Annual Reports Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

Cookie Policy INTRODUCTION This cookie policy (“ Cookie Policy” ) relates to the website mbr.mt and/or any sub-website and/or associated domains (and/or sub-domains) of mbr.mt (hereinafter referred to as the “ Site ” owned by the Malta Business Registry ). In this Cookie Policy, “ We “, “ Us “, “ Our “, “ Ourselves ” and/or “ MBR ” shall refer to the Malta Business Registry and “ You ” and “ Your ” and “ User ” refer to an identified or identifiable natural person being the user of this Site and/or recipient (or prospective recipient) of any of Our services (via the Site). Our full details, including contact details, can be read below . For more information about how We process Your Personal Data, please read Our Privacy Policy . CONTENTS OF THIS COOKIE POLICY INTRODUCTION CONTENTS OF THIS COOKIE POLICY WHAT ARE COOKIES? WHY WE USE COOKIES ESSENTIAL COOKIES NON-ESSENTIAL COOKIES SPECIFIC COOKIES USED ON THIS SITE HOW TO DELETE OR DISABLE COOKIES VIA YOUR BROWSER MBR DETAILS UPDATES WHAT ARE COOKIES? Our Site uses a technology called “cookies”. A cookie is an element of data (usually a very small file) that a website can send to Your browser, which may then store it on Your computer or mobile device. These cookies allow Us to correctly operate the Site and/or to provide You with web pages or content that are tailored to You. For example, some cookies remember Your custom preferences. This information can, in some cases, be carried from one visit of our Site (or related site) to the next (for example, to help You avoid having to re-enter certain information when You visit the same page later. Some of these cookies require Your consent (as explained below ). Some cookies are created for each session when You visit Our Site, while others are persistent and may remain for a number of months or years to facilitate Your access to Our Site. WHY WE USE COOKIES We absolutely respect Your right to privacy. We use cookies to ensure the functionality of our Site and to make Your website experience better. You can remove any cookies already stored on Your computer or mobile device (as explained below) but this may prevent You from using parts of this Site or may cause You to see this message, or part thereof, again. Apart from the cookies We make use of Ourselves, various third-party cookies may also be stored on Your computer or mobile device, including Google Analytics ( https://analytics.google.com/ ). We strongly suggest that You read the cookie policies of any such third-party cookies. ESSENTIAL AND NON-ESSENTIAL COOKIES We divide cookies into two main categories namely: Essential Cookies These are strictly necessary to ensure that the Site functions in Your everyday use of it or for Us to provide You with the service(s) You expect from Us. Cookies used for the sole purpose of carrying out or facilitating the transmission of a communication will also be considered as essential cookies. We do not require Your consent to use such essential cookies but You may still block or delete them ( see below ). Some examples of essential cookies as found in the European Commission’s EU Internet Handbook ( see http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm ) are as follows: cookies (session-id) such as first‑party cookies to keep track of the User’s input when filling online forms, shopping carts, etc., for the duration of a session or persistent cookies limited to a few hours in some cases cookies, to identify the User once he has logged in, for the duration of a session cookies, used to detect authentication abuses, for a limited persistent duration cookies, used to store technical data to play back video or audio content, for the duration of a session cookies, for the duration of session cookies such as language or font preferences, for the duration of a session (or slightly longer) cookies, for logged‑in members of a social network Non-Essential Cookies These are not required for the essential functioning of the Site, although they may greatly enhance Your experience of using Our Site. For example, non-essential cookies may be used for the following reasons: These cookies would remember Your custom preferences. For example, this helps You avoid having to re-enter certain information when You visit the same page later; Here, the cookies would be used to gather information about Your browsing habits allowing Us to provide You with more relevant information and material that would be of interest to You; Thesehelp Us gather information about users on Our Site(s), such as when You first visited the Site and/or how often You access it and at what particular time. These also include cookies that log how You came across the Site, using which search engine or other link. WE SHALL ONLY PLACE NON-ESSENTIAL COOKIES ON YOUR COMPUTER OR MOBILE DEVICE IF YOU CONSENT TO THAT SPECIFIC CATEGORY OF COOKIE being placed by way of a pop-up on relevant areas of our Site the first time you visit it and possibly subsequently (if necessary) and/or by accepting this Cookie Policy (or other similarly effective mechanism). This will not prevent You from deleting or disabling cookies by modifying Your browser settings as explained below . YOU MAY WITHDRAW SUCH CONSENT FOR NON-ESSENTIAL COOKIES AT ANY TIME BY THE SAME METHOD IN WHICH YOU GAVE IT TO US. SPECIFIC COOKIES USED ON THIS SITE: The specific cookies we use on our Site are as follows: Cookie Name Purpose Duration Cookie Type XSRF-TOKEN Cookie for fraud detection of calls Session Essential