Privacy Policy for Website Users and End Customers

1. General

1.1 What is GDPR

GDPR is a new EU regulation, which seeks to strengthen the protection given to Personal Data. In the highly digitized world we live in today, information has become essential. We strive to ensure that any Personal Data that we have in our possession, is properly processed in terms of the law and shall strive to ensure proper protection for your Personal Data. Your Personal Data is critical for our business and for the provision of our services and thus its security and proper use is of paramount importance to us.

1.2 What is Personal Data

Personal Data is personal information about an individual, like you. We collect such information about our customers for relationship management, statistical reasons and for marketing purposes and also on our employees or potential employees or agents when they apply for a position with us. We may also collect some personal information from other individuals who are not our customers, for marketing purposes, subject to their consent. 

Personal Data may also be of a general nature and of a special nature. Generic Personal Data refers to data such as names, surnames, contact details and similar data which can be used to identify a person. Special categories of Personal Data relate to more confidential kind of Personal Data such as health data. Information regarding the different kinds of Personal Data we collect can be found in section 3 of this document. 

1.3 What are Controllers and Processors of Personal Data

When you provide your Personal Data to a third party, you are passing such data to either a controller or a processor.

A Controller of your Personal Data is an individual or a company who has the power to determine the exact uses of the Personal Data you have supplied to him. On the other hand, a Processor is a third party who is processing and thus utilising your Personal Data on behalf of a controller.

2. The Controller of your Personal Data

RE/MAX Malta is a franchise set-up composed a numerous independent franchise companies, all of which have a franchise relationship with the RE/MAX Master Franchise Owner in Malta. In this document, this shall be referred to as the “RE/MAX Franchise”.  

The RE/MAX Franchise generally collects Personal Data regarding our clients at the below stages of our relationship with our customers:

1. When we are approached to assist a client to find property to buy or rent;
2. When we are approached to assist a client to sell or lease out a property;
3. When we are about to conclude a sale or lease and collect additional Personal Data as required by the law.

We also Process Personal Data on our potential and actual employees and on any other party who engages with the RE/MAX Franchise. 

2.1 When we are approached to assist a client to find property to buy or rent

When any of our RE/MAX Franchise offices are approached by a client seeking to buy or rent a property, Personal Data shall be collected by that office, who shall be Controller of this Personal Data. This Personal Data will however be shared with the RE/MAX Master Franchise Owner, who shall also be a Controller of your Personal Data. Your Personal Data will be shared between the members of the RE/MAX Franchise so we can assist you in providing our services.

2.2 When we are approached to assist a client to sell or lease out a property

Similarly, to the above, when any of our RE/MAX Franchise offices are approached by a client seeking to sell or lease out a property, Personal Data shall be collected by that office, who shall be Controller of this Personal Data. This Personal Data will also be shared with the RE/MAX Master Franchise Owner, who shall also be a Controller of your Personal Data. Your Personal Data will be shared between the members of the RE/MAX Franchise so we can assist you in providing our services.

2.3 When we are about to conclude a sale or lease and collect additional Personal Data as required by the law

When a transaction can be concluded and thus a property sale or lease can be finalised, the RE/MAX Franchise office assisting in the transaction will require the collection of additional Personal Data from all the parties involved. Such Personal Data collected in this regard is required under law and shall be primarily held and Processed by the same office assisting the transaction and thus that RE/MAX Franchise office shall be Controller of this Personal Data. Any Personal Data collected in this regard may be in certain cases shared with the RE/MAX Master Franchise Owner, where in such a case the RE/MAX Franchise Holder would also become a separate Controller of this Personal Data, however the data will not be further shared with the other members of the RE/MAX Franchise. 

2.4 When engaged with the RE/MAX Franchise

Should you apply to work with the RE/MAX Franchise, your Personal Data shall be collected and processed by the RE/MAX Franchise office with who you will be engaged. Your Personal Data will also be shared with the RE/MAX Master Franchise Owner, who will be a separate Controller of your Personal Data. 

3. Your Personal Data

3.1 What Personal Data we collect

During your visit of this website, we will automatically collect the following Personal Data about you:

• information about the pages that you visit on this website;
• the date and time of your visit, 
• your IP address, 
• your web browser, 
• the website (https://remax-malta.com/) that you visited before accessing this website 
• certain cookies (see our Data Protection Statement). 

If you are looking to sell, buy or rent a property, we may obtain Personal Data from this website or from other members of the RE/MAX Franchise. The Personal Data we process in this context is:

• your name and surname;
• your address;
• your telephone number;
• your email address;
• listings and associated listing information and
• data concerning individual real estate transactions.

This information will only be obtained if you provide this information yourself to our franchise network or if you input this data in our website.

You may also provide us information when applying for a position with us. In such a case the personal information that we process is:

• Your name and surname;
• Your CV and any Personal Data contained therein;
• Your telephone number and mobile phone number;
• Your email;
• Personal References.

