Privacy Policy

Malta Public Transport Services (Operations) Limited (“Malta Public Transport”, “us”, “we”) strongly values the privacy of its clients and is committed to protect your personal data, the information that identifies you, as though it were our own. 

If you have any questions about how we protect your privacy, get in touch here: [email protected]. 

One of your rights under EU law, the GDPR, is that you must be informed when your personal data, also known as personal information, is processed (collected, used, stored) by any organisation. 

You also have the right to know the details and purpose of that processing. This privacy policy describes our practices related to the processing of your personal data when you use our services, purchase our products, get in touch or engage with us in any way. 

For all data related to the usage of our services, the Data Controller, being the company that’s responsible for your privacy, is Malta Public Transport Services (Operations) Limited (C-48875). 

We assure you that we will only use and disclose any personal data collected from you in accordance with the manner set out in this policy. 

We may process your personal data whenever you use our services, whenever you pay for services that accept the tallinja card as a form of payment and when you get in touch or engage with us in any way. 

Most of the personal data which we hold specifically about you is collected directly from you when you register for our personalised tallinja card, or any other card that we might issue from time to time. 

We also offer you the option to allow us to verify your personal information via the National Identity Card Database or the Driving License Database. Note that these databases are governed by their own Privacy Policies. 

We might collect other information in the process of handling a legal claim filed against us, or that we file against a third party.

We use your information in a number of different ways. What we do with it then depends on the information and the purpose for which we collected it. 

Detailed description of the personal data we process and why: 

The personal information we process shall always be used in accordance with this Policy and we will only process such information when we have a lawful basis as per with the GDPR. In order to process your personal data, we will normally rely on the following grounds: 

• To comply with our legal and contractual obligations. 
• Legitimate interests – both ours and those of third parties. A legitimate interest is when we have a business or commercial reason to use your personal data, so long as this is not overridden by your own rights and interests. 
• Where you have given consent – Where we apply your consent as a basis to process personal data, we acknowledge that you may withdraw such consent at any time. In such case and unless there is another lawful ground which permits us to continue to process your personal data, we shall cease to process that personal data. 

We also anonymise and aggregate personal information (so that it does not identify you) and use it for purposes including testing our IT systems, research, data analysis, improving our site, and developing new products and services. We may also share this anonymised information with third parties – but don’t worry, they cannot identify you. 

We only store users’ personal data to use it for the purpose it was originally collected and in accordance with the legal basis for processing it. We may also keep hold of some of your information if it becomes necessary or required to meet legal or regulatory requirements, resolve disputes, prevent fraud and abuse, or enforce our terms and conditions. 

As a guide: 

• We will hold on to your information for no longer than is necessary keeping in mind the purpose/s (or compatible purposes) for which we first collected the data; 
• We will keep personal data while your tallinja card is active with us or until such time as you ask us to stop communications with you, unless we need to keep the data for longer; 
• We may keep certain categories of personal data for longer in order to meet any legal or regulatory requirements, or to resolve a legal dispute; 
• And, we may keep different types of personal data for different lengths of time if required by law, for instance, to comply with tax/VAT reporting requirements. 

You may obtain more information as to the retention periods or the criteria used by us to determine the retention periods by contacting us on [email protected]. When it is no longer necessary to hold the data, the information in question shall be erased by secure methods. 

We recognise the need to provide further privacy protections with respect to personal information we may collect from children. If you are under the age of sixteen, please get your parent/guardian’s permission before you provide any personal information to us. 

In such instances, we will need to process personal data relating to parents or guardians, and we may also need to request documentation to verify that consent is being given by the holder of parental responsibility. 

We do not, and will not, sell any of your personal data to any third party, it is not our business to do so, and we don’t want to lose your trust and confidence. However, we share your data with the following categories of companies. This is done as an essential part of being able to provide our services to you, to improve our service levels, and enhance our safety. This is done in the manner as set out in this statement:

1. Companies in the group to which Malta Public Transport belongs. Such related entities and subsidiaries use the information collected to help us improve the content and functionality of our websites, to better understand our customers and markets, and improve our products and services. Members of the group may vary from time to time. 

2. The Authority for Transport in Malta (“Transport Malta”) as the regulator for transport in Malta. Transport Malta requires specific sets of data to control schemes which are in effect, such as, the scheme of granting free travel to personalised tallinja card holders. 

