Privacy Policy

Last Updated: July 2026 · Consent version 2.0

This Privacy Policy explains how Discover Gozo (“we”, “us”) collects, uses, and protects information when you use our website and app. We operate from Malta and process data in line with the EU General Data Protection Regulation (GDPR) and the ePrivacy rules that apply to device storage.

1. Information We Collect

A. Strictly necessary (no analytics consent required)

These are needed for the service you request:

• Account & login: email, username, password (hashed), and a session cookie when you sign in
• Bookings & tickets: reservation and redemption details you create
• App preferences: settings you choose (e.g. language, map preferences) stored on your device

B. Usage & location analytics (only with your consent)

Only after you tap Allow analytics (or enable the toggle in Privacy & Settings) we may collect:

• Anonymous visitor and session identifiers stored on your device (localStorage)
• Pages and features used (e.g. place views, searches, bookings funnel steps)
• Device type, browser/OS, screen size, language, and time zone
• Optional discovery/campaign attribution (e.g. QR or UTM parameters)
• Optional visitor type you choose (day visitor / overnight / resident)
• Approximate location (rounded to about 100 m) when GPS is enabled, for tourism visit insights

We do not use advertising networks, Google Analytics, or sell personal data.

2. How We Use Your Information

• Understand how visitors explore Gozo (aggregated patterns)
• Improve app features, content, and reliability
• Support infrastructure and tourism planning with anonymised reports
• Operate accounts, bookings, treasure hunts, and related features you use

3. Legal Basis (GDPR)

• Consent — for usage analytics, anonymous identifiers on your device, and location analytics
• Contract / requested service — for accounts, bookings, and features you ask us to provide
• Legitimate interests — for security (e.g. rate limiting, abuse prevention), balanced against your rights

You may withdraw analytics consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

4. Cookies and similar technologies

• Essential: login/session cookies when you authenticate
• Analytics (consent): first-party identifiers in localStorage / sessionStorage used only for Discover Gozo analytics

We do not set third-party advertising cookies.

5. Data protection measures

• Location used for analytics is precision-reduced (~100 m)
• Analytics uses anonymous device identifiers, not your name
• Data in transit uses HTTPS
• Passwords are hashed (bcrypt); admin access is authenticated and logged
• Uploads are restricted to safe image types; database queries use parameterized statements

No method of transmission or storage is 100% secure; we take reasonable technical and organisational measures.

6. Retention

Location and usage analytics are retained for up to 12 months, then deleted or aggregated. Aggregated, anonymised reports may be kept longer. Account and booking records are kept as needed to provide the service and meet legal obligations.

7. Sharing

We may share aggregated, anonymised statistics with tourism authorities or research partners. Those summaries cannot identify you.

8. Your choices and rights

In the app

• Allow analytics or Continue without analytics when prompted
• Change your mind anytime under Privacy & Settings
• Turning analytics off stops new collection and removes analytics identifiers stored on this device
• Map/GPS features can still work for navigation; we simply will not use location for analytics without consent

GDPR rights (EEA)

• Access, rectification, erasure, restriction, portability, objection
• Withdraw consent
• Lodge a complaint with your supervisory authority (in Malta: IDPC)

9. Children's privacy

The service is not directed at children under 16. If you believe we collected a child’s data, contact us and we will delete it.

10. Changes

We may update this policy and the consent version. Significant changes that affect how we process data will require a new consent choice in the app where analytics is concerned.

11. Contact

12. Governing law

Maltese law and the GDPR apply. For users outside the EEA, using the service means information is processed as described here.