Privacy Policy

I am, Malcolm Farrugia. I run this site as an individual and I am based in Malta, so it falls under the GDPR and Maltese data protection law. I am the data controller for everything described here. You can reach me at hello@malcolmfarrugia.com.

I use Google Analytics 4 to see how many people visit and which parts of the site get read. It does not load at all until you press Accept in the cookie banner. If you decline, or if you ignore the banner, no analytics script is loaded and no analytics cookies are set.

When it does run, Google Analytics collects the pages you view and when, the site or search that sent you here, your approximate location (roughly city level, worked out from your IP address), and basic device details such as browser, operating system, screen size, and language. It sets cookies (named _ga and _ga_*) so that repeat visits from the same browser can be recognised.

Google states that it does not log or store IP addresses in Google Analytics 4. The address is used to work out the approximate location and is then discarded. Google processes this data on my behalf and deletes the event level records once the retention period set on the property expires. Aggregated reports remain. I do not export the data anywhere else, and I never see anything that identifies you personally.

Legal basis: your consent, GDPR Article 6(1)(a). You can withdraw it at any time through Cookie settings at the bottom of any page. Withdrawing stops further measurement straight away and clears the analytics cookies from that browser.

The contact form sends your name, your email address, an optional subject, and your message. It posts to Web3Forms, a form to email service, which forwards the message to my inbox. There is no database behind the form and nothing is stored on this site.

Legal basis: your consent, given by choosing to send the message. I use what you send to reply to you and for nothing else. You will not be added to a mailing list, because there isn't one.

Retention: the message stays in my mailbox for as long as the conversation is useful and I delete it once it is not. Ask me to delete it sooner and I will.

The site is hosted by Vercel. As with any web host, Vercel processes the technical details of each request (IP address, browser user agent, the page requested, and the time) in order to serve the pages and protect the site from abuse. This happens for every visitor, including those who decline analytics, because the site cannot be delivered otherwise.

Legal basis: my legitimate interest in running the site and keeping it secure, GDPR Article 6(1)(f).

The only cookies this site sets are the Google Analytics ones described above, and only once you have accepted.

Your choice itself is not a cookie. It is kept in your browser's local storage under the key mf-consent, with the value accepted or declined. It stays on your device, it is never sent to me or to anyone else, and it is what stops the banner from asking again. Clear your browser storage for this site and the banner will ask afresh.

• No advertising, ad networks, or retargeting pixels.
• No profiling and no automated decisions about you.
• No selling or sharing of data beyond the three services named below.
• No accounts, no logins, no newsletter.
• No social media widgets or embedded third party content.
• Fonts and images are served from this site, so no request goes to Google Fonts or an outside asset CDN while you browse. The only third party script is the analytics one above, and only if you accept.

• Google, for Google Analytics, and only after you accept.
• Web3Forms, which delivers contact form messages to my inbox.
• Vercel, which hosts the site and serves it from its network.

Google and Vercel are United States companies, so data they handle may be processed outside the EU and EEA. The transfer safeguards they rely on are set out in their own policies, linked above.

Under the GDPR you can ask me to:

• confirm what data I hold about you and give you a copy,
• correct anything that is wrong,
• delete it,
• restrict how it is used, or object to that use,
• hand it over in a portable format,
• and withdraw your consent to analytics at any time.

Email hello@malcolmfarrugia.com and I will sort it out, within one month at the latest, as the regulation requires. There is no charge. In practice the only data I am likely to hold is an email conversation, since the analytics side is anonymous to me.

If you think I have got something wrong, you can complain to the Maltese supervisory authority, the Office of the Information and Data Protection Commissioner, at idpc.org.mt.

If what the site does changes, I will update this page and change the date at the top. There is no version history here, so what you are reading is the current version.