In cases where we ask you to provide any Personal Data, there is no obligation to do so, but if you do not, you will not be able to use all functions of our website, apply with us or to make use of our real estate services in general.

3.2 Specific Categories of Personal Data

Certain Personal Data is more sensitive and is classified as special categories of Personal Data, which relates to the following:

• Racial or ethnic origin;
• Political opinions;
• Religious or philosophical beliefs;
• Trade union membership;
• Genetic data;
• Biometric data for the purpose of uniquely identifying a natural person; 
• Data concerning health;
• Data concerning a natural person’s sex life or sexual orientation

In any case we will clearly explain the purposes for which we wish to use such Personal Data when it is being collected, and, if necessary, obtain your consent at that time.  In such cases, you will be able to withdraw your consent at any time. We will never process such Personal Data without obtaining your prior written consent unless otherwise specified by law.

4. Purposes for which we use your data

We will use your Personal Data to provide this website to you as a user of this website, to generate usage statistics, to improve and further develop this website, to provide real estate services to you, to respond to your requests and messages, to send you our newsletter if you have subscribed to it, to contact you about properties that may interest you, and to analyse your data in aggregate form for business intelligence purposes.

If you have applied for a position with us, we will process your data to determine your suitability for the position with us. 

5. Legal basis for the processing

We shall always process your Personal Data in terms of the law and therefore we shall always have a proper legal basis to Process your Personal Data;

1. Should you visit our premises, we will collect, and process visual data collected by our CCTV cameras. The legal grounds for processing here shall be to protect our legitimate interest in terms of article 6(1)(f).
2. If we process certain Personal Data about you that we receive from our website, from queries, from our social media platforms or from another member of the franchise network, in particular our franchisees, should you be looking to buy or lease a property, the legal basis for the processing will be your consent pursuant to Article 6(1)(a) GDPR that you will be asked for in a separate process. Where you will be asked for your consent, you may withdraw your consent at any time. However, doing so would not affect the lawfulness of the processing of your data based on the consent before its withdrawal. By withdrawing your consent, we may also be unable to provide you with our services. 
3. If we process your Personal Data due to the fact that you would like to sell or lease out a property, we would have entered into a contractual agreement with you and thus we would be processing your Personal Data to adhere to our contractual obligations in terms of article 6(1)(b) GDPR, due to certain legal obligations in terms of article 6(1)(c) GDPR and to protect our legitimate interest in terms of article 6(1)(f).
4. If however we are in the process of concluding a transaction of sale or lease of an immovable property we shall also be processing additional Personal Data from each side of the transaction as required by law. The legal grounds for processing here shall be to adhere to our contractual obligations in terms of article 6(1)(b) GDPR, due to certain legal obligations in terms of article 6(1)(c) GDPR, specifically due to prevention of money laundering and financing of terrorism laws and to protect our legitimate interest in terms of article 6(1)(f).
5. In addition, should you apply for a position with us, the legal basis of processing of your Personal Data shall be your consent pursuant to Article 6(1)(a) GDPR . 

6. Disclosures and data transfers

6.1 Independent Third Parties

As far as this is necessary for the purposes set out above, we may transfer your Personal Data to third parties as follows:

Should you require a detailed list of processors, kindly contact us as indicated below and we would provide you with more detail.

Some of the recipients referred to above are located in or process Personal Data outside of your country. The level of data protection in another country may not be equivalent to that in your country. However, we only transfer your Personal Data to countries where the EU Commission has decided that they have an adequate level of data protection or we take measures to ensure that all recipients provide an adequate level of data protection. We do this for example by entering into appropriate data transfer agreements based on the Standard Contractual Clauses implemented through Commission Implementing Decision (EU) 2021/915 of 4 June 2021 on standard contractual clauses between controllers and processors under Article 28(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council and Article 29(7) of Regulation (EU) 2018/1725 of the European Parliament and of the Council and the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council as regards the introduction of an alternative set of standard contractual clauses for the transfer of Personal Data to third countries). Such agreements are accessible upon request from info@remax-malta.com 

6.2 Regulatory Authorities

In terms of current laws, we may be required to transfer your Personal Data to certain regulatory or government authorities when subject to a proper and lawful request in terms of the law. We may be obliged to provide such data and we may also be prevented from informing you that such data has been provided. 

6.3 Personal Data collected from third Parties

In certain cases, as allowed by law, we may receive Personal Data about you from third parties, such as public authorities mainly relating to searches dealing with immovable property. Any Personal Data collected in this regard shall be processed and stored in terms of the law. 

7. Retention periods

We will retain your data that we collect automatically when you visit this website for no longer than six months. 

If you have subscribed to our newsletter, we will retain you email address until you unsubscribe from our newsletter. If you have registered on our website, we will retain your data for as long as your account exists and thereafter only for as long as there are any legal obligations to retain your data.

