1. Who we are and what this policy covers
This policy explains how Crestrado (“Crestrado”, “we”, “us”, “our”) handles personal data when you visit www.crestrado.com (the “Site”) or contact us through it.
Crestrado is established in Malta and acts as the controller of the personal data described here. Our identity and registered address are set out on the Legal information page. You can reach us about anything in this policy at [email protected].
Because we are established in Malta, this policy is written around Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), as supplemented by the Data Protection Act (Cap. 586 of the Laws of Malta) and its subsidiary legislation. Where you live outside the EU, you may have further rights under your own law; those are in addition to, not instead of, what is set out below.
We have not appointed a Data Protection Officer, as we are not required to under article 37 GDPR. Privacy questions go to the address above.
2. The personal data we handle
Data you give us. When you use the contact form or email us, we receive your name, email address, country of residence, the capacity in which you are contacting us, your message, your phone number if you choose to give it, and the fact that you ticked the consent box. If you apply for a role, we receive your CV and covering note.
Data created by your visit. Our website host records technical information needed to serve and protect the Site: your IP address, the request made, the time, the response, your browser’s user-agent string and the referring page. These logs are used for delivery, security and troubleshooting, not to build a profile of you.
What we do not collect. The Site has no analytics, advertising, remarketing or social media tracking. We do not buy personal data, we do not enrich what you send us from other sources, and we do not ask for financial account details, identity documents or any special category data through this website. Please do not send those by email either; if something we are discussing ever requires them, we will agree a secure route with you first.
3. Why we use it, and our legal basis
| What we do | Why | Legal basis (art. 6 GDPR) |
|---|---|---|
| Read and answer your enquiry — about the research, about data and brokerage, or about working here — and hold the thread of our correspondence | So we can reply to you and follow it up | Art. 6(1)(a) consent, which you give with the form’s tick box; and our legitimate interests in running the desk, art. 6(1)(f) |
| Consider a job application | To fill a role | Art. 6(1)(b) and our legitimate interests in recruiting, art. 6(1)(f) |
| Keep the Site available, diagnose faults and defend against abuse | Security and reliability | Art. 6(1)(f) — our legitimate interest in a working, secure website |
| Keep records of enquiries we did not pursue, and of consents given | To show we acted properly | Art. 6(1)(f) and art. 6(1)(c) |
| Comply with a legal obligation, court order or lawful request | We have to | Art. 6(1)(c) |
Giving us your details is voluntary. If you choose not to, we simply cannot reply — there is no other consequence.
Where we rely on consent, you can withdraw it at any time by emailing us; that does not affect processing already carried out. Where we rely on legitimate interests, you can object (see section 7), and we will stop unless we have compelling grounds to continue.
No automated decision-making. We do not make decisions about you by automated means alone, and we do not profile you, within the meaning of article 22 GDPR. The trading systems described elsewhere on this Site operate on market data, not on personal data.
No marketing without consent. We do not send newsletters or marketing emails from this Site. Replying to your enquiry is correspondence, not marketing.
4. Who else sees it
We disclose personal data only to the following, and only as much as each needs:
- Our website host, which serves the Site and keeps the technical logs described above. The Site is hosted on Cloudflare’s global network.
- Google Ireland Limited / Google LLC, because contact form submissions are delivered into Google Apps Script and stored in a Google Sheet that only we can open.
- Our email provider, which carries and stores our correspondence with you.
- Professional advisers — lawyers, accountants, auditors — where we need advice or must demonstrate compliance.
- Public authorities and courts, where we are legally obliged to disclose or need to establish or defend a legal claim.
Each of these acts as our processor under a written agreement required by article 28 GDPR, except public authorities and advisers, who act in their own right. None of them is permitted to use your data for their own purposes.
If Crestrado’s business or assets were ever transferred, personal data could move with it. We would tell you before that changed how your data is used.
We do not sell personal data, and we do not share it for anyone else’s advertising.
5. Transfers outside the EEA
Some of the providers above process data outside the European Economic Area, mainly in the United States. A transfer like that only happens where Chapter V GDPR allows it — in practice:
- an adequacy decision by the European Commission for the receiving country or framework, such as the EU–US Data Privacy Framework where the recipient is certified under it; or
- the European Commission’s Standard Contractual Clauses, together with an assessment of the transfer and any extra technical and organisational safeguards it calls for.
You can ask us which mechanism applies to a particular provider, and we will give you the relevant information and a copy of the safeguards where we are permitted to.
6. How long we keep it
| Record | Retention |
|---|---|
| Enquiries we do not take further | Up to 24 months from our last exchange, then deleted |
| Correspondence we are required to keep | As long as any legal, tax or accounting rule requires |
| Job applications | Up to 12 months from the decision, unless you ask us to keep them longer |
| Website and security logs | Short operational periods set by our host, normally measured in days |
| Record that a consent was given or withdrawn | As long as needed to evidence it |
Where a limitation period or a statutory record-keeping rule applies, we keep what that rule requires and no more. After the period ends we delete the data or anonymise it irreversibly.
7. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you, and receive a copy (art. 15).
- Rectify data that is inaccurate or incomplete (art. 16).
- Erasure — have data deleted where one of the grounds in article 17 applies.
- Restrict our processing while a dispute about accuracy or lawfulness is resolved (art. 18).
- Portability — receive the data you gave us in a structured, machine-readable form, and have it sent to another controller where this is technically feasible (art. 20).
- Object to processing based on our legitimate interests (art. 21).
- Withdraw consent at any time, where consent is the basis we rely on (art. 7(3)).
To use any of these, email [email protected]. We reply within one month, and tell you if we need up to two further months because the request is complex, as article 12(3) allows. We may ask for enough information to confirm who you are, so we do not disclose your data to someone else. Using these rights is free, unless a request is manifestly unfounded or excessive.
Complaints. If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Maltese supervisory authority:
Information and Data Protection Commissioner (IDPC)
Floor 2, Airways House, Triq il-Kbira, Tas-Sliema SLM 1549, Malta
idpc.org.mt
If you live or work in another EU or EEA country, you may instead complain to your own national supervisory authority, or go to the courts.
8. Cookies and storage on your device
The Site sets no cookies. There are no analytics, advertising or tracking cookies, and nothing on the Site profiles you across websites or sessions.
The Site stores nothing on your device at all — no cookies, no local storage, no session storage. There is therefore nothing to consent to under regulation 4 of the Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01), Malta’s implementation of article 5(3) of the ePrivacy Directive, and no cookie banner, because there would be nothing for it to ask about.
Fonts, stylesheets, scripts and images all come from our own domain. No third-party server is contacted as you read the Site, so no third party can observe your visit.
Because we do not track you, there is nothing for a “Do Not Track” or Global Privacy Control signal to switch off. We honour them by not tracking anyone in the first place.
9. Security
The Site is served only over HTTPS, with HTTP Strict Transport Security, a Content Security Policy and related protections set at the host. Access to enquiry records is limited to the people at Crestrado who need it, over accounts protected by multi-factor authentication.
No system is perfectly secure, and no transmission over the internet can be guaranteed against interception. Please do not send account numbers, identity documents, passwords or other sensitive material through the contact form or by ordinary email.
If a personal data breach ever creates a risk to your rights, we will notify the IDPC within 72 hours as article 33 GDPR requires, and tell you directly where article 34 requires it.
10. Children
The Site is intended for adults. It is not directed at children and we do not knowingly collect their data.
Under Maltese law the age at which a child can consent on their own to an information society service is 13 — Malta exercised the option in article 8(1) GDPR through subsidiary legislation under the Data Protection Act. Separately, the capacity to enter a contract in Malta begins at 18. If you believe a child has sent us personal data, contact us and we will delete it.
11. Changes to this policy
We may update this policy as the Site or the law changes. The effective and last-updated dates appear at the top of this page. Where a change materially affects how we use personal data we already hold, we will take reasonable steps to tell affected individuals directly rather than rely on this page alone.
12. Contact
Crestrado
[email protected]
Registered address: see Legal information