1. Who is responsible
Data controller
Charlie Autodealer is the controller for personal data processed through this website. The showroom address is Triq Dun Karm Psaila Birkirkara Bypass, Birkirkara BKR 01.
You can currently reach the business through the contact page or by telephone at 9949 4553.
2. Data we process
Information connected with your enquiry
Depending on how you contact us, the information may include:
- Your name, phone number and email address.
- Your preferred contact method and the content of your message.
- The vehicle, viewing, test-drive or part-exchange request connected with the enquiry.
- Any vehicle details or photographs you choose to provide for a part-exchange discussion.
- Basic technical and security information, such as IP address, browser details, timestamps and request logs, where produced by hosting or security services.
We do not ask you to send payment-card details, identity documents or sensitive personal data through a general website message.
3. How and why
Purposes and lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Answering questions, arranging a viewing or taking steps you request before a possible purchase. | Steps at your request before a contract, and legitimate interests in responding to customers. |
| Following up a part-exchange or vehicle-specific enquiry. | Steps at your request and legitimate interests in managing the enquiry. |
| Protecting the website, preventing abuse and diagnosing errors. | Legitimate interests in maintaining a secure and reliable service, and legal obligations where applicable. |
| Keeping records needed for disputes, accounting or legal compliance. | Legal obligation and legitimate interests in establishing or defending legal claims. |
We do not sell personal data. We do not currently use website enquiry data for advertising profiles or unrelated marketing.
4. Sharing and transfers
Service providers and external destinations
Personal data is shared only where needed for the purposes above, with appropriate providers or where the law requires it. These providers may include:
- Supabase for database, authentication and vehicle-media storage services.
- The website hosting provider for delivery, logs, backups and service security.
- Cloudflare Turnstile, if enabled, to assess form submissions for automated abuse.
- Professional advisers, insurers, public authorities or law enforcement where reasonably necessary or legally required.
WhatsApp and Google Maps
Google Maps is embedded on the contact page and may receive technical data, including your IP address, when the map loads. WhatsApp is only contacted when you choose its link. Those providers' own privacy terms and international-transfer safeguards apply. You can call us instead if you prefer not to use either service.
Where a provider processes data outside Malta or the European Economic Area, the transfer is handled under the provider's applicable GDPR transfer mechanism and safeguards.
5. Retention
How long information is kept
Online enquiry records held in the website system are retained for up to 180 days after submission, then deleted or anonymised unless a longer period is needed for an active transaction, a legal obligation, fraud prevention or the establishment, exercise or defence of legal claims.
The current WhatsApp handoff opens WhatsApp with a prepared message and does not save the message on this website. Messages you send through WhatsApp are retained under the business's communication practices and WhatsApp's own terms. Hosting and security logs may follow shorter provider-controlled schedules.
6. Security
Protecting information
Reasonable technical and organisational measures are used, including access controls, encrypted connections, restricted administration access and service monitoring. No internet service can promise absolute security.
7. Your rights
Your GDPR choices
Subject to the GDPR's conditions and exceptions, you may ask to:
- Access a copy of your personal data.
- Correct inaccurate or incomplete information.
- Erase information or restrict how it is used.
- Object to processing based on legitimate interests.
- Receive eligible information in a portable format.
- Withdraw consent where consent is the lawful basis, without affecting earlier lawful processing.
We may need to verify your identity before completing a request. You may also read about your rights on the Malta Information and Data Protection Commissioner website or file a complaint with the IDPC .
8. Children
Age considerations
This website is intended for people enquiring about vehicle purchases and is not directed at children. Please do not submit a child's personal data through an enquiry.
9. Changes
Updates to this notice
We may update this notice when the website, providers or legal requirements change. The version date at the top will be revised when material changes are published.
10. Contact
Questions or rights requests
Use the contact page or call 9949 4553. Please state that your message concerns privacy or a data-protection right.