Who We Are
Cars.com.mt is an online vehicle marketplace operated by [Cars.com.mt], a company registered in Malta
We act as the Data Controller for the personal data collected through this website, meaning we determine the purposes and means of processing your information in accordance with the General Data Protection Regulation (GDPR) and the Maltese Data Protection Act (Chapter 586 of the Laws of Malta).
Data We Collect
Account & Registration Data
When you register or contact us, we may collect:
- Full name and username
- Email address and phone number
- Password (stored in hashed form — we never store plaintext passwords)
- Dealer or private seller status
- Business name and VAT number (for dealers)
Listing & Vehicle Data
If you post a vehicle listing, we collect all details you provide, including make, model, year, price, mileage, condition and any uploaded photographs.
Transaction & Payment Data
For paid features, we collect billing details necessary to process your payment. Full card numbers are processed by our payment provider and are never stored on our servers.
- Name on card and billing address
- Transaction reference and amount
- Invoice history
Communication Data
When you send an enquiry to a seller through our platform, or contact our support team, we retain the content of that communication.
Technical & Usage Data
We automatically collect certain technical data when you use our website:
- IP address and approximate location (country/city level)
- Browser type, version and device type
- Operating system
- Pages visited, search terms used and time spent on site
- Referring URLs (where you came from)
- Cookie identifiers (see Section 5)
How We Use Your Data
We use your personal data only for legitimate purposes directly related to operating the cars.com.mt platform:
- To create and manage your account and listings
- To process payments for advertising services
- To send transactional emails (account confirmation, payment receipts, listing expiry notices)
- To enable buyers to contact sellers through our messaging system
- To provide customer support and respond to enquiries
- To detect and prevent fraud, spam and abuse
- To analyse usage patterns and improve the website’s performance and features
- To comply with legal obligations (tax records, regulatory requests)
- To send occasional service updates or platform announcements (you may opt out at any time)
Legal Basis for Processing (GDPR Art. 6)
We process your personal data only where we have a lawful basis to do so. The table below sets out the basis for each processing activity:
| Purpose | Legal Basis |
|---|---|
| Account registration and management | Contract (Art. 6(1)(b)) |
| Processing payments for listings | Contract (Art. 6(1)(b)) |
| Sending transactional emails | Contract (Art. 6(1)(b)) |
| Fraud prevention and platform security | Legitimate Interests (Art. 6(1)(f)) |
| Analytics and website improvement | Legitimate Interests (Art. 6(1)(f)) |
| Marketing communications (opt-in) | Consent (Art. 6(1)(a)) |
| Retaining tax and financial records | Legal Obligation (Art. 6(1)(c)) |
| Responding to regulatory or court requests | Legal Obligation (Art. 6(1)(c)) |
Cookies & Tracking Technologies
What are cookies?
Cookies are small text files placed on your device when you visit our website. They allow us to recognise your browser and remember your preferences.
Cookies we use
- Essential cookies: Required for the website to function (e.g. login sessions, shopping basket). Cannot be disabled.
- Analytics cookies: Help us understand how visitors use the site (e.g. Google Analytics, anonymised). Require your consent.
- Preference cookies: Remember your settings such as language or search filters. Require your consent.
- Marketing cookies: Used to show relevant advertising on third-party platforms. Require your consent.
Managing cookies
You can accept or reject non-essential cookies using our cookie consent banner when you first visit the site. You may also update your preferences at any time via the Cookie Settings link in the website footer. Additionally, most browsers allow you to control cookies through their settings.
Disabling certain cookies may affect the functionality of the website.
Data Sharing & Third Parties
We do not share your personal data with third parties except in the following circumstances:
Service Providers (Data Processors)
We work with carefully selected third-party providers who process data on our behalf and under our instruction. These include:
- Web hosting and cloud infrastructure providers
- Payment processors (your card data is handled directly by them under PCI-DSS standards)
- Email delivery services (for transactional emails)
- Website analytics providers (anonymised data)
All processors are bound by data processing agreements and are not permitted to use your data for their own purposes.
Legal & Regulatory Disclosure
We may disclose your data to law enforcement agencies, regulators or courts where required by applicable law, a court order, or where necessary to protect the legal rights of cars.com.mt or third parties.
Business Transfers
In the event of a merger, acquisition or sale of all or part of our business, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
Public Listing Data
Vehicle listing information you publish (make, model, price, photos, seller phone number or email if provided) is publicly visible on cars.com.mt and may be indexed by search engines. Please only include contact details in your listings that you are comfortable making public.
Data Retention
We retain your personal data only for as long as necessary for the purposes for which it was collected, or as required by law:
- Account data: Retained while your account is active and for up to 2 years after closure, to handle any outstanding disputes or enquiries.
- Payment and invoice records: Retained for 10 years to comply with Maltese tax and accounting requirements (Value Added Tax Act, Cap. 406).
- Listing data: Retained for 12 months after a listing expires or is removed.
- Communication logs: Retained for 12 months after the last communication.
- Analytics data: Aggregated and anonymised — retained indefinitely. Individual session data retained for up to 26 months.
When your data is no longer required, it is securely deleted or anonymised.
Your Rights Under GDPR
As a data subject under GDPR, you have the following rights. You can exercise any of these rights by contacting us at privacy@cars.com.mt. We will respond within 30 days.
Right of Access
Request a copy of all personal data we hold about you.
Right to Rectification
Ask us to correct inaccurate or incomplete data.
Right to Erasure
Request deletion of your data (“right to be forgotten”), subject to legal retention requirements.
Right to Restriction
Ask us to pause processing of your data in certain circumstances.
Right to Portability
Receive your data in a structured, machine-readable format.
Right to Object
Object to processing based on legitimate interests, including direct marketing.
Withdraw Consent
Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
Right to Complain
Lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC) at idpc.org.mt.
International Data Transfers
Malta is a member of the European Union. Your data is primarily processed within the EU/EEA.
Where any of our service providers process data outside the EU/EEA (for example, if hosted on servers in a third country), we ensure that appropriate safeguards are in place, such as:
- EU Standard Contractual Clauses (SCCs) approved by the European Commission
- An adequacy decision by the European Commission confirming the third country offers equivalent protection
You may request details of the safeguards in place by contacting privacy@cars.com.mt.
Children’s Privacy
Cars.com.mt is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18 years of age.
If you believe a child has provided us with personal data without parental consent, please contact us at privacy@cars.com.mt and we will delete such information promptly.
Data Security
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, disclosure, alteration or destruction. These include:
- HTTPS/TLS encryption for all data in transit
- Encrypted storage of sensitive data at rest
- Password hashing using industry-standard algorithms
- Access controls — only authorised personnel can access personal data
- Regular security reviews and updates
No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or for other operational reasons.
When we make material changes, we will notify you by:
- Posting a notice on the cars.com.mt homepage
- Sending an email notification to registered users (where applicable)
- Updating the “Last updated” date at the top of this page
Your continued use of cars.com.mt after the effective date of any changes constitutes your acceptance of the updated policy. We encourage you to review this page periodically.
📬 Contact Us
If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how we handle your personal data, please reach out to us.