Draft for Curt to review. Check every line, fill in the parts in square brackets, and have it read by someone who knows Maltese data protection law before launch.

Privacy notice

Last updated November 2026

This notice explains what EventPlanly stores, where it is kept, and what you can ask us to do with it. We have tried to write it in plain words.

Who runs EventPlanly

EventPlanly is run by [company name and number to confirm], Malta. We are the data controller for the data described here. Email contact@eventplanly.com or use the contact form.

Your plans and shortlist stay in your browser

Everything you put into the planner stays in the browser you used: the event drafts, budgets, picks, timelines, notes, guest lists and RSVPs, and the businesses you save with the heart. It is kept in your browser's local storage (see the cookie policy). It is not sent to our server, we cannot see it, and we cannot get it back for you. Clearing your browser's data for this site deletes it.

If you make a share link, the plan is written into the link itself, after the # sign. Browsers do not send that part of a link to our server, so we do not see it either. Anyone you give the link to can see the plan, so share it with care.

What we keep on our server

Only what you choose to send us through a form:

Contact form: your name, email, the topic you picked and your message.
Claim or update a business page: your name, role, email, phone (if given), what you want changed, the page it is about, and that you ticked the box saying you are the owner or allowed to act for the business.
Remove a listing: your email, your reason (if given) and the page it is about.

We also store the date and time each message arrived. Our own code does not store your IP address with these messages. We use them only to answer you and to deal with the listing. If email is set up, a copy of each message goes to our own inbox [email provider to confirm]. We never pass your message to a listed business.

We keep these messages for as long as we need them to deal with your request [retention period to confirm, for example 12 months], then delete them.

Server logs

Our own code does not log your visits. The server that runs the site, and the hosting in front of it, may keep standard technical logs (IP address, the page asked for, the time and the browser type) to keep the site running and safe [hosting provider and how long its logs are kept to confirm].

No tracking

We use no analytics, no advertising, no tracking cookies and no scripts from other companies. Fonts, pictures and maps are served from our own server, so opening a page does not tell another company about your visit. If you follow a link to a business's website, that site has its own privacy rules.

What we show about businesses, and where it comes from

Each listing is a real business in Malta or Gozo that we found and read up on by hand. We did not ask them first. We show what the business itself publishes on its own website (or, where it has none, its own public page): its name, the kind of business, the town, a short description in our words, what its site says it offers, any prices it publishes (with the date we read them) and a link to its site. We do not show personal phone numbers, email addresses or reviews.

The picture on a listing is the share image the business's own website publishes for link previews, or its logo. We keep a resized copy on our server and show it with the credit "Photo from their website" or "Logo from their website", linked to their site.

We use this information because we have a legitimate interest in helping people find local businesses for their events (GDPR Article 6(1)(f)), and it is information the business already makes public. A business can ask us to correct or remove its page at any time: open the page and use "Claim or update this page" or "Remove this listing". We act on removal requests within two working days, after a quick check.

Your rights

You can ask us:

for a copy of the data we hold about you (access),
to correct it (correction),
to delete it (removal),
to stop using it (objection).

Email contact@eventplanly.com or use the contact form. We will answer within one month. Data kept only in your browser is in your hands: we hold no copy of it.

Complaints

If you are not happy with how we handle your data, please tell us first. You can also complain to Malta's data protection authority, the Information and Data Protection Commissioner (IDPC): idpc.org.mt.

Changes

If we change what the site stores, we will update this page first and change the date at the top.

See also the terms of use and the cookie policy.