Your profile and your account.
What MJMDA keep when you send an Online Profiler profile or hold a client account on this site, why, for how long, and who else handles it. MJMDA’s website at mjmda.eu has its own policy.
Last updated 22 October 2026.
Who is responsible
- Controller
- Matthew James Mercieca Design Architects (MJMDA)
- Address
- 125, Naxxar Road, Birkirkara, BKR9047, Malta
- Contact
- matjam@mjmda.eu
What is collected
When you send a profile
- Your first and last name, email address and telephone number.
- Your answers about the project: its type and location, what you want to achieve, its size and budget, the spaces involved, the style, technology and sustainability, the services you need, when you are available, how you heard of MJMDA, and anything else you write.
- Any files you attach: project documents and images of what you like, as PDF, JPG or PNG.
- The reference the profile is given, and the date it was sent.
- If the profile is changed later, from your account or by MJMDA, the date of the change and the answers it held before.
When you hold an account
- Your name, email address and telephone number, and the profiles saved to the account.
- The record MJMDA keep of you as a client, which your account page shows in full and lets you change: your title, postal address, another email address and telephone number, your identity card or passport number where you give one, and your company’s VAT and registration numbers if the account is a company’s.
- Your password, which is never stored in a form anyone can read, MJMDA included. You choose it yourself from the confirmation email.
- When the account was created and when it was last signed in to.
- If you work on a profile while signed in, your answers as you give them, saved to the account so you can carry on from any device you sign in on. They are kept there until you send the profile or discard it, and with them the step you reached and when you last changed them.
- Whether you want reminder emails about a profile you have left unfinished in the account. They are on unless you turn them off on your account page.
If you used MJMDA’s previous client portal
- If you signed in to the previous client portal within the last three years, your account was carried over to this site: your name, email address and telephone number, and the dates you accepted that portal’s terms, confirmed your email address and last signed in.
- MJMDA also keep, in their own staff system, the record they already held about you on that system: your postal address, telephone and fax numbers, any second email address, your company’s name, VAT and registration numbers where you gave them, and, where they held one, your identity card or passport number. When an account is created for that email address and the address is confirmed, that record becomes your record in the new system, so nothing you gave MJMDA before has to be given again. It happens once, when the account is made; signing in afterwards needs nothing but your email address and your password, and stores nothing new.
- If the email address belonged to more than one record on the old system, nothing is carried across until one of MJMDA’s administrators says which record is yours.
- Identity card and passport numbers are readable only by MJMDA’s administrators, and by no one else in the practice. You can always see and change your own on your account page, and clearing a field there removes it.
- Your password was not carried over, and nothing sent through the previous portal was either. You choose a new password the first time, with “Forgotten your password?” on the sign-in page. If you would rather not keep the account, delete it from your account page or write to matjam@mjmda.eu.
If MJMDA give you the Value Sweet Spot
- MJMDA can add the Value Sweet Spot to your account. It is available only to account holders they have given it to, and they can remove it again.
- What you enter in it is saved to your account as you work: your priorities, the opportunities you compare, their figures, your answers and assumptions, any photographs you add to them, and any preference you record. Only you can read this; MJMDA cannot.
- When you choose Send to MJMDA, a dated copy of your work as it stands, with the results it shows, is sent to MJMDA. Their administrators read it; nobody else at MJMDA can. A copy cannot be changed once it is sent.
- Documents you read into it are read in your browser and are never uploaded, saved to your account or sent to MJMDA.
To keep the site safe
- When you send a profile, create an account or ask for a password email, Cloudflare Turnstile checks that a person rather than an automated program is doing it.
- So that the forms cannot be flooded, each request is counted against a one-way code made from your connection’s IP address, never the address itself, and the counts are deleted within two days.
How far people get through the Online Profiler
- Each step of the Online Profiler you reach for the first time is added to a count for the day, with whether you were signed in. The count holds no answer, no address and nothing that identifies you, your browser or your device, so MJMDA can see how many people reach each step and never who.
Why
- To reply to your enquiry and prepare to work with you, which you ask for by sending a profile.
- To provide the account you asked for, or to keep the one you held on MJMDA’s previous client portal.
- To provide the Value Sweet Spot, if MJMDA have given it to you, and to let MJMDA read what you choose to send them from it.
- To keep the record MJMDA already held about you as their client, so that work already under way carries on and details you have given once do not have to be given again.
- To protect the site, and the people who use it, from abuse. This is MJMDA’s legitimate interest.