Moreover, we will retain your Personal Data that we receive from other members of the RE/MAX Franchise at least until the end of your business relationship with the RE/MAX Franchise unless there are statutory retention obligations or potential claims that are not yet time-barred. 

In this regard we shall keep;

1. Any of your general Personal Data up to at least five years after the end of our business relationship. Such Personal Data shall be kept to protect our legitimate interest due to statuary limitations. In addition this data shall be kept due to our due diligence obligations under the current legislation to prevent money laundering and financing of terrorism. This period may be extended to 10 years in certain situations as dictated under law;
2. Other Personal Data which may relate to transactions and other commercial matters shall be kept for at least ten years due to other obligations we have in terms of the law with the local authorities in relation to taxation matters

If you have applied for a position with us, we will delete all your Personal Data if we do not engage you after 4 months, unless you provide consent to keep the Personal Data for any longer.

We also process your personal data in the form of CCTV footage as stated previously. Such recordings shall be kept for 7 days unless the need arises to keep the recordings for a longer period of time due to legal obligations or to protect our legitimate interest.    

Should in any event, we are required to keep your Personal Data for any longer period as allowed by law, your Personal Data shall be kept secure and shall be deleted when we are allowed by law to delete such Personal Data.

8. Your rights and remedies

Under applicable data protection law, you have these rights:

1. to check whether and what kind of Personal Data we hold about you and to access or to request copies of such data,
2. to request correction, supplementation or deletion of Personal Data about you that is inaccurate or processed in non-compliance with applicable requirements,
3. to request that we restrict the collection, processing or use of Personal Data about you,
4. in certain circumstances, to object for legitimate reasons to the processing of your Personal Data,
5. to request your Personal Data in a structured, commonly used and machine-readable format, as allowed by law,
6. to know the identities of third parties to which your Personal Data are transferred and
7. to provide instructions on how your data must be handled after your death when relevant. 

When you are making such requests please note the below:

1. That following your request, we shall have up to one (1) month to reply, except in extreme situations as allowed under law. In such a case, we shall provide you with information why your requests was not finalised within such one month period. In the above mentioned exceptional situations, the one month time frame may be extended by a further two (2) months
2. That we have the right to charge a reasonable fee or refuse your request, if such requests are manifestly unfounded or excessive.
3. That when you are making a request, we may request documentation or information to confirm your identity. 

In case of any complaints, you also have the right to lodge a complaint with the competent data protection authority in Malta or in the Member state in which you work or reside.

9. Data Security Measures

We shall take all the necessary measures as required by law to ensure proper security and protection to your Personal Data. Such measures may include encryption, use of firewalls, anti-virus software and specialized security software, access restrictions and limitations, strict enforcement of policies and any other measures that we may enforce from time to time. Our measures shall strive to ensure that:

1. There is no unlawful destruction of your Personal Data;
2. That your Personal Data is not subject to unauthorized access;
3. That your Personal Data is not subject to unauthorized disclosure;
4. That your Personal Data is not subject to unauthorized modifications;

Despite our best efforts however, we cannot provide a 100% guarantee in relation to our system security. 

10. Surveillance and Security

We apply certain surveillance and security measures at our offices and on our systems. At our premises, measures like CCTV footage is recorded and retained in terms of our retention policy and security requirements. This Personal Data shall be stored and managed in terms of current data protection law. 

11. Marketing

11. 1 Direct Marketing

We shall always send marketing material to you if authorised by law to do so and we shall never send unsolicited marketing material in this regard. If you subscribe to our website, create a MY RE/MAX account, or subscribe to our services, we shall be sending you information regarding property that would interest you, in terms of the information you would have provided us. Thus we would be relying on your consent to send you such information which you can withdraw at any time. 

11.2 Social Media 

We also use social media to promote our services. Should you contact us through social media or should you provide us with Personal Data through social media, this privacy policy shall also apply and any Personal Data collected there shall be managed in terms of this policy. 

12. Hyperlinks

Our website contains hyperlinks to websites operated by other companies or businesses which are not related to us in any way. These websites are managed by companies who have their own data protection policies and procedures in place on which we have no control over. Therefore, we are not be responsible for the way the owners of these websites process your Personal Data.

13. Updating of this Policy

We may at any time update the terms of this Privacy Policy in terms of the law. If you are our client, we shall inform you if we have carried out material changes to this policy. If you are not a client of ours, it shall be in your interest to regularly check this policy. 

14. Contacting us

Should you have any questions regarding our data protection policies or would like to make a request in relation to your Personal Data, please contact us on the below: 

JK Holdings Limited
76a, Gorg Borg Olivier Street, St. Julian’s
info@remax-malta.com
+356 22471300 

The contact email of our DPO is:

drjcachia@remax.com.mt