This policy explains how Palazzo Paolina Boutique Hotel collects and uses personal data when you visit this website, book a stay, contact us or stay with us, and the rights you have under the EU General Data Protection Regulation (GDPR) and Malta's Data Protection Act.
Who we are
The data controller is P & D Investments Limited (VAT No. 2375-0326MT), 50 St Thomas Bay Road, Marsascala, Malta, which operates Palazzo Paolina Boutique Hotel, 101 St Paul Street, Valletta VLT 1216, Malta (licence H0451). You can contact us at [email protected] or on +356 2124 2442.
What we collect and why
- Bookings: your name, contact details, dates, room, number of guests and any requests. Bookings made on this website are handled by our booking engine, Little Hotelier (part of SiteMinder), and card payments by its payment provider; this website does not store card numbers. We use this information to take and manage your booking.
- At check-in: photo identification and a credit card, which we need to register your stay as the law requires and to secure any extras.
- Enquiries: whatever you send us by email or tell us by phone, so that we can reply.
- Job applications: your CV and the details you send us, so that we can consider your application.
- Website visits: technical data such as your IP address, browser and the pages you view, recorded by our hosting and security providers to keep the site running and secure. If you accept analytics cookies, Google Analytics also collects statistics about how the site is used.
We rely on the contract with you for bookings and stays, on legal obligations for registration and accounting records, on our legitimate interest in running and protecting the website and answering enquiries, and on your consent for analytics cookies.
Who we share it with
We share personal data only with providers who help us run the hotel and this website: our booking engine (Little Hotelier), our web host and website developer, Cloudflare for security and performance, and, if you consent, Google for analytics. If you book through another platform, such as Booking.com, that platform passes your booking to us under its own privacy policy. We disclose data to the authorities only when the law requires it, and we never sell personal data.
Transfers outside the EU
Some providers, such as Google and Cloudflare, may process data outside the European Economic Area. Where they do, the transfer is protected by the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.
How long we keep it
We keep booking and stay records for as long as Maltese tax and accounting law requires, enquiries for as long as we need to deal with them, and job applications for up to six months unless you agree to a longer period. Analytics data is deleted after 14 months.
Your rights
You can ask for a copy of your personal data, ask us to correct or delete it, restrict or object to how we use it, ask us to transfer it, and withdraw your consent at any time. Email [email protected] and we will reply within one month.
If you are not satisfied with our answer, you can complain to Malta's Information and Data Protection Commissioner (idpc.org.mt).
Changes to this policy
We may update this policy from time to time. It was last updated in October 2026.