Conference information
How personal information is used in connection with the conference, enquiries and bookings.
171 Old Bakery Street
Il-Belt Valletta VLT 1455
Malta
Telephone: +356 2123 5406
Conference email: employmentlawconference@gmail.com
Ganado privacy contact: dp@ganado.com
Ganado Advocates participates as a joint organiser and joint controller. Booking invoices are issued by Roselyn Borg trading as Ten Yards Legal.
Trading as Ten Yards Legal
40/1 Old Mint Street
Valletta VLT 1514
Malta
VAT number: MT15990628
Telephone: +356 7924 0414
Conference email: employmentlawconference@gmail.com
Roselyn Borg is a warranted advocate under Maltese law.
Ganado Advocates and Roselyn Borg trading as Ten Yards Legal jointly determine the purposes and means of processing conference information and are joint controllers. You may exercise your rights against either organiser. The shared conference contact is employmentlawconference@gmail.com.
Roselyn coordinates bookings, invoices, payments, marketing preferences and privacy requests through the shared conference email. Both organisers are responsible for ensuring lawful access, security, retention and assistance with your rights. You may contact either organiser about your information.
For privacy enquiries and rights requests, contact employmentlawconference@gmail.com or +356 7924 0414.
This notice covers conference bookings, enquiries, attendance administration, payment records and use of the website. Information may be supplied directly by you or by a colleague booking on your behalf.
The booking form collects your email address, title, first name, surname, telephone/mobile number, number of participants and selected payment method. It also offers company name, designation, company address and company VAT number fields. The form records your responses to its acknowledgement and permission questions, where included. Additional booking correspondence, invoices, payments and cancellation records may be processed to administer the event.
Email, title, name, surname, telephone/mobile number, participant count, payment method are required for the online booking process. Company fields are optional unless needed for the invoice you request. The form itself does not request payment-card numbers, dietary/allergy information or accessibility information.
Where an employer or colleague supplies your details, that person should provide this notice to you. We use those details for conference administration and provide this notice to the attendee, ordinarily in our first communication and within the applicable GDPR time limit.
| Purpose | Legal basis |
|---|---|
| Managing your booking, attendance and enquiries | Performance of a contract or pre-contractual steps where you are the contracting individual. For employees attending under an employer's booking, legitimate interests in administering the event, subject to the appropriate assessment. |
| Invoices and legally required accounting records | Compliance with the applicable legal obligations; contractual processing where appropriate. |
| Security and handling disputes | Legitimate interests in protecting the service and establishing, exercising or defending legal claims. |
| Future promotional communications | Your separate, optional consent for future promotional emails about this conference series. You may unsubscribe using the link in each message or contact the organisers. Booking and attendance do not depend on opting in. |
Where we rely on legitimate interests, we assess those interests against your rights and reasonable expectations. Information required to administer a booking must be provided for the booking to proceed; optional information should be identified separately.
The website is hosted through Cloudflare, and online bookings are submitted using a separate Google Form. These services process information according to their relevant roles and terms.
Conference sponsors do not receive attendee or booking personal information.
Authorised people working for the organisers may access information where necessary for their conference responsibilities. Ganado owns the Google booking form. Google services support submission and storage of booking responses and the conference email correspondence.
Cloudflare delivers and protects the website, processing technical request information such as IP addresses, browser/device information, requested URLs and security events. Wix is used for conference marketing-email contact lists and delivery, including subscription choices, delivery and unsubscribe records and campaign interaction information where enabled. It is not the host of this conference website.
The payment method you choose may involve Bank of Valletta, Revolut or Stripe. The relevant provider processes payment, payer and transaction information under its own notice; we receive the information needed to reconcile payment and issue or settle your invoice. Payment-card details are entered with the payment provider, not in our booking form. We may disclose records to professional advisers or public authorities where necessary for legal, accounting or regulatory obligations or claims.
Sponsors and venue owners do not receive attendee lists or booking contact details. The photographer is not given those records; the photographer does, however, create and handle event images as described below. We do not sell attendee information.
The organisers do not plan separate overseas disclosures of attendee lists. However, the website and booking process use international service providers, which may process information outside the European Economic Area.
