Website Privacy Notice

This notice explains how Privacy Core Services Ltd processes personal data when people visit https://www.privacycoreservices.com, contact us, book a consultation, use an assessment or service finder, download resources, subscribe to updates, attend an event, apply to work with us, or otherwise interact with our website and business-development channels.

It applies where Privacy Core Services Ltd acts as the controller. Separate client engagement terms, data processing agreements or client-facing notices may apply when we provide professional services for a client or act as a processor, Data Protection Officer or representative on another organisation’s behalf.

Privacy Core Services Ltd has not designated a statutory Data Protection Officer for its own processing; the statutory appointment criteria in Article 37 GDPR do not apply to it. The privacy contact above is responsible for privacy matters relating to this website and our business-development processing.

• Identity and professional data, such as name, job title, employer, sector and country.
• Contact data, such as business email address, telephone number and correspondence details.
• Enquiry and engagement data, including the service requested, markets of interest, messages, meeting notes and proposal history.
• Assessment and service-finder data, including answers, result category, version, date and any optional contact details you choose to provide.
• Live chat and messaging data where you use our Amber digital assistant on this website or via WhatsApp, including your messages, the assistant's replies, session identifiers and delivery metadata.
• Resource and marketing data, such as downloads, newsletter choices, webinar registrations, unsubscribe records and campaign interactions.
• Technical and security data processed through the website and Vercel hosting, such as IP address, browser and device information, request details, timestamps and security or diagnostic logs. Google Analytics runs only after you consent via the cookie banner.
• Cookie or consent data only where a strictly necessary storage item or a future consent control is used. The only non-essential technology is consent-gated Google Analytics.
• Recruitment or partnership data where submitted, such as CV, experience, availability and communications.
• Data obtained from public business sources or introductions, such as corporate websites, professional profiles, registers and referral partners.

Please do not submit special-category data, criminal-offence data, passwords, full payment-card data or confidential client records through ordinary website forms. Use an approved secure channel where we expressly request sensitive material.

Marketing consent is separate from the act of submitting an enquiry or downloading a resource. Marketing choices are optional, unticked and specific. We maintain suppression records so that we can respect opt-outs. You can unsubscribe using the link in an email or contact us at any time.

The site uses one non-essential technology: Google Analytics, which loads only after you accept it via the cookie banner and can be switched off at any time through the “Cookie preferences” control in the footer. Everything else is strictly necessary. See the Cookie Policy and live register for details.

The Amber website chat sets one strictly necessary session cookie, only when you open the chat, so the conversation can continue across pages. It is not used for tracking or analytics.

• Authorised employees, consultants and group or associated service entities who need the data for their role.
• Vercel, which provides the website hosting and delivery infrastructure; Plausible Insights OÜ (EU) for cookieless aggregate analytics; OpenAI (response generation) and Supabase (conversation storage) for the Amber digital assistant, engaged as processors; and — only for visitors who consent — Google (Google Ireland Ltd) for analytics. Website forms and business follow-up are operated in-house by Privacy Core, with no separate CRM, scheduling embed or newsletter platform active on the website.
• Professional advisers, auditors, insurers, banks and prospective transaction counterparties where necessary.
• Regulators, supervisory authorities, courts, law-enforcement bodies and other recipients where required by law or necessary to protect rights.
• Service partners or local specialists where you request a jurisdiction-specific service and appropriate disclosure or contractual safeguards are in place.

Some providers or recipients may process data outside Malta, the European Economic Area or the United Kingdom. Where required, we use an applicable adequacy decision, approved standard contractual clauses, the UK International Data Transfer Agreement or Addendum, and supplementary technical or organisational measures.

Vercel operates global infrastructure and uses subprocessors. Where its processing involves an international transfer, the applicable safeguards are addressed through Vercel’s Data Processing Addendum and transfer provisions. Google Analytics transfers are covered by Google's EU transfer safeguards and apply only to consented measurement data.

The Amber digital assistant uses OpenAI as a processor to generate responses and Supabase to store conversation records; both are engaged under data processing agreements with applicable transfer safeguards. Chat contents are not used to train AI models.

Any website assessment or service finder is designed to provide a provisional result or route to relevant information. It does not provide legal advice and does not make a decision that produces legal or similarly significant effects about you. Where a result is uncertain, conflicting or high-risk, the tool routes the user to human review. Assessment answers are never sent to Google Analytics.

Amber, our digital assistant, answers questions using approved company information and clearly identifies itself as automated. It does not provide legal advice and does not make decisions producing legal or similarly significant effects. You can ask to speak to a person at any time, and WhatsApp users can opt out of automated replies by messaging STOP.

• Access to personal data and information about how it is used.
• Correction of inaccurate or incomplete data.
• Erasure in applicable circumstances.
• Restriction of processing in applicable circumstances.
• Objection to processing based on legitimate interests and objection at any time to direct marketing.
• Data portability where the legal conditions apply.
• Withdrawal of consent without affecting earlier lawful processing.
• Rights relating to qualifying solely automated decisions, where applicable.
• The right to lodge a complaint with a supervisory authority.

To exercise a right, contact privacy@privacycoreservices.com. We may need proportionate information to verify identity and clarify the request. We acknowledge rights requests within 3 business days and respond within one calendar month, extended only where the law permits and we have told you why.

Please raise concerns with us first so that we can investigate — see the Complaints Procedure. You may also complain to the Office of the Information and Data Protection Commissioner in Malta or, where applicable, another competent supervisory authority in the country where you live, work or believe an infringement occurred.

We apply technical and organisational measures intended to protect personal data, including access controls, secure transmission, logging, supplier controls, backups, vulnerability management and incident procedures appropriate to risk. No internet service can be guaranteed absolutely secure. Security vulnerabilities should be reported through the Responsible Disclosure Policy, not through a general contact form.

The website and services are intended for organisations and professional users and are not directed to children. Do not submit children’s data unless this has been specifically requested through a secure, appropriate channel for a legitimate professional engagement.

The website may link to external sites but does not automatically load third-party scheduling, social-media, map or video embeds. The map on the contact page loads Google Maps content only after you choose to display it. An external provider may process data as an independent controller once you follow a link or load its content. We will update this notice before introducing any further embedded third-party service.

We will publish material changes on this page and update the “last updated” date. Where a change significantly affects existing processing, we will provide additional notice where appropriate.