No decision about you is made automatically. Your details are not sold, not used for advertising and not added to a mailing list.
Who sees it
MJMDA are emailed when a profile arrives, with the names of any files sent with it, and read it in their own staff system. There, MJMDA’s administrators, their senior staff (team leaders) and their sales and marketing team can read the whole profile, your contact details and the files sent with it, and the sales and marketing team can copy your enquiry into MJMDA’s HubSpot account, described below, to follow it up. The rest of MJMDA’s team can read your name and your answers about the project, but not your email address, your telephone number, your other contact answers or your files. Only MJMDA’s administrators can read an identity card or passport number carried over from the previous system. If you hold an account, you can read the profiles saved to it, change their answers, and see the names of the files you sent. MJMDA’s administrators can correct a profile too, and their team leaders can correct your name, contact details, project type and locality; only administrators can delete one. They can also see that a profile is in progress in an account, how far it has got and when it last changed, so that they can help if you need it.
What stays in your browser
- Your answers are kept in this browser while you work on a profile. Signed out, nothing you answer is sent until you press send; signed in, your answers are also saved to your account as you go. They are removed from this browser when you send the profile, choose Start again or sign out, or when you clear this browser’s data, and they are shown only to the account they were saved to. Files you choose are held only by the open page until they are sent.
- After sending, the details the account step needs are kept in that browser tab, and go when it closes or once they have been used.
- A one-time code that lets you save a sent profile to an account is kept in this browser. It holds no personal details and stops working after 24 hours.
- If you sign in, your session is kept in this browser until you sign out.
This site sets no cookies of its own, and nothing here is used for advertising or to follow you from page to page or site to site. The only counting is the daily total of Profiler steps described above.
Who else processes it
- Supabase, Inc.
- The database, sign-in and file storage, located in the EU (Ireland). Supabase is a US-incorporated company, so access from outside the EU is possible under its data processing agreement.
- Cloudflare, Inc.
- Hosts and delivers this site and runs the Turnstile security check. Cloudflare is a US-incorporated company and processes data under its data processing agreement.
- Resend, Inc.
- Sends this site’s emails: account confirmation and password emails, reminders about a profile left unfinished in an account, and the notice of each profile to MJMDA. It sends from its EU (Ireland) region; Resend is a US-incorporated company and processes data under its data processing agreement.
- HubSpot, Inc.
- MJMDA’s customer records. When MJMDA take on your enquiry, your name, email, phone and your profile’s answers are copied into MJMDA’s HubSpot account. HubSpot is a US-incorporated company and processes data under its data processing agreement.
- Microsoft
- MJMDA’s email runs on Microsoft 365, so the notice of each profile is received there.
How long
- A profile, and any files sent with it, is kept for 24 months after it is sent and then deleted automatically. The answers it held before a change are kept with it and deleted with it.
- A profile saved to an account is kept for as long as the account exists. If you delete the account, your profiles stay with MJMDA as enquiries for the rest of their 24 months and are then deleted.
- An unfinished profile saved to an account is kept until you send it, discard it, or delete the account. You are emailed about it at most twice, a few days and then about ten days after you last changed it, unless you have turned reminders off.
- Your account is kept until you delete it.
- Your work in the Value Sweet Spot is kept until you start again or delete your account. If MJMDA remove the Value Sweet Spot from your account, your work is kept and comes back if they give it to you again.
- What you send to MJMDA from the Value Sweet Spot follows the same rule as a profile: it is kept while your account exists, and if you delete the account it stays with MJMDA for the rest of 24 months from when you sent it, and is then deleted.
- You cannot delete a profile yourself once it is sent. MJMDA delete one sooner when you ask, with any files sent with it and the answers it held before a change. They then keep only a note of its reference, when it was sent, when it was deleted and who at MJMDA deleted it, so that the reference is not mistaken for one that never existed.
- A file that does not finish uploading is deleted within a day.
- The email notice MJMDA receive stays in their mailbox, apart from this site.
Your rights
You can ask for a copy of what is held about you, have it corrected or deleted, object to its use, ask for its use to be restricted, or ask for it in a form you can take elsewhere. You can delete your account yourself from your account page. A profile you have sent can be deleted only by MJMDA. To have one deleted, write to info@mjmda.eu, quoting its reference. For anything else, write to matjam@mjmda.eu.
If you are not satisfied with the answer, you can complain to Malta’s Information and Data Protection Commissioner at idpc.org.mt.
Changes
This notice describes the site as it stands. When what is collected changes, this page changes before it does.
