This policy explains what personal data WhizzFix collects, why, who we share it with and what rights you have. It is written for a small service business in Malta and follows the EU General Data Protection Regulation (GDPR) and the Maltese Data Protection Act, Chapter 586 of the Laws of Malta.
1. Who is responsible for your data
The data controller is JMT Holdings Limited (C99143), trading as WhizzFix, 88 Triq Birkirkara, San Ġiljan STJ 1850, Malta. Email info@whizzfix.com, phone +356 9923 1611.
2. What we collect
When you contact us or book a service. Your name, phone number, email address, the address for pickup or delivery, and the content of your messages to us by WhatsApp, phone, email or our booking system at book.whizzfix.com.
When you book luggage storage and delivery. In addition to the above: - a photo of the personal details page of your passport or identity card (you may cover the document number); - your flight booking confirmation or boarding pass, and your flight numbers and dates; - the name and phone number of any Recipient you ask us to release your luggage to; - your signed booking form and declaration, with the date, time and IP address of signature; - photographs, weights, seal numbers and luggage codes of each item, and a record of every handover, storage movement and delivery.
About your items. A description of each item, its condition, any defects you tell us about, and photographs we take before and after work for quality control and as a record of the item's condition.
When you pay. For card payments at the counter or on our self-service machines, the payment is handled by the card terminal provider. Online payments on book.whizzfix.com are handled by Stripe. We see the amount, the date and the last digits of the card, never the full card number. Cash payments are recorded in our books.
When you visit our premises. CCTV images from cameras covering our premises, including the luggage storage area.
When you use this website. Your IP address, device and browser type, the pages you visit and how you got here. This comes from cookies and similar technologies, explained in section 6.
When you join our mailing list. Your email address and the date you signed up. Entering our monthly prize draw also records that you entered.
We do not ask for and do not want any special category data, such as health information. If you tell us something like that in a message, we will use it only if it is needed to handle your item safely.
3. Why we use it and our legal basis
| Purpose | Legal basis |
|---|---|
| Giving quotes, booking, doing the work, arranging pickup and delivery, and telling you when your item is ready | Performance of a contract with you |
| Providing luggage storage and delivery, including scheduling airport meetings from your flight details | Performance of a contract with you |
| Checking your identity documents before confirming a luggage booking and at handover, to prevent fraud and make sure luggage is released only to the right person | Performance of a contract with you and our legitimate interest in security and fraud prevention |
| Keeping your signed luggage declaration and custody records | Performance of a contract and our legitimate interest in establishing and defending legal claims |
| Keeping records of jobs, prices and payments | Legal obligation under Maltese tax and accounting law |
| Photographs of items before and after work, and of luggage at handover and delivery | Legitimate interest in recording the condition of items and resolving any dispute |
| CCTV at our premises | Legitimate interest in protecting customers' items, our staff and our premises |
| Answering questions and handling complaints | Legitimate interest in running our business and looking after customers |
| Sending our newsletter and offers | Your consent, which you can withdraw at any time using the unsubscribe link |
| Using before-and-after photos in our marketing | Your consent, asked for separately |
| Analytics and advertising cookies | Your consent, given through the cookie banner |
| Keeping our website, booking system and premises secure and preventing fraud | Legitimate interest |
| Reporting to authorities where the law requires, including concerns about prohibited items in luggage | Legal obligation |
We never use identity documents, flight details or luggage photographs for marketing.
4. Who we share it with
We share personal data only with providers who help us run the business, and only what they need.
- Vercel, which hosts this website. Vercel processes data in the United States and the European Union.
- Supabase, which hosts the database and file storage for our booking system and our mailing list, including luggage booking records and identity documents, in the European Union.
- Lovable, which hosts the booking system at book.whizzfix.com.
- Meta Platforms, because we communicate with customers on WhatsApp, and because we advertise on Facebook and Instagram.
- Google, for Google Analytics, Google Ads and Google Maps.
- Card terminal and online payment providers, including Stripe, for card payments.
- Our accountants and, where the law requires, the Maltese tax authorities, the police or other public bodies.
- Delivery staff, who see your name, address and phone number for pickup and delivery, and for luggage also your flight details, the Recipient's name and phone number, and your luggage codes and seal numbers. Drivers do not have access to stored identity documents.
We do not sell personal data, and we do not share it with anyone else for their own marketing.
5. Transfers outside the European Economic Area
Identity documents and luggage booking records are stored in the European Union. Some of our other providers, including Vercel, Meta and Google, process data in the United States and other countries outside the EEA. Where they do, the transfer is covered by the EU-US Data Privacy Framework or by the European Commission's Standard Contractual Clauses. You can ask us for details of the safeguard that applies.
6. Cookies
When you first visit this website or our booking system you will see a cookie banner. Essential cookies, which make the site work, are always on. Analytics cookies, which help us see how the site is used, and marketing cookies, which help us measure and show advertising, run only if you accept them. You can change your choice at any time using the "Manage" link in the banner or the cookie settings link in the footer, and by clearing cookies in your browser.
7. How long we keep it
- Job records, quotes, invoices, luggage booking records and signed luggage declarations: for as long as Maltese tax and accounting law requires, currently up to ten years.
- Passport or identity card images and flight confirmations: deleted 30 days after your luggage booking is completed, unless a claim or investigation is open, in which case until it is resolved.
- Luggage photographs, weights, seal numbers and custody records: 90 days after your booking is completed, unless a claim is open.
- Photographs of items for cleaning, repair and restoration: 12 months after the job is finished, unless you have agreed to their use in our marketing, in which case until you withdraw that consent.
- CCTV images: 30 days, unless needed for an incident or claim.
- Messages on WhatsApp and email: up to 2 years after our last contact, so we can refer back to what was agreed.
- Mailing list: until you unsubscribe.
- Website analytics: as set by Google Analytics, currently 14 months.
Data deleted from our booking system may remain in encrypted backups for up to 90 days before those backups are overwritten. Backups are not used for any other purpose.
8. Your rights
You have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw any consent you have given. Write to info@whizzfix.com and we will respond within one month. We may ask you to confirm your identity first. We may need to keep some data after a deletion request where the law requires it or to deal with a claim.
If you are not happy with how we handle your data, you can complain to the Information and Data Protection Commissioner, Floor 2, Airways House, Triq il-Kbira, Tas-Sliema SLM 1549, Malta, idpc.org.mt.
9. Children
Our services and website are intended for adults. We do not knowingly collect data from anyone under 16. Luggage bookings must be made by an adult. If you believe a child has given us their data, contact us and we will delete it.
10. Security
Our website is hosted by Vercel, which encrypts data in transit and at rest. Our booking system encrypts data in transit and at rest. Identity documents are kept in private storage that is not publicly accessible, can be opened only by named staff through time-limited links, and every access is logged. Staff use individual accounts with two-step login. Access to customer records is limited to staff who need it. No system is completely secure, so please upload identity documents only through book.whizzfix.com or the secure booking link we send you, and do not send them, card details or other sensitive information by WhatsApp or email. If you do, we will move them to the booking system and delete the message.
11. Changes to this policy
We will post any changes here and update the date at the top. If a change is significant, we will tell mailing list subscribers by email.
12. Contact
JMT Holdings Limited (C99143), trading as WhizzFix, 88 Triq Birkirkara, San Ġiljan STJ 1850, Malta. Email info@whizzfix.com. Phone and WhatsApp +356 9923 1611.