Last updated: 2 March 2026
Who we are
Magdalena is a self-catering holiday home at 48 Triq Il-Gendus, Bormla (Cospicua), BML1022, Malta. For the purposes of data protection law, we — Dick and Christine — are the data controllers for the personal data described in this policy.
You can reach us at magdalena.bormla@gmail.com.
What data we collect and why
Booking enquiries
When you use our enquiry form, we collect your name, email address, preferred check-in and check-out dates, number of guests, and any message you include. We use this to respond to your enquiry and, if a booking follows, to manage your stay.
Website analytics
We use Google Analytics 4 (GA4) to understand how visitors find and use this website. GA4 records the pages you visit, how long you spend on them, your approximate location (country or city — not your home address), your device type and browser, and how you arrived at the site. Your IP address is anonymised before it reaches Google.
GA4 uses cookies in your browser to identify returning visitors and maintain sessions. See the Cookies section below.
Server logs
Our web server automatically records standard access logs: your IP address, the page requested, the date and time, and your browser type. These are used for security monitoring only and are deleted after 30 days.
Gmail integration (Google API)
We use the Google Gmail API to scan our own reservations inbox (magdalena.bormla@gmail.com) for incoming Booking.com confirmation emails. This is a read-only integration: the scanner reads message subjects to extract the Booking.com reservation ID and the check-in date, and matches each against an existing booking record to fill in its reservation number. No message bodies are read, no attachments are downloaded, no emails are stored on our servers, forwarded, or shared with any third party.
The connection uses Google OAuth with the gmail.readonly scope only. We never request write access, send-mail access, or any other Gmail permission. The scanner runs on a schedule (typically every 30 minutes) and processes only emails from noreply@booking.com with the subject pattern “New booking!”.
Access to the inbox can be revoked at any time at myaccount.google.com/permissions. When revoked, the scanner stops immediately and no further data is read.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Legal basis for processing
GDPR requires us to have a lawful basis for every type of processing:
- Enquiry and booking data — pre-contractual steps (Article 6(1)(b)). You have asked us to take action with a view to making a booking, and we need your details to respond.
- Analytics (GA4) — legitimate interests (Article 6(1)(f)). We have a genuine interest in understanding how our website performs. IP anonymisation is enabled and the analysis does not identify you personally.
- Server logs — legitimate interests (Article 6(1)(f)). Maintaining basic security logs is a reasonable operational need.
- Functional cookies — legitimate interests (Article 6(1)(f)). Cookies required purely to deliver the website correctly are technically necessary.
How long we keep your data
- Enquiry data (no booking made) — deleted after 1 year.
- Booking records — kept for 5 years after your stay, as required under Maltese tax law.
- Analytics data — retained by Google for up to 14 months, then automatically deleted.
- Server logs — deleted after 30 days.
Cookies
Cookies are small text files stored in your browser. This site uses the following:
Google Analytics cookies
- _ga — distinguishes unique visitors. Set by Google Analytics. Expires after 2 years.
- _ga_L9ZKB8TQ96 — maintains session state for our Analytics property. Set by Google Analytics. Expires after 2 years.
Technical cookies
- LSCWP_VARY — ensures the correct cached version of a page is served to you. Set by our web server (LiteSpeed Cache). Deleted when you close your browser.
You can control or delete cookies through your browser settings at any time. Disabling analytics cookies will not affect your ability to use this site. To opt out of Google Analytics tracking across all websites, use the Google Analytics opt-out browser add-on.
Who we share your data with
We do not sell your data. We share it only as follows:
- Google LLC — receives anonymised analytics data via GA4. Google operates under the EU–US Data Privacy Framework. Google’s privacy policy.
- Our web host — our website is hosted on servers within the European Economic Area. Your data does not leave the EEA through hosting.
Your rights
Under GDPR you have the right to:
- Access — ask us what personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your data, subject to any legal obligations we have to keep certain records.
- Restriction — ask us to pause processing while a dispute is resolved.
- Portability — request a copy of the data you have provided to us in a machine-readable format.
- Object — object to processing based on legitimate interests. We will stop unless we can show compelling legitimate grounds that override your interests.
To exercise any of these rights, email magdalena.bormla@gmail.com. We will respond within one month.
Supervisory authority
You have the right to lodge a complaint with Malta’s data protection authority if you believe we have not handled your data lawfully:
Information and Data Protection Commissioner (IDPC)
https://idpc.org.mt
Changes to this policy
If we make significant changes to this policy, we will update the date at the top of this page.