PRIVACY NOTICE
This is a guide to how your personal data is managed by the C&C Group. Please read it carefully.
1. Who we are
Your information will be held by the C&C Group which comprises BAS Limited, Cassar & Cooper Limited, Cassar & Cooper (Holdings) Limited, Cassar & Cooper (S&I) Limited and C&C Express Limited.
Throughout this Privacy Notice, "we", "us" "our", and "ours" refer to the C&C Group.
More information about the C&C Group can be found on: www.cassar-cooper.com
2. The information we collect about you
There are various categories of personal information that we collect about you which may include inter alia, basic personal information (such as your name, address, ID or passport number, date of birth and contact details) and financial information (such as account and transaction information and history).
We will only process information in accordance with the provisions of the Data Protection Act (Chapter 440 of the Laws of Malta), the General Data Protection Regulation ((EU) 2016/679), and any and all national implementing laws, regulations and secondary legislation applicable in Malta relating to the processing of personal data, as introduced, amended or updated from time to time (the “Data Protection Laws”)
Accordingly, we must have one or more of the following reasons for processing your information:
- To fulfill a contract that we have with you;
- When it is in our legitimate interest. However, even where it is in our legitimate interest to do so, it must not unfairly prejudice your interest of fundamental rights and freedoms;
- When it is our legal duty: when you apply for a product or service (and throughout your relationship with us) we are required by law to process certain personal information about you;
- When you have consented to the using of your data in a specific way;
- Where we need to protect your vital interests or those of another person; and
- Where it is required in the public interest or for official purposes.
3. Who we share your information with
There may be instances during the course of providing you with our services where we may be required to disclose, share or exchange some or all of your personal information. This may be required in terms of the performance of our contract with you or in accordance with our legal obligations. Accordingly, we may share your personal information with, inter alia, the following persons:
- within the various companies of the C&C Group and our associated companies;
- your authorised representatives;
- any trade association, credit management, credit reference or similar organization;
- our service providers
- statutory and regulatory bodies, any public or governmental authority and/or to disclose any information before any court or adjudicating body of a competent jurisdiction; and
- entities you ask us to share your data with.
4. How long we hold your information
In line with our legal obligations, including inter alia the anti-money laundering regime and the Maltese tax legislation, and for the purpose of providing you with our services, we will generally keep your personal data for a maximum period of ten (10) years from date of termination of our relationship, after which time it will be destroyed if it is no longer required for the lawful purpose(s) for which it was obtained. We may on exception retain your information for longer periods, particularly where we need to withhold destruction or disposal based on an order from the courts or an investigation by law enforcement agencies.
5. Processing your information outside the EEA
Your information is stored on secure systems within the C&C Group premises. We may transfer or allow the transfer of information about you to our service providers and organisations outside the European Economic Area (the “EEA”), but only if they agree to act solely on our instructions and protect your information to the same standard that applies in the EEA.
We will implement all appropriate measures in order to protect the confidentiality, integrity and availability of all your data and we have appropriate technical and organizational measures to protect your personal data against unauthorised or unlawful processing together with accidental alteration, destruction, loss and to also ensure compliance with the obligations imposed by the Data Protection Laws. We also maintain strict information security policies designed to prevent unauthorised access to your information.
7. Your rights
Please note that you have several rights in relation to how we process your information, as follows:
The right to be informed
You have the right to request us in writing to inform you about the personal data that we process about you, the purpose of the processing, the categories of data that are being processed, the recipients of the data and the type of processing. If you wish to raise a complaint on the manner we have handled your personal data, you may contact us to have the matter investigated. In the event that you are not satisfied with our response or believe we are not processing your personal data in line with the Data Protection Laws, you can proceed to lodge a complaint the Information and Data Protection Commissioner’s office.
The right to maintain your personal data accurate and up to date
We do our utmost to ensure that all your personal data that we process is accurate and regularly updated. However, should you become aware of any errors or omissions in relation to your personal data, you are kindly requested to inform us about this in writing.
The right to be forgotten
Subject to certain exceptions, you shall also have the right to request erasure of your personal data on inter alia the following grounds:
- If your personal data has been given to us solely for consultation purposes and your choose not to avail yourself of any of our service;
- When you have withdrawn your consent (in those instances where we process that information on the basis of your consent);
- Where processing is no longer necessary for its intended purpose;
- Where erasure is necessary for compliance with a legal obligation;
- When you have successfully exercised your right to object to the processing; and
- Where special circumstances exist in connection with minors’ rights.
In any case, we shall not be legally bound to comply with the erasure request if the processing is necessary for compliance with a legal obligation to which we are subject (including but not limited to our data retention obligations) or for the establishment, exercise or defense of legal claims.
The right to data portability
Since your personal data may be subject to automated processing on the basis of our contractual relationship, you may be thus allowed to request a copy of the data concerned in order for you to be able to transmit your processed data to another controller without any hindrance from our part.
The right to object
You have a right to object to us processing your personal information where the legal basis for our use of your data is our legitimate business interest or that pursued by a third party, or the performance of a task in the public interest. However, in doing so this may have an impact on the services we can/are willing to provide. You also have the right to object at any time to the use of your personal data for direct marketing purposes.
The right to withdraw your consent
Where we rely on your permission to process your personal information, you have a right to withdraw your consent at any time. We will always make it clear where we need your permission to undertake specific processing activities.
8. Implications of not sharing your information
As provided in this Privacy Notice, we may need to collect personal information in view of a legal requirement, or under the terms of a contract we have with you.
If you opt not to give us this personal information, it may delay or prevent us from meeting our obligations. Moreover, it may mean that we may not be able to provide you with certain services that you request and/or we may not be able to continue to provide you with or renew existing services.
9. How to contact us
If you have any queries about how your personal data is processed, or if you wish to exercise any of your data rights set out above, please contact us at info@tnt.com.mt.
10. Changes to this Notice
We reserve the right to change, modify, update, add and/or remove parts of this Privacy Notice from time to time. If you are an existing client with whom we have a contractual relationship, you shall be informed by us of any changes made to this Privacy Notice.
