Legal information
Privacy policy
Last updated 26 October 2026
This page explains what personal data we receive on partyinmalta.com, what it's used for, who has access to it, how long we keep it and how to exercise your rights. In short: apart from the technical data that protects the site, we only receive what you enter in a form or write to us, and every email we send includes an unsubscribe link.
Data controller
The data controller is the publisher of partyinmalta.com, operating under the brand Party in Malta (Malta).
A question about your data or about this page? Email info@maltapartyvibes.com, or message us on WhatsApp at +356 7759 0493.
The data we receive
Depending on the form you fill in, we receive:
Parties during your stay: your name, your email address, your arrival and departure dates and, if you wish, the number of people. After signing up, you can add your mobile number.
Newsletter: your email address, and the page or list you signed up from.
On-sale alert (“Notify me”): your email address, your name if you give it, and the party whose tickets you're waiting for. On a page that isn't about a specific party, such as the boat parties page, this form signs you up to the newsletter and records the page's theme.
Contact: your name, your email address, your message and, if you wish, your phone number.
VIP table: your first name, your email address, the number of people, the party chosen and its date, plus, if you add them, your surname, your phone number and a comment.
With each submission, we also record its date, the page it was sent from and the language of the site.
WhatsApp: if you message us on WhatsApp, we see your number, your profile name and the messages exchanged.
Emails sent: a copy of each email we send you, its date and its delivery status (for example delivered or bounced), as reported by our email service.
Technical data: each submission goes through an anti-spam check. Your IP address is used at that moment without being stored with your request, and we look at how the form was filled in, for example how long it took. When a submission is blocked as spam, a security log keeps a one-way hash of the IP address, the browser type and the partly masked email address. Our hosting provider also keeps its usual technical logs.
We don't create accounts, and we don't ask for any sensitive data or payment details on this site: tickets are bought on our partners' ticketing platform, described below. For a VIP table, we may ask you for a deposit: it's paid to our team via Revolut, outside this site. Revolut then processes the payment details under its own privacy policy; we keep a record of the payment (name, amount and date) for our accounts.
What it's used for, and on what legal basis
Sending you the emails you asked for (confirmation, parties during your dates, on-sale alerts, new parties in Malta) and, if you added your mobile number, also messaging you on WhatsApp about these parties: on the basis of your consent (Article 6(1)(a) GDPR), which you can withdraw at any time, without affecting messages already sent.
Replying to your messages and VIP table requests, and passing a VIP request on to the venue concerned: on the basis of pre-contractual steps taken at your request (Article 6(1)(b)) and our legitimate interest in replying to you (Article 6(1)(f)).
Blocking spam and abusive submissions, securing the site and keeping a record of the emails sent: on the basis of our legitimate interest (Article 6(1)(f)).
A contact message or a VIP request doesn't sign you up to any mailing list. We don't do targeted advertising and we don't make any automated decisions about you.
Who has access to it
Your data is neither sold nor rented out. Only the following recipients have access to it:
Our team, to reply to you and to manage the lists and alerts.
The venue hosting the party, only for a VIP table request: your name, the date, the number of people, your email address and, if you gave it, your mobile number, so that it can confirm the table.
Our technical service providers, who act on our behalf and on our instructions: Supabase for the database, located in the European Union; Netlify for hosting the site and the servers that receive the forms; Resend for sending emails; Google for our team's mailbox (Google Workspace).
Our technical platform, worldpartyvibes.com, run by the same publisher: it receives the forms and sends our emails. This address may therefore appear as the sender and in unsubscribe links.
WhatsApp (Meta), only if we chat on WhatsApp: the conversation is then also subject to WhatsApp's terms.
The ticketing platform: the Tickets button takes you from our site to the party's official page on GetYourTickets.com, the platform on which our official partners sell tickets. Whatever you enter there, including payment, is handled by that platform under its own privacy policy; we don't receive your payment details.
Apart from these cases, we only disclose your data where the law requires it.
The chat assistant
The site offers an automated chat assistant (artificial intelligence) that answers your questions about the parties. It's identified as such in the chat window.
Your messages are sent, for as long as it takes to produce the answer, to Groq, Inc. (United States), the service that runs the assistant. Before they're sent, any email addresses and phone numbers you type are masked. We don't keep your conversations: they stay in your browser and disappear when you close the page.
Please don't type personal data into the assistant. For a request about you (a VIP table, a group booking), use the forms or WhatsApp. According to its documentation, Groq doesn't keep these messages by default; it may keep a record for 30 days at most, for service reliability and abuse prevention.
Transfers outside the European Economic Area
Some of these providers are based outside the European Economic Area or process data there, notably in the United States and Singapore. This is the case for the servers that receive the forms and for the email services. These transfers are covered by the European Union's standard contractual clauses and, for certified providers, by the EU-US Data Privacy Framework. You can ask us for details of these safeguards at info@maltapartyvibes.com.
How long we keep it
Lists and alerts: for as long as your subscription is active. Alerts linked to your travel dates stop automatically once those dates have passed.
Unsubscribing: we stop emailing you straight away. Seven days later, we delete your name, phone number, dates, message and interests. All that remains is your email address, your language, where you signed up, the record of your unsubscribing and the list of alerts already sent, so that you can't be signed up again by mistake.
Contact messages and VIP table requests without a list sign-up: two years after your last request, then deleted.
Copies of emails sent and their delivery status: one year.
Security log of submissions rejected as spam: ninety days.
WhatsApp conversations: two years after your last message.
Our hosting provider's technical logs: for a limited period, set by its own policy.
Data that the law requires us to keep: for the legal period, then deleted.
Your rights
You have the right to access your data, to have it corrected or erased, to restrict its use, to object to processing based on our legitimate interest, to receive the data you've given us in a commonly used format (portability) and to withdraw your consent at any time. You can also leave us instructions on what should happen to your data after your death.
To do so, email info@maltapartyvibes.com, ideally from the address concerned. We reply within one month, which may be extended in the cases provided for by the GDPR. To stop receiving our emails, the unsubscribe link in each one is all you need; on WhatsApp, just tell us.
If you believe your rights aren't being respected, you can lodge a complaint with the IDPC, Malta's data protection authority (idpc.org.mt), or with the authority in the country where you live, for example the Information Commissioner's Office in the United Kingdom (ico.org.uk) or the Data Protection Commission in Ireland (dataprotection.ie).
Minimum age
This site and its forms are intended for people aged 17 and over. We don't knowingly collect data from younger people: if you think this has happened, email us and we'll delete it.
Security
Exchanges with the site and the forms are encrypted (HTTPS). The database can only be accessed by our servers, our automated tasks and an internal, password-protected dashboard reserved for our team. In the event of a data breach, we notify the supervisory authority and, where the law requires it, the people concerned.
Cookies
The site sets no cookies and loads no analytics or advertising tools. Our cookie policy gives the details.
Changes to this policy
When this policy changes, the new version is shown here, with its date. If the change is significant for data we've already received, we'll tell you by email.