van Cutsem Wittamer Marnef & Partners​ About us

Privacy / Disclaimer

Last updated: 13th July 2026

Introduction

This Data Privacy Policy (the “Policy”) relates to the services provided by the following companies:

Zerafa Advocates is a law firm duly registered in accordance with Article 88A of the Code of Organisation and Civil Procedure, Chapter 12 of the Laws of Malta.

Zerafa Trustees Ltd. is a private limited company incorporated under the laws of Malta with Company Registration Number C 97921, having its registered address at 23, South Street, Valletta, VLT 1102, Malta.

Zerafa.io Ltd. is a private limited liability company incorporated under the laws of Malta with Company Registration Number C 888830, and having its registered address at 23, South Street, Valletta, VLT 1102, Malta.

All three entities shall collectively be referred to as the “Firm”.

Purpose

The Firm operates the website www.zerafa.com.mt (the “Website”) and is the sole person which determines the purposes and means of the processing of all data gathered (the “Data Controller”) for the Website. The Firm is committed to protecting the privacy of individuals who visit the Website and who make use of services offered by the Firm (the “Services”).

For the purposes of the Policy, “Personal Data” shall refer to any information relating to the Website user (“you” or the “User”) as an identified or identifiable natural person, which may include, but is not limited to, your email address, name, and phone number. Personal Data does not include data from which you can no longer be identified, such as anonymised aggregate data.

Additionally, the Firm may also collect non-personal data. “Non-Personal Data” means statistical and other analytical information collected on an aggregate basis of all visitors to the Website. This Non-Personal Data comprises information that cannot be used to identify or contact you, such as demographic information regarding, for example, user Internet Protocol (“IP”) addresses where they have been clipped or anonymised, browser types and other anonymous statistical data involving the use of the Website.

This Policy defines the rights and obligations and other essential provisions relating to the collection, processing, handling and storing of personal data when using the Website.

Scope

This Policy applies to all related undertakings and employees of the Firm, and to third parties who conduct processing of Personal Data through the Firm and its Website.​

The aim of this Policy is to inform the Firm’s clients of the policies regarding the collection, use, and disclosure of Personal Data in connection with your relationship with the Firm as the Firm’s clients, acting for a client, or being generally interested in the Services, including this Website, in terms of the European Union’s (the “EU”) Data Protection Act, Chapter 586 of the Laws of Malta, and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”).

General

The Firm will not use or share your information with anyone except as described in this Policy.

​For queries or more information on this Policy you are kindly requested to contact the Firm’s Data Protection Officer.

Contact details of the Data Protection Officer (“DPO”) of the Firm:

Name: Dr Omar Zerafa

Firm Address: 23, South Street, Valletta, VLT 1102

E-mail address: [email protected]

The Firm shall use your Personal Data for providing and improving its Services. By using the Services and the Website, you agree to the collection and use of data in accordance with this Data Privacy Policy. 

Data Collection and Use

While using the Services or browsing the Website, you may be asked to provide Personal Data that can be used to contact or identify you.

The Firm is committed to collecting, processing, handling, and storing your Personal Data in accordance with the principles laid down in the GDPR. In this regard, your Personal Data will be:

  1. Processed lawfully, fairly, and in a transparent manner;
  2. Collected for specified, explicit, and legitimate purposes;
  3. Not further processed in a manner that is incompatible with those purposes, unless it is for archiving purposes in the public interest;
  4. Not kept longer than necessary for the achievement of those purposes, unless for the public interest;
  5. Adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed;
  6. Accurate and kept up to date, taking every reasonable step to ensure that any inaccurate Personal Data is erased or rectified without delay;
  7. Processed in a manner that ensures appropriate security and confidentiality

Subject to the Consent and the Rights of Data Subjects

The collection, processing, handling, and storing of your Personal Data will always be subject to the consent and all the rights you are entitled to, as outlined in subsequent sections, including the necessary minimum information which must be communicated to you. You may, at all times, subject to certain exemptions, withdraw your consent or request the erasure or rectification of your Personal Data. In such cases, the Firm shall irrevocably destroy or rectify your Personal Data.

The Firm will collect, process, handle or store your Personal Data only if:

  1. You have given consent to the processing of your personal data for one or more specific purposes;
  2. It is necessary for the performance of a contract or prior to the entering into a contract to which you are a party;
  3. It is necessary for the Firm’s compliance with a legal obligation;
  4. It is necessary in order to protect your vital interests or the vital interests of another natural person;
  5. It is necessary for the performance of a task carried out in the public interest;
  6. It is necessary for the purposes of the Firm’s legitimate interests, except where such interests are overridden by your interests or your fundamental rights and freedoms which require protection of your Personal Data.