hs Security Cookie for Hive (legacy) Session Essential svSession Cookie for security, stability, and core site function 12 months Essential SSR-caching Performance cookie for rendering 24 hours Essential TS* Cookies for attack detection Session Essential bSession Used for system effectiveness measurement 24 hours Essential fedops.logger.sessionId Tracking session errors and issues (resilience) 12 months Essential _wixAB3|* Cookie for site experiments 6 months Essential server-session-bind Cookie for API protection Session Essential client-session-bind Cookie for API protection Session Essential oAuthState Session cookie for identification Session Essential wixSession Cookie for security, stability, and core site function 12 months Essential sec-fetch-unsupported Used to indicate browser limitations preventing the enabling of site security features Session Essential HOW TO DELETE OR DISABLE COOKIES VIA YOUR BROWSER Even if We obtain Your consent to use non-essential cookies or if We use essential cookies (where we don’t need your consent), You can still control Your settings in Your browser to delete or disable cookies. If Your browser is NOT configured, by default, to block all or certain cookies, You may manually configure Your browser to either reject all cookies or control which cookies are set on Your computer or mobile device through the Site. Should You wish to reject all or certain cookies used by Our Site, You may modify Your web browser preferences to do so. If You reject ALL cookies (including Essential Cookies ) then You might be unable to use some of the features or services available on Our Site and You might also experience a lack of full functionality of the Site. Usually, the information on how to change Your options regarding cookies can be obtained by referring to Your operating system’s manual or to the ‘Help’ section of Your web browser, or by contacting Your Internet Service Provider. You may also find all the necessary information on how to make the necessary configuration settings by visiting the following helpful site: http://www.allaboutcookies.org/manage-cookies/ Please read Our Privacy Policy which, among other things, explains all Your rights as a data subject. For more information please feel free to contact us as indicated below. MBR DETAILS MBR is the data controller responsible for processing of Your personal data that takes place via the Site or in the manner explained above. If You have any questions/ comments about privacy, You should contact Us at: info.mbr.@ mbr.mt or by writing to Malta Business Registry, AM Business Centre, Triq il-Labour, Zejtun ZTN 2401, Malta, by phoning Us using telephone number (+356) 2258 2300 (during normal office hours) or by contacting our Data Protection Officer. MBR’s Data Protection Officer is Dr. Geraldine Ann Spiteri Lucas who can be contacted directly at dpo.mbr@mbr.mt UPDATES We reserve the right, at Our complete discretion, to change, modify, add and/or remove portions of this Cookie Policy at any time. If You are an existing client with whom We have a contractual relationship You shall be informed by Us of any changes made to this Cookie Policy (as well as other terms and conditions relevant to the Site). We shall also archive and store previous versions of the Cookie Policy for Your review. As a User of this Site with which We have no contractual relationship or even a lawful way of tracing, it is in Your interest to regularly check for any updates to this Cookie Policy, in the event that Our attempts to notify You of such updates do not reach You. Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

Mergers Mergers Continuation of Companies in Malta The Continuation of Companies Regulations (Legal Notice 344 of 2002, as amended) provide the legal framework for the continuation of companies in Malta, both for foreign companies wishing to establish themselves in Malta and for Maltese companies looking to move their registration outside Malta. 1. Continuation of a Foreign Company in Malta Foreign companies incorporated or registered under the laws of an approved country may apply to the Registrar of Companies in Malta to continue their existence in Malta. The process involves submitting various documents including: A resolution authorizing the continuation, A revised constitutive document compliant with Malta’s requirements, A certificate of good standing from the foreign jurisdiction, A declaration of solvency from the company's directors, A list of directors and other officers of the company. Additionally, companies must comply with the declaration on beneficial owners (Form BO1) and a declaration of compliance by proposed directors (Form K1). Upon approval, the company is provisionally registered in Malta and must submit proof of ceasing to be registered in the foreign jurisdiction within six months. 