Privacy Policy
Last updated: August 2026
CiaoStay respects your privacy. This policy explains what personal data we collect, why we collect it, and how we keep it safe when you use our website or book a holiday home in Malta.
1. Data Controller
The data controller is CiaoStay, the manager of short-let holiday accommodation in Malta. For any privacy-related questions, contact us at info@ciaostay.com.
2. What Data We Collect
We collect only the information necessary to manage your booking and comply with legal obligations. This may include:
- Name, email address and phone number
- Passport or government-issued ID details
- Booking dates, apartment details and estimated arrival time
- Payment information (processed securely by our payment providers)
- Correspondence and special requests
- Technical data such as IP address and browser type
3. How We Use Your Data
We use your data to:
- Process and confirm reservations
- Send check-in instructions and property access details
- Communicate before, during and after your stay
- Comply with Malta Tourism Authority (MTA) and tax reporting requirements
- Handle payments, deposits and refunds
- Prevent fraud and ensure security
4. Legal Basis for Processing
We process personal data on the basis of: (a) performance of a contract (your booking), (b) compliance with legal obligations (such as MTA registration and tax reporting), and (c) your consent, where required (for example, marketing communications).
5. Sharing Your Data
We do not sell your personal data. We share it only with trusted service providers necessary to deliver our service — such as payment processors, property owners, cleaning and maintenance partners, and legal or tax authorities when required by law. All partners are bound by confidentiality obligations.
6. Data Retention
We keep your personal data for as long as necessary to fulfil the purposes described above, and for any period required by Maltese or EU law. Identity documents are securely deleted once the legal retention period has passed, unless a longer period is required by authorities.
7. Your Rights
Under GDPR and applicable data protection law, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data, where legally permitted
- Object to or restrict certain processing
- Request a copy of your data in a portable format
- Withdraw consent at any time
To exercise any of these rights, please email us at info@ciaostay.com.
8. Cookies & Tracking
Our website uses only essential cookies required for the site to function and for security. We do not use third-party advertising or tracking cookies. You can manage cookies through your browser settings.
9. Security
We use industry-standard measures to protect your data, including encrypted connections, secure hosting, and restricted access to personal information. However, no online service can guarantee absolute security.
10. Changes to This Policy
We may update this Privacy Policy from time to time. The latest version will always be available on this page, and we will note the date of the last update.
11. Contact Us
For any questions about this Privacy Policy or how we handle your data, please contact us at info@ciaostay.com.