Privacy
Your profile and your account.
What MJMDA keep when you send an Online Profiler profile or hold a client account on this site, why, for how long, and who else handles it. MJMDA’s website at mjmda.eu has its own policy.
Last updated 19 September 2026.
Who is responsible
- Controller
- Matthew James Mercieca Design Architects (MJMDA)
- Address
- 125, Naxxar Road, Birkirkara, BKR9047, Malta
- Contact
- matjam@mjmda.eu
What is collected
When you send a profile
- Your first and last name, email address and telephone number.
- Your answers about the project: its type and location, what you want to achieve, its size and budget, the spaces involved, the style, technology and sustainability, the services you need, when you are available, how you heard of MJMDA, and anything else you write.
- Any files you attach: project documents and images of what you like, as PDF, JPG or PNG.
- The reference the profile is given, and the date it was sent.
When you hold an account
- Your name, email address and telephone number, and the profiles saved to the account.
- The record MJMDA keep of you as a client, which your account page shows in full and lets you change: your title, postal address, another email address and telephone number, your identity card or passport number where you give one, and your company’s VAT and registration numbers if the account is a company’s.
- Your password, which is never stored in a form anyone can read, MJMDA included. You choose it yourself from the confirmation email.
- When the account was created and when it was last signed in to.
If you used MJMDA’s previous client portal
- If you signed in to the previous client portal within the last three years, your account was carried over to this site: your name, email address and telephone number, and the dates you accepted that portal’s terms, confirmed your email address and last signed in.
- MJMDA also keep, in their own staff system, the record they already held about you on that system: your postal address, telephone and fax numbers, any second email address, your company’s name, VAT and registration numbers where you gave them, and, where they held one, your identity card or passport number. When an account is created for that email address and the address is confirmed, that record becomes your record in the new system, so nothing you gave MJMDA before has to be given again. It happens once, when the account is made; signing in afterwards needs nothing but your email address and your password, and stores nothing new.
- If the email address belonged to more than one record on the old system, nothing is carried across until one of MJMDA’s administrators says which record is yours.
- Identity card and passport numbers are readable only by MJMDA’s administrators, and by no one else in the practice. You can always see and change your own on your account page, and clearing a field there removes it.
- Your password was not carried over, and nothing sent through the previous portal was either. You choose a new password the first time, with “Forgotten your password?” on the sign-in page. If you would rather not keep the account, delete it from your account page or write to matjam@mjmda.eu.
To keep the site safe
- When you send a profile, create an account or ask for a password email, Cloudflare Turnstile checks that a person rather than an automated program is doing it.
- So that the forms cannot be flooded, each request is counted against a one-way code made from your connection’s IP address, never the address itself, and the counts are deleted within two days.
Why
- To reply to your enquiry and prepare to work with you, which you ask for by sending a profile.
- To provide the account you asked for, or to keep the one you held on MJMDA’s previous client portal.
- To keep the record MJMDA already held about you as their client, so that work already under way carries on and details you have given once do not have to be given again.
- To protect the site, and the people who use it, from abuse. This is MJMDA’s legitimate interest.
No decision about you is made automatically. Your details are not sold, not used for advertising and not added to a mailing list.
Who sees it
MJMDA are emailed when a profile arrives, with the names of any files sent with it, and read it in their own staff system. Only MJMDA’s administrators can open the files, and only they can read an identity card or passport number carried over from the previous system. If you hold an account, you can read the profiles saved to it and see the names of the files you sent.
What stays in your browser
- Your answers are kept in this browser while you work on a profile, and nothing is sent until you press send. They are removed when you send the profile or choose Start again, or when you clear this browser’s data. Files you choose are held only by the open page until they are sent.
- After sending, the details the account step needs are kept in that browser tab, and go when it closes or once they have been used.
- A one-time code that lets you save a sent profile to an account is kept in this browser. It holds no personal details and stops working after 24 hours.
- If you sign in, your session is kept in this browser until you sign out.
This site sets no cookies of its own, and nothing here is used for advertising, analytics or tracking.
Who else processes it
- Supabase, Inc.
- The database, sign-in and file storage, located in the EU (Ireland). Supabase is a US-incorporated company, so access from outside the EU is possible under its data processing agreement.
- Cloudflare, Inc.
- Hosts and delivers this site and runs the Turnstile security check. Cloudflare is a US-incorporated company and processes data under its data processing agreement.
- Resend, Inc.
- Sends this site’s emails: account confirmation and password emails, and the notice of each profile to MJMDA. It sends from its EU (Ireland) region; Resend is a US-incorporated company and processes data under its data processing agreement.
- HubSpot, Inc.
- MJMDA’s customer records. When MJMDA take on your enquiry, your name, email, phone and your profile’s answers are copied into MJMDA’s HubSpot account. HubSpot is a US-incorporated company and processes data under its data processing agreement.
- Microsoft
- MJMDA’s email runs on Microsoft 365, so the notice of each profile is received there.
How long
- A profile, and any files sent with it, is kept for 24 months after it is sent and then deleted automatically.
- A profile saved to an account is kept for as long as the account exists. If you delete the account, your profiles stay with MJMDA as enquiries for the rest of their 24 months and are then deleted.
- Your account is kept until you delete it.
- A file that does not finish uploading is deleted within a day.
- The email notice MJMDA receive stays in their mailbox, apart from this site.
Your rights
You can ask for a copy of what is held about you, have it corrected or deleted, object to its use, ask for its use to be restricted, or ask for it in a form you can take elsewhere. You can delete your account yourself from your account page. To have a profile deleted sooner, or for anything else, write to matjam@mjmda.eu.
If you are not satisfied with the answer, you can complain to Malta’s Information and Data Protection Commissioner at idpc.org.mt.
Changes
This notice describes the site as it stands. When what is collected changes, this page changes before it does.
