Consent

This site uses third party services that need your consent. Learn more

Skip to content

Privacy Policy

Last updated: 1 October 2026

This Privacy Policy explains how City Walking Tours Malta collects, uses and protects your personal data when you visit citywalkingtoursmalta.com, send us an enquiry or book a tour with us. We process personal data in line with the EU General Data Protection Regulation (GDPR) and the Maltese Data Protection Act (Cap. 586).

Who we are

City Walking Tours Malta is the data controller responsible for your personal data.

  • Address: 1, Cambridge Court, Achille Ferris Street, Msida MSD 1753, Malta

  • VAT number: MT24776024

  • Malta Tourism Authority licence: TRA/C/35

  • Email: [email protected]

  • Phone: +356 9931 8808

What data we collect

Information you give us

  • Contact form: your name, email address and message.

  • Booking request form: your first and last name, email address, phone number, the tour you are interested in, your preferred date, the number of adults, youths and children in your group, and any message you add.

  • Emails, calls and messages: any information you share when you contact us directly.

  • Online bookings: when you book and pay for a tour through the booking widget on our tour pages, your booking and payment details are handled by our booking partner Bókun (see "Who we share your data with" below).

Information collected automatically

  • Technical data: your IP address, browser type, device and the pages you request, which our hosting and security providers process to deliver the website and protect it from abuse.

  • Usage data: if you accept analytics cookies, Google Analytics collects information about how you use our website, such as the pages you visit, how long you stay and how you arrived at our site. See our Cookie Policy for details.

How and why we use your data

  • To answer your enquiries and booking requests, and to arrange and deliver your tour. Our legal basis is taking steps at your request before entering into a contract, and performing that contract.

  • To keep a record of our correspondence and bookings, as required for accounting and tax purposes. Our legal basis is compliance with our legal obligations.

  • To keep the website secure and working properly. Our legal basis is our legitimate interest in running a safe and reliable website.

  • To understand how visitors use our website so we can improve it. Our legal basis is your consent, which you can withdraw at any time through "Manage consent" at the bottom of every page.

We do not sell your personal data, and we do not use it for automated decision-making or profiling.

Who we share your data with

We only share your data with service providers who help us run our business, and only as far as needed:

  • Bókun – online booking and payment processing for tours booked through our website.

  • Google – website analytics (Google Analytics), only with your consent.

  • Twilio SendGrid – delivery of the emails sent by our website forms.

  • Cloudflare – website security and content delivery.

  • Our hosting provider – the servers that run our website.

  • Facebook (Meta) – some tour pages show embedded Facebook posts, which are loaded from Facebook's servers.

We may also disclose data where the law requires it, for example to public authorities.

International transfers

Some of these providers may process data outside the European Economic Area, for example in the United States. Where this happens, the transfer is protected by appropriate safeguards, such as the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

How long we keep your data

We keep enquiries and booking requests for as long as needed to handle them and follow up, and for no longer than 24 months after our last contact with you. Booking and invoicing records are kept for as long as Maltese accounting and tax law requires. Analytics data is kept for 14 months.

Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you;

  • have inaccurate data corrected;

  • have your data erased;

  • restrict or object to how we process your data;

  • receive your data in a portable format;

  • withdraw your consent at any time, without affecting processing that took place before you withdrew it.

To exercise any of these rights, email us at [email protected]. We will reply within one month.

If you are unhappy with how we handle your data, you have the right to complain to the Information and Data Protection Commissioner (IDPC) in Malta: idpc.org.mt.

Security

We take appropriate technical and organisational measures to protect your personal data, including encrypted (HTTPS) connections to our website.

Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be published on this page, with the date it was last updated.