Storage of Personal Data

The Firm is committed to storing your Personal Data in the most secure manner using effective and modern software which shall be kept up to date. The storage of your Personal Data shall be made in accordance with the principles and procedures applicable to the processing of Personal Data, laid down in the previous section of this Policy. This Policy requires that your Personal Data is kept confidential by limiting the access to your Personal Data to you or to persons who actually require such access for legitimate reasons and with the appropriate security measures in place to avoid unauthorised access, use or sharing of your Personal Data. The Firm shall have in place all necessary procedures to ensure that any erasure of your Personal Data is done safely and securely with no possibility of recovery of such data. The Firm shall also implement back-up and disaster recovery solutions for unintentional loss of your Personal Data.

The security of your Personal Data is important to the Firm; however, it cannot be guarantee that any method of transmission over the Internet or method of electronic storage is completely secure. While the Firm strives to use commercially acceptable means to protect your Personal Data, the Firm cannot guarantee its absolute security.

Data Minimisation

The Firm is committed to processing and storing your Personal Data only as long as such storage is required and for legitimate purposes. Therefore, this Policy requires the erasure, within reasonable time, of your Personal Data which is no longer required or the purpose for which data was stored is no longer relevant.

Data Processing

The Firm will collect your Personal Data when you:

  1. Access the Website;
  2. Post a query or complaint through the Website;
  3. Request the Firm’s service;
  4. Apply for an opportunity with the Firm; and
  5. Engage the Firm to provide the Services.

This list is not exhaustive and the Firm may also collect your Personal Data in connection with other interactions or activities where it is necessary for the Firm to do so in accordance with applicable laws and legitimate business purposes.

Compliance with Laws

The Firm may require your Personal Data in order for to remain compliant with any applicable law or regulation, or to satisfy a legal or statutory obligation. The Firm will disclose your Personal Data with any of its employees or any other person deemed fit where required to do so by law or by court order or if the Firm believes that such action is necessary to comply with the law and the reasonable requests of law enforcement or to protect the security or integrity of the Services. The Personal Data which may be processed in this regard includes, but is not limited to, your name, address, identification number, date of birth, country of birth, email address, and phone number.

Communications

The Firm may use your Personal Data to contact you with newsletters, marketing or promotional materials, and other information that may be of interest to you. You may opt out of receiving any, or all, of these communications by following the unsubscribe link or instructions provided in any email sent.

Log Data

The Firm collects information that your browser sends whenever you visit the Website (“Log Data”). This Log Data may include information such as your computer’s IP address, browser type, browser version, the pages of the Website that you visit, the time and date of your visit, the time spent on those pages, and other statistics.

Cookies

Cookies are files with small amount of data which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your computer’s hard drive.

​The Website uses cookies to collect information, monitor site performance and deliver targeted advertising. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some sections of the Website.

Service Providers

The Firm may employ third party companies and individuals to facilitate in providing the Services, to provide services on the Firm’s behalf, to perform related services, or to assist in analysing how the services are being used.

​These third parties have access to your Personal Data only to perform these tasks on the Firm’s behalf and are obliged not to disclose or use it for any other purpose.

International Transfer

Your Personal Data may be transferred to, and maintained on, computers located outside of your country where the data protection laws may differ than those from your jurisdiction.

​If you are located outside Malta and choose to provide information to the Firm, please note that all information, including Personal Data, is transferred to and processed in Malta.

Your consent to this Policy followed by your submission of such information represents your agreement to that transfer.

Notification of Breach

In the case that the security or confidentiality of your Personal Data is breached, the Firm shall inform the competent supervisory authorities within 72 hours of such breach, and shall also inform you without undue delay of such breach. Notification of a breach will only be sent to you where it is deemed to constitute a high risk to your rights and freedoms. In notifying you of such breach, the Firm shall communicate in plain language:

  1. The name and contact details of the Data Protection Officer or other contact point where more information can be obtained;
  2. The likely consequences of the breach;
  3. The measures taken or proposed to be taken to address and mitigate the effects of the breach.

Rights of Data Subjects

The Firm is committed, to the best of its abilities, to allow you to exercise your rights in relation to your Personal Data held by it. The Firm is committed to respect and act upon any exercise of such rights.

Right to Information

You are entitled to certain minimum information when your Personal Data is collected. Throughout this Policy, the Firm is providing you with such information, which includes the following:

  1. The Firm’s identity and contact details or of its representative;
  2. The contact details of the Data Protection Officer;
  3. The purposes and legal basis of the processing of your Personal Data;
  4. The legitimate interests pursued by the Firm for the processing of your Personal Data;
  5. The recipients of your Personal Data;
  6. Where your Personal Data is not collected directly from you, information as to the source of your Personal Data; and
  7. The fact that the Firm may transfer your Personal Data to a third country or international organisation and that appropriate safeguards are in place.