3. Other companies that are involved in the process of getting your purchases from us to you, such as payment service providers, data warehouses, order packers, card printing services and delivery companies; 

4. Professional service providers, such as marketing agencies, advertising partners and website hosts who provide such services to us in the operation of our business; 

5. The provider of the Safety Device Camera software used onboard some of our buses, Nauto Global Limited, whose Privacy Notice may be accessed here, and this for the improvement of the Safety Device software.

6. Other third-party transport service providers with whom we partner up to provide you with a more comprehensive transport service in Malta and Gozo and where the tallinja card can be used to pay for their services and/or to obtain discounts; 

7. Credit reference agencies, law enforcement and fraud prevention agencies, so we can help tackle fraud; 

8. Other companies that you may approve of, such as social media sites and applications (if you choose to link your accounts to us) or payment service providers; 

There may be occasions where we might have to disclose personal information, such as with a court order, to comply with legal requirements and satisfy a legal request, for the proper administration of justice, to protect your vital interests, to fulfil your requests, to safeguard the integrity of the relevant websites operated by us or by such related entities or subsidiaries, or in the event of a corporate sale, merger, reorganisation, dissolution or similar event involving us and/or our subsidiaries and related entities. 

When we do share data, we do so on an understanding with the other entities that the data is to be used only for the purposes for which we originally intended. We may also provide third parties with aggregated but anonymised information and analytics about our customers and, before we do so, we will make sure that it does not identify you. Anonymous information means it is anonymous. If we ever have to share data with entities that are outside of the EEA, we will be sure to do so in a manner that complies with the requirements established by the GDPR and this Policy. 

In fact, whenever we transfer personal data internationally, we have established safeguards to: 

• Ensure that the data transfer complies with applicable law; 
• Help to give your data the same level of protection it has within the EU. 

We would normally communicate to you about products or services in which you have shown interest or which you are already buying from us and which we understand you would be interested in receiving as it is of use in relation to the product or service 

you purchase or purchased from us. However, rest assured, you can ask us to stop whenever you want by hitting the “unsubscribe” button. 

How to stop marketing messages from us 

You can stop receiving marketing messages from us at any time through any of the following methods: 

• By clicking on the ‘unsubscribe’ link in any email we send you 
• By contacting our Customer Care team 

Once you do this, we will update your profile to ensure that you don’t receive further marketing messages. Please note that, it might take a few days for all our systems to be updated, so you might get messages from us while we process your request. 

If you ask us to stop marketing messages this will not stop service communications, such as order updates as this may be necessary for us to communicate to you in performance of our contract with you. 

We engage in online advertising, also to keep you aware of what we’re up to and to help you see and find our products using targeted adverts which may appear when you are on other websites and apps that offer such digital marketing services. 

We use a range of advertising technologies like ad tags, cookies, and mobile identifiers, as well as specific services offered by some sites and social networks, such as Facebook’s Custom Audience service. 

The banners and ads you see will be based on information we hold about you, or your previous use of our website (for example, your search history, and the content you read) or on banners or ads you have previously clicked on. 

Malta Public Transport uses cookies and other identification technologies on our apps, websites, emails, and online ads for purposes described in this Policy. Cookies are small text files that are stored on browsers or devices by websites, apps, online media, and advertisements. Malta Public Transport uses cookies and similar technologies for purposes such as: 

• Authenticating users 
• Remembering user preferences and settings 
• Delivering and measuring the effectiveness of advertising campaigns 
• Analysing site traffic and trends, and generally understanding the online behaviours and interests of people who interact with our services. 

This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience. 

Other Passive Information which we collect 

Apart from the information you provide us with when using our Website, other information is passively collected from you (without you actively furnishing such information) when you navigate through the website. We use various technologies and navigational data collection methods to gather such passive information for various reasons, for example to track how many visitors access our website, the date and time of their visit, the length of their stay and which pages they view. The passive information also aids us to determine which web browsers our visitors use and the address from which they accessed our website – for instance if they connect to our Website through clicking on one of our banner ads. This technology does not identify you personally. 

