1. Who is responsible
Data controller
Charlie Autodealer is the controller for personal data processed through this website. The showroom address is Triq Dun Karm Psaila Birkirkara Bypass, Birkirkara BKR 01.
You can currently reach the business through the contact page or by telephone at 9949 4553.
2. Data we process
Information shared through direct contact
Depending on how you contact us, the information may include:
- Your name, phone number and email address.
- Your preferred contact method and the content of your message.
- The vehicle or part-exchange question connected with your message.
- Any vehicle details or photographs you choose to provide for a part-exchange discussion.
- Basic technical and security information, such as IP address, browser details, timestamps and request logs, where produced by hosting or security services.
- Page views, counted by Cloudflare Web Analytics without cookies or identifiers; and, if you accept usage data, public page paths, event times and privacy-reduced interaction, performance, referrer-domain and campaign data.
This website does not provide an on-site message form. We do not ask you to send payment-card details, identity documents or sensitive personal data through a general message. Names, email addresses, phone numbers and WhatsApp message contents are never sent to any analytics.
3. How and why
Purposes and lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Answering questions or taking steps you request before a possible purchase. | Steps at your request before a contract, and legitimate interests in responding to customers. |
| Following up a part-exchange or vehicle-specific conversation. | Steps at your request and legitimate interests in managing the conversation. |
| Protecting the website, preventing abuse and diagnosing errors. | Legitimate interests in maintaining a secure and reliable service, and legal obligations where applicable. |
| Keeping records needed for disputes, accounting or legal compliance. | Legal obligation and legitimate interests in establishing or defending legal claims. |
| Counting public page views without cookies or identifiers and, if you accept, recording engagement, selected interactions, performance and errors. | Legitimate interests in counting page views; your consent for usage data. |
We do not sell personal data. We do not currently use direct-contact data for advertising profiles or unrelated marketing.
4. Sharing and transfers
Service providers and external destinations
Personal data is shared only where needed for the purposes above, with appropriate providers or where the law requires it. These providers may include:
- Neon for the database and sign-in records; Cloudflare for vehicle media.
- The website hosting provider for delivery, logs, backups and service security.
- Cloudflare Web Analytics and Workers Analytics Engine for page counts and, if you accept, usage data.
- Professional advisers, insurers, public authorities or law enforcement where reasonably necessary or legally required.
WhatsApp and Google Maps
Google Maps is embedded on the contact page and may receive technical data, including your IP address, when the map loads. WhatsApp is only contacted when you choose its link. Those providers' own privacy terms and international-transfer safeguards apply. You can call us instead if you prefer not to use either service.
Where a provider processes data outside Malta or the European Economic Area, the transfer is handled under the provider's applicable GDPR transfer mechanism and safeguards.
5. Retention
How long information is kept
This website does not collect or retain messages through an on-site contact form. Messages you send through WhatsApp, telephone or email are retained under the business's communication practices and the relevant provider's terms, only as long as needed for the conversation, an active transaction, legal obligations or legal claims. Hosting and security logs may follow shorter provider-controlled schedules.
Your usage-data choice is kept in this browser's site storage until you clear it; we hold no copy of it. Page counts and usage data set no cookie and create no identifier, so there is nothing about you in this browser to remove and nothing in the records that could be traced back to you. Cloudflare holds usage data for three months. Rejecting later immediately stops new usage data being recorded; it does not remove events already delivered.
6. Security
Protecting information
Reasonable technical and organisational measures are used, including access controls, encrypted connections, restricted administration access and service monitoring. No internet service can promise absolute security.
7. Your rights
Your GDPR choices
Subject to the GDPR's conditions and exceptions, you may ask to:
- Access a copy of your personal data.
- Correct inaccurate or incomplete information.
- Erase information or restrict how it is used.
- Object to processing based on legitimate interests.
- Receive eligible information in a portable format.
- Withdraw consent where consent is the lawful basis, without affecting earlier lawful processing.
We may need to verify your identity before completing a request. You may also read about your rights on the Malta Information and Data Protection Commissioner website or file a complaint with the IDPC .
8. Children
Age considerations
This website is intended for people considering vehicle purchases and is not directed at children. Please do not send a child's personal data through a contact channel.
9. Changes
Updates to this notice
We may update this notice when the website, providers or legal requirements change. The version date at the top will be revised when material changes are published.
10. Contact
Questions or rights requests
Use the contact page or call 9949 4553. Please state that your message concerns privacy or a data-protection right.