Privacy Policy & GDPR Notice

1. Who We Are (Data Controller)

HR Advisory Services ("we", "us", "our") is a Malta-based human-resources consultancy. For all matters relating to your personal data, we act as the Data Controller under the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the Maltese Data Protection Act (Chapter 586 of the Laws of Malta).

• Address: 75 Lornev Flats, Unit 3, Triq il-Bardnell, San Pawl il-Bahar, SPB 2816, Malta
• Email: info@hradvisoryservices.eu
• Telephone: +356 9960 8994
• Supervisory Authority: Office of the Information and Data Protection Commissioner (IDPC), Malta — idpc.org.mt

2. The Information We Collect

We only collect personal data that is necessary to deliver our services or respond to your enquiry. Depending on your interaction with us, we may collect:

• Identification & Contact Data: full name, company, email address, telephone number, postal address.
• Employment & Professional Data: CV contents, work history, qualifications, references (where you engage us for CV writing, coaching or HR consultancy).
• Enquiry Data: the message, service of interest and any information you voluntarily provide via our contact form or email.
• Technical Data: IP address, browser type, device type, pages visited, and cookies (see section 7).

We do not knowingly collect special-category data (e.g. health, religion, political opinions) unless you explicitly provide it as part of an HR engagement and have given informed consent.

3. Lawful Basis for Processing (Article 6 GDPR)

We process your personal data only when a valid legal basis applies:

• Consent (Art. 6(1)(a)) — when you tick the consent box on our contact form or subscribe to marketing communications.
• Performance of a contract (Art. 6(1)(b)) — when you engage us for HR advisory, CV writing, coaching or other professional services.
• Legal obligation (Art. 6(1)(c)) — for accounting, tax, anti-money-laundering and other Maltese/EU statutory requirements.
• Legitimate interests (Art. 6(1)(f)) — to improve our services, ensure website security and prevent fraud, where such interests are not overridden by your rights.

4. How We Use Your Information

• To respond to enquiries received through our website, email, phone or WhatsApp.
• To deliver the HR services you have requested and to manage our client relationship.
• To issue invoices and meet our accounting and tax obligations.
• To send you, with your prior consent, occasional HR insights or service updates. You can unsubscribe at any time.
• To maintain the security and proper functioning of our website.

5. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by Maltese law:

• General enquiries: up to 24 months from the last contact, after which data is securely deleted.
• Client files & contracts: retained for 10 years following the end of the engagement, in line with Maltese commercial and tax legislation.
• Marketing data: until you withdraw consent or 36 months of inactivity, whichever comes first.

6. Sharing & International Transfers

We do not sell, rent or trade your personal data. We may share limited information only with:

• Trusted service providers (e.g. email, secure hosting, accounting software) acting as Data Processors under strict GDPR-compliant agreements.
• Maltese regulatory or law-enforcement authorities where we are legally obliged to do so.

Where data is transferred outside the European Economic Area (EEA), we ensure adequate safeguards are in place, such as the European Commission's Standard Contractual Clauses or an adequacy decision.

7. Cookies & Tracking Technologies

Our website uses a minimal number of cookies. You can accept or decline non-essential cookies via the banner displayed on your first visit.

• Strictly necessary cookies — required for the website to function (always active).
• Functional cookies — remember your preferences (e.g. cookie consent choice).
• Analytics cookies (optional) — help us understand how visitors use the site, anonymised wherever possible.

You can manage or delete cookies at any time through your browser settings.

8. Your Rights Under the GDPR

As a data subject in Malta and the EU, you have the following enforceable rights:

• Right of access — obtain a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”) — request deletion of your data where no legal basis to retain it applies.
• Right to restrict processing — ask us to limit the use of your data in specific situations.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — at any time, without affecting prior lawful processing.
• Right to lodge a complaint — with the Maltese IDPC (idpc.org.mt).

To exercise any of these rights, please email info@hradvisoryservices.eu. We will respond within one calendar month, as required by Article 12 GDPR.

9. Security of Your Data

We implement appropriate technical and organisational measures — including encrypted transmission (HTTPS/TLS), access controls, regular backups, and staff confidentiality training — to protect your personal data against unauthorised access, alteration, disclosure or destruction. In the unlikely event of a personal-data breach likely to result in a risk to your rights, we will notify the IDPC within 72 hours and inform affected individuals without undue delay.

10. Children's Privacy

Our services are intended for adults. We do not knowingly collect personal data from individuals under the age of 16 without verifiable parental consent, as required by Article 8 GDPR.

11. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology or our services. The "Effective Date" at the top will indicate when the latest revision was published. We encourage you to review this page periodically.