.
• Right to rectification: to have inaccurate or incomplete data corrected.
• Right to erasure: to request deletion of your data in certain circumstances.
• Right to restriction: to request that we limit the processing of your data.
• Right to data portability: to receive your data in a structured, commonly used, machine-readable format.
• Right to object: to object to processing based on our legitimate interests or for direct marketing.
• Right to withdraw consent: where processing is based on consent, at any time, without affecting prior processing.

To exercise any of these rights, please contact us using the details on our contact page. We will respond within the timeframes required by law.

Our website and services are not directed at children, and we do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us so that we can take appropriate action.

Our website may contain links to third-party websites or resources. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any website you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. The updated version will be indicated by an updated “Last updated” date and will take effect as soon as it is published. We encourage you to review this Policy periodically.

If you have concerns about how we handle your personal data, we encourage you to contact us first so that we can address them. You also have the right to lodge a complaint with the supervisory authority in Malta, the Office of the Information and Data Protection Commissioner (IDPC), or with the data protection authority in your country of residence.