This Privacy Policy explains how SAW (referred to as “we”, “us” or “our”) collects, uses and protects personal data when you visit our website. We are committed to protecting your privacy and processing your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Data Protection Act (Chapter 586 of the Laws of Malta).

Our website is not intended for minors. We do not knowingly collect personal data relating to children. If you have reason to believe that a minor has provided us with personal data, please contact us immediately at Dpo@saw.com.mt and we will take steps to address this.

If you have any questions regarding this policy or how we handle your data, please contact us at: Dpo@saw.com.mt.

1. Updates

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The latest version will always be available on this website. Where changes are material, we will notify you by email or by a prominent notice on the website and, where required, seek your re-acceptance of the updated policy. For all other changes, your continued use of the website after the revised date constitutes your acceptance of those changes. We encourage you to review this page periodically. This policy was last reviewed in April 2026.

2. What Amounts to Personal Data?

Personal data means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

This website does not collect personal data directly through forms or account registration. However, certain data is automatically collected when you visit our website through the tools described below.

3. How Do We Collect Personal Data?

We collect personal data through the following automated methods when you visit our website:

We do not collect personal data through contact forms, account registrations, purchases, or any other direct submission method, as none of these features are present on this website.

4. What Personal Data Do We Process?

Given the nature of this website as a portfolio site with no forms, accounts or e-commerce functionality, the personal data we process is limited to:

We do not process special categories of personal data (such as health, biometric, religious or ethnic data), nor do we process data relating to criminal convictions or offences.

5. How Do We Use Your Personal Data?

We use the personal data collected through Google Analytics solely for the following purposes:

We do not use personal data for marketing, advertising, automated profiling, or any purpose other than those stated above.

6. Legal Bases of Processing Personal Data

We rely on the following legal basis for processing your personal data:

Legitimate interests (Article 6(1)(f) GDPR): We have a legitimate interest in understanding how our website is used in order to improve its performance and content. We have assessed that this interest is not overridden by your fundamental rights and freedoms, given that: (a) the data collected is anonymised and aggregated; (b) no forms, accounts or purchases are involved; and (c) you are provided with the ability to opt out via our cookie consent banner.

7. Recipients

We share data with the following third-party recipients who act as data processors on our behalf:

We do not sell, rent or share your personal data with any other third parties. We do not permit our data processors to use your personal data for their own purposes. If there is a corporate merger, acquisition or sale of assets, your personal data may be transferred to any successor entity, which will be required to honour the commitments made in this Privacy Policy.

8. Automated Decision-Making and Profiling

We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects on you. The analytics data we collect is used solely in aggregated, anonymised form to understand general website traffic patterns.

9. Data Retention

We retain personal data only for as long as is necessary for the purposes for which it was collected. When personal data is no longer required, it is securely deleted or anonymised.

Google Analytics data is retained in accordance with the data retention settings configured within our Google Analytics account. By default, Google Analytics retains user-level and event-level data for a period of 14 months, after which it is automatically deleted. Aggregated reporting data may be retained indefinitely.

Cloudflare retains connection logs for a limited period in accordance with its own data retention policy, available at cloudflare.com/privacypolicy.

As this website has no forms, accounts, purchases or marketing activities, no other categories of personal data are retained by us.

10. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

To exercise any of the above rights, please contact us at Dpo@saw.com.mt. We will respond to all legitimate requests without undue delay and in any event within one month of receipt. We may need to verify your identity before processing your request. Where a request is made on your behalf by a third party, we may also ask for proof of authorisation.

Please also note that you have the right to lodge a complaint with the supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement. See Section 12 for details of our Lead Supervisory Authority.

11. Keeping Your Data Secure

We take appropriate technical and organisational measures to protect your personal data from accidental loss, unauthorised access, use, alteration or disclosure. Access to analytics data is restricted to authorised personnel only. We use secure network connections and anonymise data where possible.

Please note that the transmission of information over the internet is never completely secure. While we take all reasonable steps to protect your data, we cannot guarantee the security of data transmitted to our website.

We have adopted procedures to deal with any actual or suspected personal data breach. Where a breach is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by applicable law.

12. Complaints

If you have a concern about the way we handle your personal data, we encourage you to contact us in the first instance at Dpo@saw.com.mt so that we may address your concern directly.

You also have the right to lodge a complaint with our Lead Supervisory Authority, the Information and Data Protection Commissioner (IDPC), which is the Maltese authority responsible for data protection matters:

Address: Level 2, Airways House, High Street, Sliema, Malta

Email: idpc.info@idpc.org.mt

Website: https://idpc.org.mt

Telephone: +356 2328 7100

13. Provision of Personal Data Relating to Third Party Data Subjects

This website does not currently collect personal data relating to third parties through any forms, submissions or uploads. If in future any functionality is added to this website that involves the submission of data relating to third parties (such as referrals or joint enquiries), the person submitting such data confirms that they are authorised to share it and that the relevant individuals have been informed of how their data will be used in accordance with this Privacy Policy.

International Transfers

Both Google LLC and Cloudflare, Inc. are based in the United States, which is a country that has not been the subject of an adequacy decision by the European Commission in all relevant respects. The transfer of personal data to these organisations is therefore carried out on the basis of Standard Contractual Clauses approved by the European Commission, which provide appropriate safeguards for the protection of your personal data. For further information on countries recognised by the European Commission as providing an adequate level of data protection, please refer to the European Commission’s list of adequate countries.

For further information on the specific safeguards in place, please refer to: