Privacy Policy

Last updated: [30/08/2026]
Version: 1.0

Żgħażagħ Azzjoni Kattolika (“ŻAK”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store and protect personal data when you:

  • visit zakmalta.org;

  • create or use a website account;

  • register or renew membership with ŻAK;

  • participate in ŻAK groups, activities or events;

  • make payments through the website;

  • contact us;

  • provide information as a parent, guardian or next of kin; or

  • otherwise interact with ŻAK where this Privacy Policy applies.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Data Protection Act (Chapter 586 of the Laws of Malta) and other applicable data-protection legislation.

1. Who is responsible for your personal data?

The data controller responsible for personal data covered by this Privacy Policy is:

Żgħażagħ Azzjoni Kattolika
213, Brared Street
Birkirkara, BKR 1256
Malta

Data protection enquiries: info@zakmalta.org

If you have questions about this Privacy Policy, how we process your personal information or wish to exercise your data-protection rights, you may contact us using the details above.

2. What personal data do we collect?

The personal data we collect depends on your relationship with ŻAK and the services you use.

Membership information

When a person registers or renews membership, we may collect information including:

  • full name;

  • identity card or other identification number;

  • date of birth;

  • sex;

  • nationality;

  • residential address;

  • postcode;

  • telephone and mobile numbers;

  • email address;

  • passport-style photograph;

  • signature;

  • ŻAK centre and group;

  • leadership status;

  • skills and interests;

  • membership status; and

  • related administrative information.

We use this information to register and administer membership, identify members, communicate with members, organise ŻAK groups and activities and maintain appropriate organisational records.

3. Information about children and young people

ŻAK works with children and young people and therefore processes personal data concerning minors.

We may process information relating to minors where necessary for:

  • membership administration;

  • participation in ŻAK activities;

  • safeguarding;

  • communication;

  • emergency management; and

  • the safe and effective operation of ŻAK groups.

Depending on the member’s age and circumstances, we may also collect information concerning their parent or legal guardian, including:

  • full name;

  • identification number;

  • nationality;

  • sex;

  • mobile number;

  • signature;

  • relationship to the child; and

  • information necessary to establish parental or custodial authority.

Where consent is legally required for a particular processing activity involving a child, ŻAK will obtain the appropriate consent in accordance with applicable law.

4. Parents, guardians and next of kin

For membership administration, safeguarding, emergency contact and appropriate communication, ŻAK may collect personal information relating to parents, guardians and next of kin.

This may include:

  • full name;

  • identification number;

  • nationality;

  • sex;

  • mobile number;

  • signature; and

  • relationship to the member.

We use this information where reasonably necessary for membership administration, safeguarding, emergency communication or another legitimate organisational purpose.

5. Health, allergy and medical information

Members, parents or guardians may provide information concerning allergies, medical conditions or other health matters that ŻAK needs to know in order to protect the health and safety of members.

Health information constitutes special-category personal data under the GDPR and receives additional protection.

Access to health information is restricted. Depending on the member concerned, such information may be accessed only by:

  • the Leader responsible for that member’s group;

  • the Coordinator responsible for that member’s centre;

  • authorised ŻAK Administrators; and

  • authorised technical Developers where access is necessary for the maintenance or operation of the system.

Leaders may only access information concerning members of their own group. Coordinators may only access information concerning members belonging to their centre.

Health information may also be disclosed where necessary to medical professionals, emergency services or other persons who reasonably require the information to protect the health or vital interests of a member.

ŻAK seeks to collect only health information that is relevant and necessary.

Health information may be retained for the duration of membership and, where reasonably necessary for safeguarding, incident management, legal claims, insurance or related organisational purposes, for a limited period afterwards. In all cases, personal information associated with a former member will be removed from the membership system no later than five years after their membership ends, unless ŻAK is legally required to retain specific information for longer.

6. Skills and interests

Members may provide information about their skills and interests.

ŻAK may use this information to:

  • understand the abilities and interests of its membership;

  • plan activities;

  • identify members who may wish to assist with ŻAK projects or organisational needs; and

  • contact members regarding appropriate voluntary opportunities.

Providing a skill or interest does not create an obligation for a member to provide that service to ŻAK.

7. Photographs, video and organisational archives

ŻAK may take photographs, video recordings or other media during its activities and events.

