Privacy Policy

Privacy Policy

This Privacy Policy is effective from 1st July 2026. We reserve the right to modify this Privacy Policy at any time. Changes and clarifications will take effect immediately upon their posting on the website. If we make material changes to this policy, we will notify you here that it has been updated.  

Henley Alumni Malta Chapter is an independent alumni organisation affiliated with Henley Business School, University of Reading.  This policy is made compliant with the General Data Protection Regulation EU 2016/679 (“GDPR”, “Regulation”), and the Data Protection Act (Chapter 586 of the Laws of Malta).

INTRODUCTION

1.1 This Privacy Policy sets out the way in which Henley Alumni Malta Chapter (hereunder referred to as “we”, “us” or “HAMC”), collects and processes Personal Data, as well as the steps we take to protect such information (as defined in Section 2 below).

1.2 By using our services, you acknowledge that you have read and understood, the terms of this Privacy Policy, including how your Personal Data shall be used by HAMC, as well as any partners and subcontractors for the purposes set out in Section 3 of this Privacy Policy. If you do not wish to provide your Personal Data on the basis set out in this Privacy Policy, you should not enter the relevant information on the Website or provide your Personal Data to us otherwise. However, if you do not provide your Personal Data, you may not be able to use all of our services.

1.3 This policy is based on the following data protection principles:

The processing of personal data shall take place in a lawful, fair and transparent way;

The collecting of personal data shall only be performed for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;

The collecting of personal data shall be adequate, relevant and limited to what is necessary in relation to the purpose for which they are processed;

The personal data shall be accurate and where necessary, kept up to date;

Every reasonable step shall be taken to ensure that personal data that are inaccurate having regard to the purposes for which they are processed, are erased or rectified without delay;

Personal data shall be kept in a form which permits identification of the data subject for no longer than it is necessary for the purpose for which the personal data are processed;

All personal data shall be kept confidential and stored in a manner that ensures appropriate security;

Personal data shall not be shared with third parties except when necessary for them to provide services upon agreement;

Data subjects shall have the right to request access to and rectification or erasure of personal data, or restriction of processing, or to object to processing as well as the right of data portability.

WHAT INFORMATION WE COLLECT?

 2.1 Any information we collect which you can be personally identified by shall be considered as Personal Data. As such your name, email address, home address, telephone number and date of birth are all considered as Personal Data.

2.2 We collect different types of information from or through the following services:

a.       By using online forms;

b.       When you email us your details;

c.       Through surveys which we, or companies engaged by us for such purpose, undertake;

d.       With your explicit consent when signing up for our Newsletters and other email communications.

LEGAL BASIS

3.1 HAMC acts as the Data Controller for all personal data processed through our website, membership activities, events, communications, and any related services. As the Data Controller, HAMC determines the purposes and means of processing your personal data in accordance with the GDPR and the Data Protection Act (Chapter 586 of the Laws of Malta).

Entering into and performing a contract – we process your personal data on the basis of Article 6(1)(b) of the GDPR, in particular to provide you with the services you have requested from us and as necessary for the performance of a contract;

Compliance with legal obligations – we process your personal data on the basis of Article 6(1)(c) of the GDPR, if applicable;

Our legitimate interests – we process your personal data on the basis of Article 6(1)(f) of the GDPR, in particular legitimate interests which may arise directly or indirectly in relation to the services provided e.g. we may process your personal data for the purposes of establishing, exercising or defending legal proceedings. HAMC shall always ensure that your own interests, rights and freedoms are safeguarded.

Consent – we process your personal data on the basis of Article 6(1)(a) of the GDPR, in particular when the data subject has given consent to the processing of his or her personal data for one or more specific purposes, for example, to share our Newsletter with our subscribers. Should the data subject, after opting-in change his/her mind, s/he may withdraw his/her consent at any time by contacting us on hamc@henleymaltachapter.org. By doing so, all information we hold about you in relation to the Newsletter and other email communications shall be deleted.