Our service providers operate internationally. Processing is not confined to Malta or the European Economic Area (EEA). The location and safeguards depend on the service and the relevant provider terms.
| Provider and use | Processing locations and published safeguards |
|---|---|
| Google: bookings, email and embedded map | Google uses servers worldwide and may process information outside your country, including in the United States. Its published arrangements include the EU–US Data Privacy Framework for covered transfers and European Commission standard contractual clauses where appropriate. See Google’s privacy policy and transfer frameworks. |
| Cloudflare: website delivery and security | Cloudflare states that it primarily stores information in the United States and EEA, with access and transfers through global operations. It describes reliance on the EU–US Data Privacy Framework for covered US transfers, and standard contractual clauses for other relevant transfers or as a fallback. See its privacy policy and data processing addendum. |
| Wix: conference email marketing | Wix’s processing terms allow worldwide processing. They describe initial transfers to Wix in Israel under the EU adequacy decision and onward transfers using adequacy decisions or standard contractual clauses/other appropriate safeguards. Its published sub-processors include entities and email providers in the United States and other countries, alongside EEA providers. See Wix’s processing terms, privacy policy and sub-processor list. |
These are the providers’ published arrangements, rather than a promise of a particular server location for each record. Where a provider processes information on our behalf, the applicable processor terms govern that processing; providers may also act as independent controllers for their own security, account or payment activities. You can contact either organiser to request further information about a relevant transfer and its safeguards, including a copy or reference to the applicable clauses, subject to necessary redactions.
We retain organiser-controlled records for the periods below, then delete or anonymise them, subject to the limited exceptions described here.
| Record | Retention period |
|---|---|
| Booking, attendee lists and routine event correspondence | 24 months after the relevant conference, then deletion or anonymisation, except records separately required for accounting or a live claim. |
| Enquiries that do not lead to a booking | 12 months after the last substantive correspondence. |
| Invoices, payment and VAT transaction records | At least six years from the end of the year to which they relate. If the relevant VAT return is late or corrected, the six-year period starts from submission/correction. Retain longer only where another applicable requirement or a specific legal hold requires it. |
| Opted-in marketing contact details | Until withdrawal, or three years after the last affirmative opt-in/renewal, whichever occurs first. At that point, cease marketing unless permission is renewed. Routine email opens do not restart this period. |
| Evidence of marketing permission | Six years after the last marketing communication relying on that permission, limited to what is needed to demonstrate compliance. |
| Opt-out/suppression records | A minimal email identifier and opt-out record for as long as the organisers maintain the relevant marketing programme, to avoid re-adding an unsubscribed person; review necessity annually. |
| Unselected raw event photographs | Three months after the conference, then deletion. |
| Selected event photographs | Three years after the conference, followed by a review; retain beyond this only where continued use is specifically justified, documented and disclosed. |
| Privacy requests and complaints | Three years after resolution, unless a specific investigation or claim requires longer. |
Exceptions for legal obligations, proceedings or disputes are limited to the relevant information and reviewed when the reason ends. The schedule applies to our forms, spreadsheets, email and local exports. Residual backup copies are removed through the relevant backup cycle and are not used for routine processing; if restored, deletion restrictions are reapplied.
Providers may retain security, service or payment records under their own terms, independently of our event-record schedule. Their periods depend on the record, service configuration, security need and applicable legal requirements. The provider notices linked above explain their criteria; contact us if you need information about a particular record. We do not treat these provider-controlled records as subject to a single event deletion date.
Subject to the applicable conditions, you may request access, correction, erasure, restriction or portability of your personal information. You may object to processing based on legitimate interests, and you may object to direct marketing at any time. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. Erasure is not absolute: some records may need to be retained by law or for legal claims.
Contact us using the details above. We normally respond within one month; where legally permitted, a complex or numerous request may require an extension, which we will explain. We may need proportionate information to verify your identity.
You may complain to Malta's Information and Data Protection Commissioner or another competent supervisory authority.
Photography is planned for this edition, and the website displays photographs from the previous edition. The organisers do not carry out automated decision-making or profiling for conference administration.
Photographs may be used on the conference website, in conference promotional emails and on social media to report on and promote the event. For proportionate general event photographs, the legal basis is the organisers' legitimate interests in documenting and promoting the conference, balanced against attendees' interests and rights. Attendance is not blanket consent to every photographic use; we seek separate permission for posed portraits or prominent individual promotional features.
If you do not wish to be photographed, please tell registration staff on arrival so they can notify the photographer and explain the arrangements. You can also contact the organisers in advance or raise an objection to a particular use afterwards. Withdrawal/removal requests will be assessed promptly, including the practical limits on copies already circulated or shared by others.
Access is limited to people who need the information for their responsibilities. We use appropriate organisational and technical measures to protect conference records, and avoid sharing attendee records with sponsors or other attendees.
See our cookies and external-services notice for the map and external booking links. We will update this notice when our processing changes and display its revision date.