Privacy Policy

1. Data controller

The data controller is the Malta Aviation Museum Foundation, Ta’ Qali, ATD 4000, Malta.
Email: [email protected]
Telephone: +356 2141 6095

This notice is given under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the Maltese Data Protection Act (Cap. 586), to everyone who visits www.maltaaviationmuseum.com or contacts the Foundation through it. The Foundation has not appointed a Data Protection Officer; for any question about your data, please write to the address above.

2. Which data we process and why

2.1 Browsing data

The servers that host the site record, as for any website, the technical data sent by the browser: IP address, date and time of the request, page requested, response code, browser and operating system. They are used only to deliver the pages, to keep the site secure and to investigate any misuse.

• Legal basis: legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
• Retention: the hosting provider’s server logs are kept for a limited period, as a rule no longer than 12 months.

2.2 Contact form

The form on the Contact Us page asks for your name, your email address and your message. The message is sent by email to the Foundation and is also saved in the site’s database, so that requests are not lost.

• Purpose: to answer your request.
• Legal basis: steps taken at your request (Art. 6(1)(b) GDPR) or, for general enquiries, the Foundation’s legitimate interest in answering whoever writes to it (Art. 6(1)(f) GDPR).
• Retention: the messages saved on the site are deleted 2 years after they are sent; the emails are kept for the time needed to handle the request.

Please do not include in the message information you do not want to share, such as health data or identity document numbers: they are not needed to answer you.

2.3 Membership and volunteer applications

The forms on the Membership & Volunteering page ask for your name and email address, which are sent by email to the Foundation’s director and saved in the site’s database.

• Purpose: to handle your application to become a member or a volunteer and to contact you about it.
• Legal basis: steps taken at your request before joining (Art. 6(1)(b) GDPR).
• Retention: the applications saved on the site are deleted 2 years after they are sent. If you become a member or a volunteer, your data are then processed by the Foundation outside the website, under the rules that apply to its members and volunteers.

2.4 Newsletter

The form in the footer of every page asks only for your email address, which is sent to Mailchimp to subscribe you to the Foundation’s newsletter about events and news. Subscription is completed only after you confirm it from the email you receive (double opt-in). The address is also saved in the site’s database.

• Legal basis: your consent (Art. 6(1)(a) GDPR).
• Unsubscribing: every newsletter contains a link to unsubscribe at any time; you can also write to [email protected].
• Retention: until you unsubscribe; the copy saved on the site is deleted after 2 years.

2.5 Comments

To comment on an article you are asked for your name, email address and, optionally, a website. Comments are published only after approval. Your name, website and comment are published; your email address is never published. The comment form is protected from spam by Google reCAPTCHA (see section 4).

Next to each published comment the site shows the picture linked to the commenter’s email address on Gravatar (Automattic Inc.): to find it, a code derived from the email address (hash) is sent to Gravatar, and visitors’ browsers download the pictures from Gravatar’s servers.

If you tick the box to save your details, three cookies keep your name, email and website in your browser for the next comment (see the Cookie Policy).

• Legal basis: your consent to the publication of the comment (Art. 6(1)(a) GDPR), and the Foundation’s legitimate interest in protecting the site from spam (Art. 6(1)(f) GDPR).
• Retention: comments stay published until you ask for their removal or the article is removed.

2.6 Statistics and embedded content

With your consent the site uses Google Analytics 4 for aggregate statistics, and shows YouTube videos and Google Maps. Before your consent these tools are not loaded. All the details, including the name and duration of each cookie, are in the Cookie Policy.

• Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from the icon at the bottom left of every page.

3. How data are protected

The site uses an encrypted connection (HTTPS). Data are processed with electronic means by people authorised by the Foundation and by the providers listed in section 4, with security measures suited to the risk. Data are not used for automated decision-making or profiling by the Foundation.

4. Who receives the data

Data are not sold or disclosed to third parties for their own marketing. They may be processed, on behalf of the Foundation and as data processors, by:

Data may be disclosed to public authorities only where required by law.

5. Transfers outside the European Union

Cloudflare, Mailchimp, Automattic (Gravatar) and, in some cases, Google process data in the United States. These companies participate in the EU-U.S. Data Privacy Framework, covered by the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR).

6. Your rights

You can ask the Foundation at any time for access to your data, their rectification or erasure, the restriction of processing, data portability, and you can object to processing based on legitimate interest (Articles 15-22 GDPR). Where processing is based on consent, you can withdraw it at any time, without affecting the lawfulness of the processing carried out before.

To exercise your rights, write to [email protected]. We will answer within one month.

You also have the right to lodge a complaint with the Maltese supervisory authority, the Information and Data Protection Commissioner, or with the authority of the EU country where you live or work.

7. Minors

The site is not aimed at children under 13 and the Foundation does not knowingly collect their data through the forms. If you believe a child has sent us personal data, please write to us and we will delete them.

8. Changes to this notice

This notice may be updated when the site or the services it uses change. The date of the last update is shown below.

Last updated: 16 October 2026.