2. Continuation of a Foreign Company Outside Malta A Maltese company may also request to continue under the laws of an approved foreign country. The company must publish its intent and allow creditors to raise objections. If no objections are raised, the Registrar will issue the necessary consent, and the company will be struck off the Maltese Register upon the continuation becoming effective in the new jurisdiction. Important Note : These regulations apply to companies wishing to move their registration to any approved country except those where the EU Mobility Directive of 2019 has been transposed. Cross-Border Transactions: Summary for Website 6.1 Cross-Border Divisions (CBD) Non-Applicability CBD Regulations do not apply when conditions under Regulation 4(5) are present. Procedure for Dividing Maltese Companies Filing with the Registrar : Includes the Draft Terms of CBD, a Declaration of Solvency, and a Notice to creditors and employees about the right to comment. Publication : A statement is published in the Gazette, on the Registrar’s website, and in a daily newspaper. General Meeting Approval : Requires an extraordinary resolution approved one month after publication. Pre-CBD Certificate : Application to the Registrar after one month from publication. Completion Certificate : Issued when recipient companies are registered and includes striking off the Maltese company from the register. 6.2 Cross-Border Conversions (CBC) Non-Applicability CBC Regulations are not applicable under conditions outlined in Regulation 4(4). Procedure for Companies Converting from Malta Filing with the Registrar : Includes the Draft Terms of CBC, Declaration of Solvency, and Notice to creditors and employees about the right to comment. Publication : Statements published in the Gazette, on the Registrar’s website, and in a daily newspaper. Pre-CBC Certificate : Issued after three months from publication. Striking-off : The company is struck off from the Maltese register once the conversion is complete. Procedure for Foreign Companies Converting to Malta Required Documents : Includes draft terms, pre-conversion certificate, declaration of solvency, and articles of association. Director’s Declarations : Includes compliance with company law and disqualification criteria. Certificate of Cross-Border Conversion : Issued once registration is complete, confirming the company's new status and authorization to commence business. 6.3 Cross-Border Mergers (CBM) Non-Applicability CBM Regulations are not applicable under conditions in Regulation 4(5). Procedure for Merging Maltese Companies Filing with the Registrar : Includes Common Draft Terms of CBM, Declaration of Solvency, and Notice to creditors and employees. Publication : Statements published in the Gazette, on the Registrar’s website, and in a daily newspaper. Pre-CBM Certificate : Application after one month from publication. Certificate of Completion : Issued when the merger is approved, with the resulting company’s registration and notification of the effective merger date. Striking-off : Maltese companies ceasing to exist due to the merger are struck off from the register. These procedures ensure that cross-border transactions, including divisions, conversions, and mergers, comply with local regulations and maintain transparency throughout the process. For more detailed information you may use this link . Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

Companies Act: Main & Subsidiary Legislation A list of legal documents pertaining to the legislation under which the formation, registration or incorporation, governance, and dissolution of a firm, is administered and controlled. Main Legislation Companies Act Cap. 386 Malta Business Registry (Establishment as an Agency) Order, 2018 Subsidiary Legislation S.L. 386.01 Companies Act (Forms) Regulations S.L. 386.02 Companies Act (Investment Companies with Variable Share Capital) Regulations S.L. 386.03 Companies Act (Fees) Regulations S.L. 386.04 Companies Act (Investment Companies with Fixed Share Capital) Regulations S.L. 386.05 Continuation of Companies Regulations S.L. 386.08 Companies Act (European Economic Interest Grouping) Regulations S.L. 386.09 Investment Companies with Variable Share Capital as Retirement Funds Regulations S.L. 386.10 Companies Act (Cell Companies Carrying on Business of Insurance) Regulations S.L. 386.11 Companies Act (The Prospectus) Regulations S.L. 386.13 – Companies Act (Incorporated Cell Companies Carrying on Business of Insurance) Regulations S.L. 386.14 – Companies Act (SICAV Incorporated Cell Companies) Regulations S.L. 386.15 – Companies Act (Recognised Incorporated Cell Companies) Regulations S.L. 386.16 Insurance Business Act (Cap.403) Securitisation Cell Companies Regulations, 2014 S.L. 386.17 Transfer of Registered Office of a European Company (SE) Regulations S.L. 386.18 Companies Act (System of Interconnection of Registers) Regulations S.L. 386.19 Companies Act (Register of Beneficial Owners) Regulations S.L. 386.20 Companies Act (Audit Exemption) Regulations S.L. 386.21 Companies Act (Company Reconstructions Fund) Regulations S.L. 386.22 Companies Act (Shipping and Aviation Cell companies) Regulations SL 386.24 Companies Act (Suspension of Filing for Dissolution and Winding Up) Regulations S.L. 386.25 Companies Act (Use of Digital Tools and Processes Regulation) S.L. 386.26 Cross-Border Divisions of Limited Liability Companies Regulations S.L. 386.27 Cross-Border Conversions of Limited Liability Companies Regulations S.L. 386.28 Cross-Border Mergers of Limited Liability Companies Regulations SL 386.29 Companies Act (Suspension of Filing for Dissolution and Winding Up) Regulations Order SL 386.30 Companies Act (Agricultural Companies) Regulations S.L. 386.31 Corporate Sustainability Reporting Regulations Not yet in force S.L. 386.32 Companies Act (Youth Enterprise) Regulations S.L. 386.33 Sports Private Limited Liability Companies Regulations S.L. 459.01 – Financial Collateral Arrangements Regulations Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

Company Changes Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