WHAT DO WE DO WITH YOUR INFORMATION?

4.1 Your Personal Data is processed by us to provide you with the requested Services and for the following Purposes:

a.       Set-up, administer and manage your records;

b.       Provide and personalise the services;

c.       Receive and respond to your communications and requests;

d.       Ensure that we can fulfil our statutory obligations regarding your records, including by verifying the accuracy of any information you give us;

e.       Carry out market research campaigns;

f.         Preparing statistics relating to the use of the services by you and other stakeholders;

g.        Provide you with information about, and support for, the services, including this Privacy Policy; and

h.       Support any other purpose necessary for the performance of our contractual obligations or specifically stated at the time at which you provided your Personal Data.

DISCLOSURE

5.1. Except as described in this Policy, we will not intentionally disclose the Personal Data that we collect or store on the Service to third parties without your consent. We may disclose information to third parties if you explicitly consent to us doing so, as well as in the following circumstances:

a.       Any company which assists us in providing the services or which otherwise has a need to know such information;

b.       Any third party which assists us in providing the services;

c.       Any third party which can assist us in verifying the accuracy of your Personal Data, including financial institutions and credit reference agencies (a record of the search may be retained by such third party);

d.       Any third party which assists us in monitoring use of the services;

e.       Any contractors or other advisers auditing any of our business processes or who have the need to access such information for the purpose of advising us;

f.         Any law enforcement body which any reasonable requirement may have to access your Personal Data;

g.        In the event of HAMC merging with another entity, your information may be transferred to the new (merged) entity; and

h.       Any statutory body or authorised entity which have any reasonable requirement to access your Personal Data.

5.2. If at any time you wish us to stop processing your Personal Data for the above purposes, then you must contact us, and we will take the appropriate steps to stop doing so. Please note that this may mean that you may not be able to use all our services.

DATA SUBJECT RIGHTS

6.1 As a data subject you have certain rights in relation to your personal data including:

a.       Right of Access – you have the right to ask us for copies of your personal data that is being processed. There are some restrictions which means you may not always receive all the information we process;

b.       Right to Erasure – you have the right to ask us to delete your personal data in certain circumstances. This is not an absolute right and shall depend on our established retention periods;

c.       Right to Object – you have a right to object and request that we cease the processing of your personal data where we rely on our, or a third party’s legitimate interests for processing your personal data or a task carried out in the public interest;

d.       Right to Portability – you may request that we provide you with certain personal data which you have provided to us in a structured, commonly used and machine-readable format. Where technically feasible, you may also request that we transmit such personal data to a third-party controller indicated by you;

e.       Right to Rectification – you have the right to update or correct any inaccurate personal data which we hold about you;

f.         Right to Restriction – you have the right to request that we stop using your personal data in certain circumstances including if you believe that we are unlawfully processing your personal data or the personal data that We hold about you is inaccurate;

g.        Right to withdraw your consent – where our processing is based on your consent, you have the right to withdraw your consent. Withdrawal of your consent shall not affect the lawfulness of the processing based on your consent prior to the withdrawal of your consent;

h.       Right to be informed of the source – where the personal data we hold about you was not provided to us directly by you, you may also have the right to be informed of the source from which your personal data originates; and

i.          Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority (Information and Data Protection Commissioner (IDPC) - https://idpc.org.mt), you shall also have the right to an effective judicial remedy where you consider that your rights under the Regulation have been violated as a result of the processing of your personal data in contravention of the Regulation.

6.2 Your rights in relation to your personal data are not absolute. If you intend to exercise one or more of your rights, please send your request to hamc@henleyalumnimaltachapter.org

6.3 No fees are applicable when exercising your rights. Moreover, you will be provided with a response without undue delay, and in any event within one month from which starts running as soon as your identity is verified.

Following your request to exercise your rights, HAMC may need to request specific information from you to help verify your identity. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

THIRD-PARTY WEBSITES

7.1 The Service may contain features or links to websites and services provided by third parties.

7.2 HAMC will not send you unsolicited information regarding any third party’s products or services.

7.3 Once you leave our website or are redirected to a third-party website or application, you are no longer governed by this Privacy Policy.

7.4 When you click on links on our website, they may redirect you away from our site. We are not responsible for the privacy practices of other sites and encourage you to read their privacy statements.

SECURITY AND USE OF COOKIES

8.1 SECURITY

We take appropriate security measures to protect against the loss, misuse and unauthorised access, alteration, disclosure, or destruction of your information. HAMC has taken steps to ensure the ongoing confidentiality, integrity, availability, and resilience of systems and services processing Personal Data, and will restore the availability and access to information in a timely manner in the event of a physical or technical incident.

As no method of transmission over the Internet, or method of electronic storage, is 100% secure, if you believe your Personal Data has been compromised, please contact HAMC’s Data Protection Officer at hamc@henleyalumnimaltachapter.org

If we learn of a security systems breach, we will inform you of the occurrence of the breach in accordance with Applicable Law.

8.2 COOKIES

Our website is built using Google Sites. Google Sites may place strictly necessary cookies that are required for the website to function securely and correctly (for example, cookies related to load balancing, security, or session management). These cookies do not require consent under the GDPR and the ePrivacy Directive.

We do not use any analytics, advertising, or tracking cookies, and we do not deploy any cookies ourselves.

If Google Sites displays a cookie notice, this relates solely to Google’s own essential cookies. Should we introduce any optional cookies in the future (such as analytics or marketing cookies), we will update this Privacy Policy and request your consent before such cookies are used.

DATA RETENTION

9.1  This Section sets out our data retention policies and procedure, designed to help ensure that we comply with our legal obligations in relation to the retention and deletion of personal data.

9.2 Personal Data that we process for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

9.3 We only retain the Personal Data collected from a User for as long as we need it to fulfil the purposes for which we have initially collected it, unless otherwise required by law. We will retain and use information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, after which point your data will be erased.

9.4 In some cases, it is not possible for us to specify in advance the periods for which your personal data will be retained. In such cases, we will determine the period of retention based on the following criteria:

a.       What the purpose(s) was for which your information was collected in the first place;

b.       Whether there are any statutory obligations, obliging us to continue to process your information;

c.       Whether we have a legal basis in place to continue to process your information, including but not limited to consent;

d.       What the value attached to your information is;

e.       Whether there are any industry practices stipulating how long information should be retained;

f.         The risk, cost and liability attached to such retention; and

g.        Any other relevant circumstances.

INTERNATIONAL TRANSFERS

10.1 As part of the services offered to you, for example through our website, the information you provide to us may be transferred to and stored in countries outside of the European Economic Area (EEA) as we may use remote website server hosts to provide the website and some aspects of our Service, which may be based outside of the EEA, or use servers based outside of the EEA – this is generally the nature of data stored in “the Cloud”. It may also be processed by staff operating outside the EEA who work with one of our suppliers, e.g. our website server host, or work for us when temporarily outside of the EEA. A transfer of your personal data may happen if any of our servers are located in a country outside of the EEA or one of our Service providers is located in a country outside of the EEA. If we transfer or store your personal data outside the EEA in this way, we will take steps with the aim of ensuring that your privacy rights continue to be protected, as outlined in this Privacy Policy and in accordance with data protection laws.

CONTACT INFORMATION

 HAMC has a Data Protection Officer (DPO) who is responsible for matters relating to privacy and data protection. HAMC’s DPO can be reached at the following address:

Data Protection Officer

Henley Alumni Malta Chapter

14, K. Micallef Street,

Rabat RBT2073

Malta

email: hamc@henleyalumnimaltachapter.org

Version 1.0 - Last Update: 01 July 2026