This Policy is also providing you with the following information:

  1. The period for which your Personal Data will be stored, or the criteria used to determine that period;
  2. Information on the rights to which you are entitled;
  3. The fact that the provision of your Personal Data is both a statutory and contractual requirement, and instances where you are obliged or not obliged to provide your Personal Data and the possible consequences of failure to provide such data; and
  4. The existence of automated decision-making, including profiling, and information on the logic involved, and the significance and the envisaged consequences of such processing of your Personal Data.

Right of Access

This Policy requires the Firm to allow you to exercise your right in requesting a confirmation as to whether your Personal Data is being processed and the right to access your Personal Data. You are also entitled to access the information on your Personal Data mentioned in the previous sub-section.

Right to be Forgotten and Rectification

You shall have the right to obtain from the Firm without undue delay the rectification of inaccurate Personal Data concerning you. Taking into account the purposes of the processing, you shall have the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.

You may also ask to destroy any or all of your Personal Data held by the Firm. When such request is made, the Firm is obliged to destroy your Personal Data in an irrecoverable manner and without undue delay if one of the following grounds applies:

  1. Your Personal Data is no longer necessary in relation to the purposes for which it was collected or processed;
  2. You withdraw your consent on which the processing is based and where there is no other legal ground for the processing;
  3. You object to the processing and there are no overriding legitimate grounds for the processing;
  4. Your Personal Data has been unlawfully processed;
  5. Your Personal Data has to be erased for compliance with a legal obligation in the EU or under Maltese Law; and
  6. Your Personal Data has been collected in relation to the offer of information society services.

This right to erase your Personal Data shall not be granted if the processing of your Personal Data is necessary for:

  1. Exercising the right of freedom of expression and information;
  2. Compliance with a legal obligation which requires processing by the EU or Malta, or for the performance of a task carried out in the public interest;
  3. Reasons of public interest in the area of public health;
  4. Archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes as long as erasure of your Personal Data is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
  5. The establishment, exercise or defence of legal claims.

Right to Restrict Processing

This Policy also commits the Firm to allow you to exercise your right to restrict from processing your Personal Data when one of the following applies:

​The accuracy of your Personal Data is contested by you, for a period enabling the Firm to verify the accuracy of your Personal Data;

  1. The processing is unlawful, and you oppose the erasure of your Personal Data and you request the restriction of its use instead;
  2. The Firm no longer needs your Personal Data for the purposes of the processing, but your Personal Data is required by you for the establishment, exercise, or defence of legal claims;
  3. You have objected to processing of your Personal Data, for the period pending verification whether the Firm has legitimate grounds which override your fundamental rights and freedoms.

Where processing has so been restricted, your Personal Data shall, with the exception of storage, only be processed:

  1. With your consent;
  2. For the establishment, exercise, or defence of legal claims;
  3. For the protection of the rights of another natural or legal person; or
  4. For reasons of important public interest of the EU or one of its member states.

Apart from restricting processing, you shall also have the right to object, at any time, to processing of your Personal Data when the processing of your Personal Data is required for the performance of a task carried out in the public interest or for the purposes of the Firm’s legitimate interest. In such case, the Firm may continue to process your Personal Data only if it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims. If you object to the processing of your Personal Data for direct marketing purposes, the Firm shall cease the processing.

Right to Data Portability

You may also request to receive your Personal Data from the Firm in a structured, commonly used and machine-readable format. You may also request such Personal Data to be transmitted to another controller without any hindrance from the Firm where:

  1. The processing is based on a consent or on a contract; and
  2. The processing is carried out by automated means.

Links to Other Sites

The Website may contain links to other sites that are not operated by the Firm. If you click on a third-party link, you will be directed to that third party’s site. When connecting to such other websites you will no longer be subject to this Policy but to the privacy policy of the new site. It is therefore strongly advised that you review the privacy policy of every site you visit.

​The Firm has no control over, and assumes no responsibility for, the content, privacy policies, or practices of any third-party sites or services.

Fees

The Firm will in general not charge for any reasonable exercise of your individual rights mentioned in this Policy. However, a reasonable fee may be charged if your request to exercise your individual rights is manifestly unfounded or excessive. Alternatively, the Firm may refuse to comply with the request in such circumstances.

Review of this Policy

The Firm may update this Policy from time to time and any changes made to the Policy will be posted on this page. It is therefore in your interest to review this Policy periodically to remain informed of any updates. Changes to this Policy are effective when they are posted on this page. Your continued use of the Website and the Services shall constitute the tacit agreement to any changes made to the Policy.

Contact Us

If you have any questions about this Policy, please contact [email protected] Any comments or suggestions you may have which may contribute to a better quality of service will be welcome and greatly appreciated.