Privacy Policy

Ludo.mt - ludo.mt

Effective Date: 2026-10-24 | Version: 1.2

Table of Contents

1. Who We Are
2. Legal Framework
3. Legal Bases for Processing
4. Personal Data We Collect
5. How We Use Your Data
6. Owner Contact Details
7. Cookies and Browser Storage
8. Data Sharing
9. International Transfers
10. Data Retention
11. Your Rights
12. Security
13. Children
14. Automated Decision-Making
15. Phone Numbers and Communications Privacy
16. Changes to this Policy
17. Contact

1. Who We Are

The operator of Ludo.mt is responsible for the personal-data processing described here. Ludo.mt identifies the website; the website name does not by itself identify a registered company.

Contact: Available via the Contact Us page at ludo.mt.

We operate a digital property platform focused on Malta and Gozo, including listing, search, saved-search, notification, and favourites features.

This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our website, messaging services, and related features (the "Platform"). It should be read together with our Terms of Service and Cookie Policy.

2. Legal Framework

We process personal data in accordance with:

• the General Data Protection Regulation (EU) 2016/679 ("GDPR");
• the Data Protection Act (Chapter 586 of the Laws of Malta); and
• applicable subsidiary legislation and guidance issued by the Information and Data Protection Commissioner ("IDPC").

3. Legal Bases for Processing

Depending on the activity, we rely on the following legal bases under Article 6(1) of the GDPR:

• Contract (Article 6(1)(b)): account creation, authentication, profile management, service delivery, and communications necessary to perform our agreement with you.
• Legitimate interests (Article 6(1)(f)): fraud prevention, security, abuse detection, platform moderation, service improvement, audit logging, and protection of our rights and the rights of other users.
• Consent (Article 6(1)(a)): for specific processing activities where consent is required, including specific messaging interactions where consent is required. You may withdraw consent at any time.
• Legal obligation (Article 6(1)(c)): where processing is necessary to comply with Maltese or EU law, including responding to lawful requests from authorities.

4. Personal Data We Collect

We collect personal data in the following categories:

4.1 Account and Identity Data

• Mobile telephone number (used as your primary identifier and for login verification);
• Name (first name and last name, where provided);
• Email address;
• Date of birth and gender (where provided);
• Account creation date, last access date, and related timestamps.

4.2 Property Search Preferences

• Search criteria such as property type, locality, price range, and financing status.

4.3 Technical and Security Data

• IP address (full and truncated);
• Browser type, version, and operating system;
• Device type (desktop, mobile, tablet);
• User agent string, referrer, and language headers;
• Approximate geographic location derived from your IP address (country, region, and city) obtained via third-party geolocation services during login;
• Session identifiers, CSRF tokens, and device-security cookie tokens.

4.4 Audit and Moderation Data

• Login attempt records (including device, browser, and geolocation metadata);
• Historical owner contact reveal records (including the listing referenced, timestamp, IP address, and user agent);
• Contact form and abuse report submissions (including name, email, phone, message content, IP address, user agent, and timestamp);
• Content moderation flags and enforcement records; and

4.5 Communications Data

• Messages sent through our WhatsApp-based verification and notification flows, and communications you send us;
• Email verification records and status; and
• Service notifications and administrative messages.

4.6 Property Listing and Sales-Confirmation Data

Where a property is prepared, submitted, or managed through our listing workflow, we may process:

• Owner or company name;
• Listing contact name, mobile number(s), and email address;
• Preferred communication channels;
• Authority basis and authority notes;
• Viewing contact details;
• Listing-source metadata; and
• Confirmation and compliance fields (including lawful-owner or authorised confirmations and related notes).

This may include free-text notes provided by users or staff in connection with listing preparation and publication controls.

Listing and viewing-contact information may come from the owner, an authorised representative or another person supplying listing material, rather than directly from each named person. Those supplying another person's details must have a lawful basis to do so. The operator's own information obligations under GDPR Article 14 remain applicable.

Saved searches may store an optional preference about sharing with licensed intermediaries. Recording that preference does not itself send your details to an intermediary. Any activation of such sharing requires a defined recipient, purpose, lawful basis and appropriate information to you.

