Privacy Policy

1. Who we are

This policy is issued by Dar Malta.

Dar Malta is the data controller for the personal information described in this policy, unless stated otherwise. Our contact details are set out in Section 16 below.

2. Scope of this policy

This policy explains how we collect, use, share and protect personal information about members, prospective members, guests, and visitors to this website. It is written to meet the requirements of, at minimum:

• the UK General Data Protection Regulation and the Data Protection Act 2018 (England & Wales);
• the EU General Data Protection Regulation (Regulation (EU) 2016/679) and Malta's Data Protection Act (Cap. 586), as enforced by the Information and Data Protection Commissioner (IDPC);
• the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA); and
• New York's data security requirements, including the SHIELD Act (General Business Law §899-bb), and applicable New York consumer protection law.

Where local law grants members additional or different rights, those rights apply in preference to this policy, to the extent of any inconsistency.

3. Information we collect

Given the nature of the House, the categories of information we collect are broader than a typical consumer service, and may include:

We collect this information directly from members and their House Representative, from guests introduced by members, from sponsoring members during the admission process, and from service providers acting on the House's instructions (e.g. tailors, travel operators, chauffeurs).

Some of the above (for example, passport details or, in rare cases, information revealing family relationships) may constitute special category or sensitive personal data under applicable law. We only collect such data where necessary to provide a requested service, and only with an appropriate lawful basis, which may include your explicit consent.

4. How we use your information

• To assess and process applications for hereditary or introduced membership;
• To operate the House and fulfil member requests (travel, vehicles, vessels, tailoring, events, introductions, meetings);
• To assign and support your House Representative;
• To manage billing, payments and House accounts;
• To maintain the security, confidentiality and integrity of the House and its members;
• To comply with legal, tax, anti-money-laundering and regulatory obligations;
• To communicate with you about your membership and arrangements; and
• To operate and improve this website.

5. Our legal bases for processing

Where UK GDPR, EU GDPR or Malta's Data Protection Act apply, we rely on one or more of the following bases for each use described above: performance of the membership arrangement (contract); our legitimate interests in operating a private, secure and well-run House, balanced against your rights; compliance with a legal obligation (e.g. anti-money-laundering checks); and, where required — for example for certain sensitive data or marketing — your explicit consent, which you may withdraw at any time.

6. Who we share information with

We share personal information, on a need-to-know basis and under confidentiality obligations, with:

• third-party service providers engaged to fulfil a request (e.g. tailors, chauffeurs, travel operators, hospitality venues, vessel operators);
• payment processors and financial institutions;
• professional advisers (legal, accounting, insurance);
• regulators, tax authorities and law enforcement, where required by law; and
• other House entities operating in Malta, the UK and the US, for the purpose of coordinating your membership across locations.

We do not sell personal information to third parties. Where California's CPRA definition of "sale" or "sharing" applies to any cross-context arrangement we enter into, see Section 10.

7. International transfers

Because the House operates in Malta, the UK and the US, personal information may be transferred between these locations. Where we transfer personal data out of the EU or UK to a country not deemed to offer an adequate level of protection (including the United States), we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK's International Data Transfer Addendum, together with supplementary measures where necessary. A copy of the relevant safeguard can be requested from info@darmalta.com.

8. Retention

We retain personal information for as long as your membership subsists and for a further period afterward to fulfil legal, tax, accounting and record-keeping obligations, to resolve disputes, and to preserve the House's historical and lineage records for the purpose of future hereditary membership applications. Financial records are ordinarily retained for [7] years in line with statutory requirements in the relevant jurisdiction. Criteria for retention include the nature of the information, the purpose of processing, and applicable legal requirements.

9. Your rights — EU, UK and Malta

If UK GDPR, EU GDPR or Malta's Data Protection Act applies to you, you have the right to: access the personal data we hold about you; request rectification of inaccurate data; request erasure in certain circumstances; restrict or object to processing; request data portability; and withdraw consent at any time where processing is based on consent. To exercise any of these rights, contact us using the details in Section 16.

10. Your rights — California residents

If you are a California resident, the CCPA as amended by the CPRA gives you the right to: know what personal information we collect, use, disclose and (if applicable) sell or share, and to request a copy of it; request deletion of personal information, subject to certain exceptions; request correction of inaccurate personal information; opt out of the sale or sharing of personal information and out of use of sensitive personal information beyond what is necessary to provide requested services; and not be discriminated against for exercising these rights. Dar Malta does not sell personal information for monetary consideration. To the extent any arrangement with a third party is later found to constitute "sharing" under the CPRA, we will provide an opt-out mechanism and update this policy accordingly. Requests may be submitted using the contact details in Section 16; we will verify your identity before responding.

11. Notice to New York residents

Dar Malta maintains reasonable administrative, technical and physical safeguards for personal information relating to New York residents, consistent with New York's SHIELD Act. In the event of a security breach affecting your personal information, we will notify you and the relevant authorities as required by New York law and the law of any other applicable jurisdiction.

12. Security

We maintain technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse or alteration, including restricted access on a need-to-know basis, encryption of sensitive data where appropriate, and confidentiality obligations imposed on staff and House Representatives. No system is completely secure, and we cannot guarantee absolute security.

13. Children

Membership and this website are not directed at individuals under the age of 18. Where family or lineage information about a minor is recorded for hereditary membership purposes, this is processed on the instruction and responsibility of the sponsoring adult member, with appropriate safeguards.

14. Cookies

This website uses cookies and similar technologies as described in our Cookie Policy, which forms part of this Privacy Policy.

15. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. The "last updated" date at the top of this page indicates when it was last revised. Material changes will be notified to members through their House Representative.

16. Contact and complaints

For any question about this policy or to exercise your rights, contact us at info@darmalta.com or through your House Representative. If you are not satisfied with our response, you have the right to lodge a complaint with: the Information and Data Protection Commissioner of Malta (IDPC) for EU/Malta matters; the UK Information Commissioner's Office (ICO) for UK matters; or the California Attorney General or California Privacy Protection Agency for California matters.