Legal
Privacy Policy
In short
- We ask for very little: your email and nationality. Everything else is optional and you can skip it.
- Your individual answers are never sold and never handed to the government, your employer or anyone else.
- We publish, share and sell combined, anonymous results only. Groups smaller than 10 people are never reported.
- You can see, correct and delete your data at any time from My points.
1. Who we are
CountUs Malta (“CountUs”, “we”, “us”) is operated by CEMRION, a company registered in Malta under number [C XXXXX], with its registered office at [REGISTERED ADDRESS]. CEMRION is the data controller of the personal data described in this policy. Contact us at privacy@countusmalta.com.
2. What we collect
| Data | When | Required? |
|---|---|---|
| Email address | Signup, to send your login code | Yes |
| Nationality | Signup | Yes |
| Confirmation that you are 18 or older, and your consents | Signup | Yes |
| Your answers to questions | Each time you vote | No, every question is optional |
| Birth year, time in Malta, sex, industry, position, employer benefits | Profile steps, unlocked gradually | No, every step can be skipped |
| A one way fingerprint of your Maltese mobile number (never the number itself) | Only if you choose to get verified | No |
| Points, level, invite code and who invited you | Automatically, as you take part | Yes, to run the points system |
| Language preference and basic technical logs (time, browser type, errors) | Automatically | Yes, to run the service securely |
We do not ask for, and you should not give us, ID card, passport or residence permit numbers, your full name, your employer's name or your home address.
3. Special category data
Some questions touch on your political opinions, trade union membership or health (for example views on the budget, union membership or stress levels). Under the GDPR these are special categories of data. We process them only with your explicit consent, given at signup and each time you choose to answer. You can withdraw that consent at any time by deleting your answers or your account.
4. Why we use your data and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and securing your account, sending login and verification codes | Performance of our agreement with you, Art. 6(1)(b) |
| Counting your answers into combined, anonymous results | Your consent, Art. 6(1)(a), and explicit consent for special categories, Art. 9(2)(a) |
| Points, levels, invite rewards and verification badges | Performance of our agreement with you, Art. 6(1)(b) |
| Preventing fraud, duplicate accounts and abuse; keeping the service secure | Our legitimate interests, Art. 6(1)(f) |
| Meeting legal obligations | Legal obligation, Art. 6(1)(c) |
5. Combined results: ownership and commercial use
All aggregated and anonymised datasets, statistics, indices, reports, analyses, visualisations and insights produced from CountUs (“Aggregated Data”), together with all database rights, copyright and other intellectual property in them, are owned exclusively by CEMRION.
We may use, publish, reproduce, license, sell, transfer or otherwise commercialise Aggregated Data, in any form and for any lawful purpose, without further notice or payment to you. Recipients may include the Government of Malta and its agencies, European Union institutions, media organisations, academic and research bodies, non governmental organisations, trade unions, employers' associations and commercial clients.
Aggregated Data does not identify you. Before any release we remove direct identifiers, report only totals and percentages, and suppress any group of fewer than 10 people, so that no individual can be singled out.
6. Who sees your personal data
We do not sell, rent or trade your personal data, and we never disclose your individual answers or profile to government authorities, employers, recruitment agencies or any other third party, except:
- Service providers who host and run CountUs for us under written data processing agreements: Supabase (database and login, hosted in the EU, Frankfurt), Netlify (website hosting), Twilio (sending WhatsApp or SMS verification codes) and our email delivery provider. They may use your data only on our instructions.
- Where we are required by law or by a binding order of a court or competent authority, and then only to the minimum extent required. Where the law allows, we will tell you first.
- To establish, exercise or defend legal claims.
- If CountUs is merged or sold, to the new owner, who must continue to protect your data under this policy.
7. International transfers
Your account data is stored in the European Union. Some providers (for example Twilio and Netlify) may process limited data in the United States. Where that happens we rely on the EU Commission's Standard Contractual Clauses or the EU US Data Privacy Framework, with additional safeguards where needed.
8. How long we keep it
- Account, profile and answers: until you delete your account, or after 24 months without signing in, when we delete them automatically.
- Phone fingerprint: until you delete your account.
- Technical logs: up to 90 days.
- Aggregated Data: indefinitely, because it no longer relates to you.
9. Security
Every table is protected by row level security, so you can only reach your own records. Emails are never shown in our back office, phone numbers are stored only as a peppered one way hash, all traffic is encrypted (HTTPS), and access to the back office is limited to named administrators. No system is perfectly secure, but if a breach affects you we will inform you and the regulator as the law requires.
10. Your rights
You have the right to: access your data; correct it (you can edit your profile yourself); delete it (use “Delete my account and answers”); restrict or object to processing; receive it in a portable format; and withdraw consent at any time, without affecting processing that already took place. Email privacy@countusmalta.com and we will reply within one month.
You can also complain to the Information and Data Protection Commissioner (IDPC), Malta's supervisory authority, at idpc.org.mt.
11. Age
CountUs is only for people aged 18 or over. We delete any account we learn belongs to someone younger.
12. Changes
We may update this policy. If a change materially affects how we use your personal data, we will tell you on the site before it applies and, where required, ask for your consent again.