Such passively collected information may be used and combined to improve our services to website visitors, customise the website based on your preferences, compile and analyse statistics and trends of our visitors and their use of the sites operated by us and our related entities or subsidiaries. Together with our related entities and subsidiaries we will use this information and share it with third parties to improve the content, functionality and administration of our websites, to better understand our customers and markets, and to improve our products and services. 

We assure you that, unless you have consented, such passive information shall not be combined with personally identifiable information collected elsewhere by our website or respective sites operated by our related entities or subsidiaries. 

You enjoy several rights relating to your personal information, including: 

1. The right to be informed about how your personal information is being used; 
   
   We need to be clear with you about how we process your personal data. We do this through this Privacy Policy, which we will keep as up to date as possible. 
2. The right to access the personal information we hold about you; 
   
   You can access the personal data we hold on you by contacting us on [email protected]. To process your request, we will ask you to send us proof of identity so that we can be sure we are releasing the personal data to the right person. 
3. The right to request the rectification and/ or erasure of your personal data; 
   
   If you think that the information we hold about you is inaccurate or incomplete please ask us to correct it. We appreciate feedback to ensure that our records are accurate and up-to-date. 
   
   You can ask us to delete your personal data however, this is not an absolute right. Despite a request for erasure, we may be justified to keep personal data either because we need it to comply with a legal obligation (for instance, for tax purposes) or in relation to the exercise or defence of any legal claims. 
4. The right to restrict the use of your personal data; 
5. The right to stop direct marketing messages; 
6. The right to object to certain processing of your personal information based on legitimate interest; 
   
   You have a right to object to our use of your personal information including where we use it for our legitimate interests or where we use your personal information to carry out profiling using automated means. 
7. The right to receive your personal data, which you provided to us, in a structured, commonly used and machine-readable format or to require us to transmit that data to another controller; 
8. The right to request human intervention if automated processing without human intervention is used to make decisions having legal or similar effects on you; 
9. The right to withdraw consent for consent-based processing at any time; and 
10. The right to complain to your data protection regulator who in Malta is the Information and Data Protection Commissioner (IDPC). 

If you want to exercise any of the rights set out above, please contact us at [email protected]. When we receive requests, we may also require that you identify yourself and provide documentation or information for verification, as we would not want to disclose information to the wrong person. Please appreciate that the rights above mentioned are not absolute and must be exercised within some limitation, for example, if you ask us for information we can only give you what relates to you and not what relates to other persons. 

Unreasonable requests may be subjected to a reasonable fee or refusal to respond. 

Security of your personal data is very important to us. 

Where it’s appropriate, our website uses HTTPS to help keep information about you secure. However, no data transmission over the internet can be guaranteed to be totally secure. 

You may complete a registration process when you sign up to use our services. This may include the creation of a username, password and/or other identification information. Any such details should be kept confidential by you and should not be disclosed to or shared with anyone. 

Where you do disclose any of these details, you are solely responsible for all activities undertaken where they are used. 

Whenever you create a password, you should choose a strong password, meaning it should be lengthy and include a mixture of letters and numbers with mix of CAPS, so as to protect your account. 

We do our best to keep the information you disclose to us secure. However, we can’t guarantee or warrant the security of any information which you send to us. 

Security measures which we have implemented to secure information transmitted over our website or stored on our systems include the following: 

1. Use of secure servers; 
2. Use of firewalls; 
3. Use of encryption; 
4. Physical access controls at data centres; 
5. Information access controls; 
6. Use of back-up systems; 

Please understand, however, that no system is perfect or can guarantee that unauthorised access or theft will not occur. 

Our website is continually under review, new functions and features are periodically added, thus changes to our privacy policy may be required from time to time. If there are any changes to this Privacy Policy, we will replace this page with an updated version. It is therefore in your own interest to periodically review this page. 

This privacy policy is not applicable to links within this site which direct you to external websites which are not controlled by us. We are not responsible for how third-party websites collect and/or use your personal information. 

Therefore, we encourage you to read the privacy policies of any external websites you visit. 

We are always happy to hear from you, whether to make a suggestion but especially if you feel we can do better. 

If you have any questions about this Privacy Policy, or if you wish to make a complaint about how we have handled your personal information, please contact us at: 

Malta Public Transport Services (Operations) Limited Valletta Road Luqa, LQA 1780 

We have an appointed Data Protection Officer who can be reached through the following email address: [email protected].