Depending on the permissions provided and the circumstances, such material may be used for:

  • documenting ŻAK activities;

  • ŻAK’s website;

  • ŻAK social-media channels;

  • publications;

  • promotional material;

  • presentations;

  • reports; and

  • ŻAK’s historical archive.

ŻAK may retain photographs, videos and other material of legitimate historical value as part of its organisational archive.

Where processing relies on consent, consent may be withdrawn in relation to future processing.

Withdrawal does not affect processing that took place lawfully before consent was withdrawn and may not always enable ŻAK to recall material that has already been lawfully printed, distributed or otherwise placed outside ŻAK’s reasonable control.

Media permissions are separate from acknowledgement of this Privacy Policy.

8. Custody information

Where relevant to the registration of a minor, ŻAK may process information concerning legal custody or guardianship.

This may include documents supporting a declaration of sole legal custody.

Such documentation may be retained because ŻAK may need to refer to it during subsequent membership renewals or where questions concerning legal responsibility for the child arise.

Custody documentation may contain sensitive information concerning several individuals and will therefore be treated as confidential.

Access will be restricted to authorised persons who require the information for legitimate membership, safeguarding or administrative purposes.

Custody-related information is subject to ŻAK’s general retention policy and will normally be removed no later than five years after the relevant membership ends, unless there is a legal or safeguarding reason requiring longer retention.

9. Website accounts

ŻAK provides registered users with website accounts.

We may process information including:

  • username or account identifier;

  • name and contact information;

  • membership information;

  • account permissions;

  • login information;

  • password-reset requests;

  • account activity; and

  • technical and security information.

ŻAK operates a role-based access model.

Member

A member may access the information and website functionality made available to their account.

Leader

A Leader may access information concerning members of the group for which the Leader is responsible.

Coordinator

A Coordinator may access information concerning members belonging to their ŻAK centre.

Administrator

An authorised Administrator may have organisation-wide access where necessary for membership or website administration.

Developer

An authorised Developer may have organisation-wide technical access where required for website development, maintenance, security or troubleshooting.

Access must only be exercised where necessary for the person’s authorised ŻAK role.

10. Contacting ŻAK

When you contact ŻAK through our website, email or another communication channel, we may process:

  • your name;

  • email address;

  • telephone number, where provided;

  • the subject of your enquiry;

  • contents of your message;

  • our response; and

  • subsequent correspondence.

We use this information to receive, manage and respond to enquiries.

Organisational email is provided using Google Workspace.

11. Events and activities

When you register for or participate in a ŻAK event, meeting, trip, camp or other activity, we may collect additional information necessary to organise and safely administer that activity.

Depending on the activity, this may include:

  • participant details;

  • contact information;

  • emergency contacts;

  • age or date of birth;

  • dietary requirements;

  • allergy or health information;

  • attendance information;

  • transport information;

  • payment information;

  • consent or authorisation information; and

  • other information relevant to the activity.

We seek to limit information collected to what is reasonably necessary for the relevant activity.

12. Membership fees, event payments and financial information

ŻAK accepts online payments for membership fees, events and other applicable services.

The website uses WooCommerce to manage relevant orders and payment records and Stripe to process electronic payments.

When a payment is made, we may process information including:

  • name of the payer;

  • member or participant concerned;

  • amount;

  • payment date;

  • payment status;

  • transaction reference;

  • order information; and

  • accounting information connected with the transaction.

Payment-card information is processed through Stripe. ŻAK does not intend to store full payment-card details directly within its membership database.

Stripe may process personal information in accordance with its own applicable privacy terms where it acts as an independent controller or service provider.

ŻAK may retain transaction and financial records for longer than the normal membership-retention period where required by accounting, tax, audit or other applicable legal obligations.

13. Website hosting and infrastructure

The ŻAK website is hosted by Hostinger.

Hostinger may process technical information necessary to provide hosting, database, backup and infrastructure services.

Such information may include:

  • IP addresses;

  • server logs;

  • website files;

  • databases;

  • backups; and

  • other technical information necessary to operate and secure the website.

ŻAK also uses Google Workspace for email and related organisational communications.

14. Website analytics

ŻAK uses Google Analytics to understand how visitors use its website.