5. How We Use Your Data

We use your personal data for the following purposes:

• To create, authenticate, and manage your Account;
• To verify your identity and mobile number through one-time code login;
• To collect, verify, and manage listing-contact and authority/compliance information required to prepare, publish, moderate, and administer property listings;
• To send you service communications, including verification codes, account notifications, and status updates;
• To verify your email address;
• To review listings and reports, moderate content, and enforce our Terms of Service;
• To prevent and detect fraud, abuse, spam, and unauthorised access;
• To maintain security and audit logs;
• To respond to your contact form submissions and abuse reports;
• To comply with legal obligations; and
• To protect our rights, property, and the safety of our users.

6. Owner Contact Details

Owner contact details are held for listing administration and are not exposed through public or registered-user property views.

Published property descriptions, facts and images are visible to visitors and may be included in public listing feeds, search previews and shared links. Do not put private contact information or sensitive documents into published text or images. Removing a listing does not immediately remove copies held by search engines or other recipients.

7. Cookies and Browser Storage

We use strictly necessary cookies only:

• Session cookie: used for secure login sessions and CSRF protection. This cookie expires when the browser is closed.
• Persistent device-security cookie: a random device token used for security controls such as device registration, device-session continuity checks, and forced logout when a device is removed or no longer authorised. This cookie is long-lived (up to approximately one year unless cleared earlier).

These cookies are not used for analytics, advertising, profiling, or behavioural tracking, and are not used to track browsing activity across unrelated websites.

We may use temporary browser-side storage for limited operational purposes during a single session. It is normally scoped to a browser tab, although browser session-restore features may retain it after reopening. The application does not synchronise it between devices.

If we introduce additional non-essential cookies in the future, we will update this Policy and our Cookie Policy and, where required, obtain your consent.

8. Data Sharing

We do not sell or rent your personal data.

We may share personal data in the following circumstances:

8.1 Service Providers

The Platform uses external services to operate its messaging, email, storage, delivery and security features. Providers' data-protection roles depend on the service and processing concerned; not every recipient acts solely as our processor. Categories of providers include:

• Messaging and communication delivery;
• Email delivery;
• Cloud hosting and content delivery;
• Geolocation services (for approximate location lookup based on IP address during login); and
• Frontend asset delivery.

The current integrations include Green API and WhatsApp for messages, AWS SES for email, Cloudflare for image storage/content delivery, and cdnjs for frontend assets. Approximate IP geolocation may be requested from ipapi.co, ipwho.is or ipinfo.io. Messaging/email services receive delivery addresses and message content; geolocation services receive the IP address being looked up; content-delivery providers receive connection metadata such as IP address and browser headers.

Contact and abuse reports are emailed to the configured support mailbox, including the submitted information, IP address and user agent. Authorised administrators can access operational records needed to manage the Platform.

8.2 Owner Contact Details

Property owner telephone numbers are stored for listing administration and are not disclosed through public or registered-user property views.

8.3 Legal and Regulatory

We may disclose personal data where required by law, regulation, court order, or lawful request from a competent authority, including law enforcement, the IDPC, or the Malta Communications Authority.

9. International Transfers

Some of our service providers may process personal data outside the European Economic Area ("EEA"). Such transfers require a valid mechanism under GDPR Articles 44-49. Depending on the destination and provider, this may involve:

• EU adequacy decisions;
• Standard Contractual Clauses approved by the European Commission; or
• Other appropriate safeguards recognised under the GDPR.

Contact us for information about the destinations and safeguards applicable to your data and how to obtain a copy.

10. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law. Retention is assessed using the criteria below; these are not claims that all records expire automatically:

Data Category	Retention Criteria
Account data	While needed for the requested account service; after closure, only for a continuing security, dispute, legal or other lawful purpose
Historical billing records	The period required for financial and tax record-keeping under Maltese law
Property listings and images	While published or required for listing administration; removed listings and images require separate review of storage, cached copies and any continuing legal or dispute need
Property listing-contact and sales-confirmation metadata	As needed to administer the listing, establish authority, resolve disputes or meet an applicable legal obligation
Historical owner contact reveal logs	Only while needed for an identified historical security, dispute or legal purpose
Login attempt and security logs	As needed to investigate and prevent account misuse, taking account of the incident and ongoing risk
Contact form and abuse report records	As needed to resolve the request and any related complaint, dispute or legal obligation; copies may remain in support email systems
Moderation and enforcement records	As needed to explain and review enforcement, prevent repeat abuse and address legal claims
Technical logs	According to their security or operational purpose and the hosting/provider retention settings
Backups	According to the operator's and providers' actual backup rotation; deletion from active records does not immediately erase backup copies
Historical webhook and billing event records	Where retained, the applicable financial, audit, dispute or legal-hold period; no new payment processing is performed by the Platform

Where data is subject to a legal hold, investigation, or dispute, we may retain it beyond the periods above as necessary.

Self-service account deletion requires a session security token and a code sent to your registered WhatsApp number. Before deleting the active account, saved searches and historical phone-reveal records, the current workflow emails a support archive of personal details, searches, favourites, device metadata and reveal audit records. Authentication codes, device-token hashes and current session identifiers are excluded. The archive and separately held listings, support correspondence, historical financial/event records and backups are not all erased by that action. Contact us to exercise erasure or other rights over retained records; statutory exceptions are assessed individually.

11. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

• Access (Article 15): the right to obtain confirmation of whether your data is being processed and to receive a copy of it.
• Rectification (Article 16): the right to have inaccurate data corrected or incomplete data completed.
• Erasure (Article 17): the right to request deletion of your data where it is no longer necessary, where consent is withdrawn, or where processing is unlawful.
• Restriction (Article 18): the right to request that we limit the processing of your data in certain circumstances.
• Data portability (Article 20): the right to receive your data in a structured, commonly used, machine-readable format where processing is based on consent or contract and carried out by automated means.
• Objection (Article 21): the right to object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
• Withdrawal of consent (Article 7(3)): where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

How to exercise your rights: Please contact us via the Contact Us page on the Platform. We may need to verify your identity before processing your request. We will respond within one month, or inform you if an extension is necessary.

Right to lodge a complaint: You may lodge a complaint with the Information and Data Protection Commissioner (IDPC), using the contact details at idpc.org.mt, or with the supervisory authority in the Member State of your habitual residence, place of work or the alleged infringement.

12. Security

We apply technical and organisational measures to protect your personal data, including access controls, encryption in transit, secure session management, and monitoring. However, no system is completely secure, and we cannot guarantee absolute security.

You are responsible for protecting your own devices, mobile number, and account credentials, and for reporting any suspected unauthorised access to us promptly.

13. Children

The Platform is intended for persons aged 18 and over. Registration verifies control of a telephone number, not age. If you believe that a person under 18 has used the Platform, please contact us so that we can assess the account and any appropriate restriction or erasure.

14. Automated Decision-Making

Administrators manage listing content and reports. Security rules automatically check verification attempts, registered-device status and other access conditions; failed checks can prevent login or require verification again. Listing images are not automatically assessed for legality by the Platform.

You may contact us to question a restriction or request review. If a proposed automated process would produce legal or similarly significant effects, the operator must first assess GDPR Article 22 and provide the required information and safeguards.

15. Phone Numbers and Communications Privacy

We do not publicly display your phone number on property listings. Your mobile number is used as your account identifier and for login verification. Communication with users is facilitated through our messaging infrastructure.

Owner telephone numbers are private and are not visible through public or registered-user property views.

16. Changes to this Policy

We may update this Privacy Policy from time to time. Updates will be posted on the Platform with a revised effective date. Where a change is material, we will use reasonable efforts to bring it to your attention. Your continued use of the Platform after an update does not by itself provide consent to new processing where consent is required.

17. Contact

For questions, data-protection requests, or complaints regarding this Privacy Policy, please contact us via the Contact Us page at ludo.mt.

Last updated: 2026-10-24. Version: 1.2.