Depending on the visitor’s consent choices, Google Analytics may process information including:

  • pages visited;

  • approximate location;

  • device type;

  • browser information;

  • referral information;

  • website interactions; and

  • technical identifiers.

Google Analytics is treated as a non-essential service and is configured not to operate until the appropriate consent has been provided through ŻAK’s cookie-consent system where consent is required.

15. Google Maps

Certain pages may use Google Maps or related Google mapping services.

When Google Maps functionality is loaded, Google may receive information including the user’s IP address, device information and information concerning interactions with the map.

Where consent is required, Google Maps will be subject to ŻAK’s cookie-consent controls before the relevant non-essential processing takes place.

Google may process information under its own privacy terms where it acts as an independent controller.

16. Cookies and similar technologies

ŻAK’s website uses cookies and similar technologies.

Certain cookies are necessary for:

  • website operation;

  • member login;

  • security;

  • session management; and

  • user preferences.

Other cookies may relate to services including:

  • Google Analytics; and

  • Google Maps.

ŻAK uses Cookie Compliance for WordPress to provide cookie information and manage consent preferences.

Non-essential cookies and tracking technologies are configured to remain blocked until the appropriate consent has been obtained where required by law.

Users may change their applicable cookie preferences through the cookie-consent interface.

17. Why we process personal information

ŻAK processes personal information only where an appropriate lawful basis applies.

Depending on the circumstances, this may include:

Performance of a contract

Where processing is necessary to establish or administer membership or provide a service requested by the individual.

Legal obligation

Where processing is required to comply with Maltese or European Union law.

Legitimate interests

Where processing is reasonably necessary for ŻAK’s legitimate organisational interests and those interests are not overridden by the rights and freedoms of the individual.

These interests may include:

  • membership administration;

  • communication with members;

  • operating ŻAK centres and groups;

  • organising events and activities;

  • safeguarding members;

  • maintaining appropriate organisational records;

  • website and account security;

  • preventing abuse or fraud; and

  • responding to enquiries.

Consent

Where an individual has freely provided consent for a specific processing activity.

Consent may be withdrawn at any time where it is the applicable legal basis.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Vital interests

In limited circumstances, information may be processed where necessary to protect someone’s life or physical safety.

Special-category information

Where ŻAK processes special-category information, including health information, an additional applicable condition under Article 9 GDPR will also be relied upon.

18. Access to membership information

ŻAK applies role-based access controls intended to ensure that information is available only to persons who need it for an authorised purpose.

RoleGeneral access
MemberOwn permitted account/profile information
LeaderMembers belonging to their group
CoordinatorMembers belonging to their centre
AdministratorOrganisation-wide administrative access
DeveloperOrganisation-wide technical access where necessary

Access to health information is further restricted as described in this Privacy Policy.

All persons with access to personal information must use that access only for legitimate purposes connected with their ŻAK role.

19. Who we share personal information with

ŻAK does not sell personal information.

Personal information may be processed by third parties that provide services necessary for the operation of the organisation or website.

These currently include:

  • Hostinger — website hosting and infrastructure;

  • Google Workspace — email and organisational communications;

  • Google Analytics — website analytics, subject to consent where required;

  • Google Maps — mapping functionality, subject to consent where required;

  • Stripe — online payment processing;

  • WooCommerce — management of online orders and payment-related website functionality; and

  • other website, security or technical providers necessary to maintain the platform.

Where a provider processes personal information on ŻAK’s behalf, appropriate data-protection arrangements will be used where required.

Personal information may also be disclosed where:

  • required by law;

  • required by a competent authority or court;

  • necessary for the establishment, exercise or defence of legal claims;

  • necessary to protect someone’s vital interests; or

  • otherwise permitted by applicable law.

20. International transfers

Some providers used by ŻAK operate internationally.

This means that personal information may in certain circumstances be processed outside Malta or outside the European Economic Area (“EEA”).

Where a transfer outside the EEA requires additional safeguards under GDPR, ŻAK will rely on an appropriate lawful transfer mechanism, such as:

  • an adequacy decision issued by the European Commission;

  • approved Standard Contractual Clauses; or

  • another mechanism permitted under applicable data-protection law.

Further information regarding applicable safeguards may be requested through info@zakmalta.org.

21. How long we retain personal information

ŻAK applies the principle that identifiable personal information should not be kept for longer than necessary.

Active members

Membership information may be retained throughout the period during which a person remains a member of ŻAK.

This includes information reasonably necessary to administer membership, safeguarding, communications and participation in ŻAK activities.

Former members

When membership ends or becomes inactive, ŻAK may retain the former member’s record for a limited period where this is reasonably necessary for:

  • possible membership renewal;

  • administrative continuity;

  • safeguarding;

  • handling complaints or incidents;

  • insurance matters;

  • legal claims; or

  • other legitimate organisational purposes.

Unless a longer period is required by law or is justified by a separate legitimate purpose, the former member and their associated personal information will be purged from ŻAK’s membership system no later than five years after membership ends.

This includes, where applicable:

  • personal and contact information;

  • health and allergy information;

  • parent or guardian information;

  • next-of-kin information;

  • identification information;

  • signatures;

  • skills and interests; and

  • custody documentation.

Financial records

Payment, accounting and transaction records may need to be retained independently of the membership record for periods required by applicable accounting, tax, audit or other legal obligations.

Historical media

Photographs, videos, publications and similar material of legitimate historical or archival value may be retained beyond the normal five-year membership period.

Such material is retained as part of ŻAK’s organisational history rather than as part of the active membership database and will be subject to appropriate safeguards.

Backups

Deleted information may remain temporarily within secure system backups until those backups are overwritten or expire in accordance with ŻAK’s technical backup schedule.

Backup copies are not intended to be used as active membership records.

22. How we protect personal information

ŻAK uses technical and organisational measures intended to protect personal information against unauthorised access, disclosure, alteration, loss or destruction.

Measures may include:

  • role-based access controls;

  • individual website accounts;

  • restricted administrative access;

  • password protection;

  • security updates;

  • secure website hosting;

  • backups;

  • logging and monitoring;

  • restrictions on access to sensitive member information; and

  • organisational procedures governing access to records.

Access is determined according to organisational role and legitimate need.

No internet-based system can be guaranteed to be completely secure. ŻAK nevertheless aims to apply security measures appropriate to the sensitivity and nature of the information being processed.

23. Your data-protection rights

Subject to applicable conditions under GDPR, you may have the right to:

  • request access to your personal information;

  • request correction of inaccurate information;

  • request completion of incomplete information;

  • request erasure;

  • request restriction of processing;

  • object to certain processing;

  • request data portability where applicable;

  • withdraw consent where processing relies on consent; and

  • exercise applicable rights concerning automated decision-making.

These rights are not absolute and may be subject to limitations established by law.

24. Exercising your rights

Requests concerning personal information may be submitted to:

Żgħażagħ Azzjoni Kattolika
213, Brared Street
Birkirkara, BKR 1256
Malta

Email: info@zakmalta.org

Please provide enough information for us to understand the request and identify the relevant personal information.

We may request additional information where reasonably necessary to verify identity.

Valid data-protection requests will normally be handled within one month, subject to any extension permitted under GDPR.

25. Complaints

If you have concerns regarding the way ŻAK processes your personal information, you may first contact us at:

info@zakmalta.org

You also have the right to lodge a complaint with Malta’s supervisory authority:

Office of the Information and Data Protection Commissioner (IDPC)
Floor 2, Airways House
High Street
Sliema SLM 1549
Malta

Telephone: +356 2328 7100
Website: https://idpc.org.mt/

26. Information concerning another person

Where you provide ŻAK with personal information concerning another person, such as a parent, guardian, child or next of kin, you should ensure that you are entitled to provide that information.

Where appropriate, that person should also be made aware that their information has been provided to ŻAK and directed to this Privacy Policy.

27. Changes to this Privacy Policy

ŻAK may update this Privacy Policy when:

  • our processing activities change;

  • website or membership functionality changes;

  • new services are introduced;

  • technology providers change;

  • organisational procedures change; or

  • applicable legal or regulatory requirements change.

The current version will always be made available on zakmalta.org.

Where a change materially affects how personal information is processed, ŻAK will take reasonable steps to inform affected persons where appropriate.

28. Contact

For privacy and data-protection enquiries:

Żgħażagħ Azzjoni Kattolika
213, Brared Street
Birkirkara, BKR 1256
Malta

Email: info@zakmalta.org