Publications Annual Reports Newsletter 2026 2025 2024 2023 2022 2021 2020 Financial Statements Financial-Statements-2025 .pdf Download PDF • 1.39MB Financial-Statements-2024 .pdf Download PDF • 2.20MB Financial-Statements-2023 .pdf Download PDF • 2.05MB Financial-Statements-2022 .pdf Download PDF • 2.07MB Financial-Statements-2021 .pdf Download PDF • 2.25MB Financial-Statements-2020 .pdf Download PDF • 1.87MB Financial-Statements-2019 .pdf Download PDF • 8.24MB Financial-Statements-2018 .pdf Download PDF • 1.50MB Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

Privacy Policy INTRODUCTION This Master Privacy Policy (“ Privacy Policy ”) relates to the baros.mbr.mt and/or any website/sub-website and/or associated domains (and/or sub-domains) of mbr.mt hereinafter referred to as the “ Site ”) the services provided by Malta Business Registry the owner of the Site, (“ We ”, “ Us ”, “ Our ”, “ Ourselves ”, and/or “ MBR” ) and any related software applications (‘Apps’), where Personal Data are processed by the same (via the Site, any of Our Apps or otherwise) relating to You. Please note that Our website may be hosted and operated using a third-party website platform/provider (currently Wix.com Ltd. and its affiliated companies (“Wix”)). In addition, when We host events or similar activities for which an online payment is required (and only while event registration is open), We will use a third-party payment service provider (currently Stripe – including Stripe Payments Europe, Limited and/or Stripe, LLC (“Stripe”)) to process online payments. In such cases, certain Personal Data will be processed by Wix and/or Stripe (as further explained in this Privacy Policy) in order for Us to operate the Site, administer event registrations and process payments securely. In this Master Privacy Policy, “ You ”, “ Your ” and “ User ” refer to an identified or identifiable natural person being the User of the Site, and/or recipient (or prospective recipient) of any of Our services and/or identifiable natural person whose information (in his/her personal capacity and not when acting as representative of a legal entity) is stored on Our database(s) and which may or may not be publicly available. Our full details, including contact details, can be read below. Please see the sections “ WHAT ARE PERSONAL DATA ” and “ WHAT ABOUT INFORMATION RELATING TO COMMERCIAL PARTNERSHIPS (INCLUDING COMPANIES) AND OTHER LEGAL ENTITIES?” below. You may be reading this Privacy Policy as a User or visitor of the Site or You may have been directed here by one (or more) of Our condensed privacy policies or Our other notices (digital or otherwise) found in one of Our forms or other similar documents. Although this Privacy Policy provides detailed, layered information on how and why We generally process Personal Data (via the Site, any of Our Apps, or otherwise) as well as detailed information about Your various rights, the specific and tailor-made content of such condensed policies or other notices will, in most cases, provide You with more focused and detailed information on specific processing operations (for example, the specific legal basis for processing certain categories of Personal Data and the specific purpose for doing so depending on the matter at hand). Although at MBR, Our goal is to always be as clear and transparent as possible, We appreciate that legal documents can sometimes be difficult to read. However, We strongly encourage You to read this Privacy Policy (which is layered for Your convenience) with care. Please do not hold back from contacting Us for any clarification You may need. For example, if You need clarification on a specific legal basis, We are relying on to process Your Personal Data for a specific processing operation, We would be happy to provide You with any such information You may need. CONTENTS OF THIS MASTER PRIVACY POLICY Introduction Contents of this Master Privacy Policy Applicable Laws What Are Personal Data? What About Information Relating to Commercial Partnerships (Including Companies) and Other Legal Entities? Personal Data MBR Collects About You How and Why We Collect Personal Data Personal Data Relating to Third Parties What We Use Your Personal Data For (Purpose of Processing) Data Which We Make Publicly Available Accuracy of Personal Data Transfer to Third Countries Internet Communications Authorised DIsclosures Sharing Of Personal Data With Other Categories Of Recipients Security Measures Retention Periods Processing For Research And Statistical Reasons Links to Third Party Sources Cookies Minors Automated Decision-Making Your Rights Under the Data Protection Laws What We May Require From You Time Limit For A Response MBR Details Updates APPLICABLE LAWS The MBR is the controller of personal data in terms of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – “the GDPR”) and the Data Protection Act (Chapter 586 of the Laws of Malta – “the DPA”). The MBR ensures that personal data are processed in accordance with the GDPR, the DPA and any other relevant European Union (“EU”) and national law. The MBR ensures, inter alia, the confidentiality and security of such personal data. All the above, as may be amended from time to time, referred to together as the “Data Protection Laws” WHAT ARE PERSONAL DATA? The term “ PERSONAL DATA ” means any information that identifies You as an individual or that relates to an identifiable individual. Information relating to legal persons (such as companies) does not amount to Personal Data. For more information on this important distinction, please read the section “ WHAT ABOUT INFORMATION RELATING TO COMMERCIAL PARTNERSHIPS (INCLUDING COMPANIES) AND OTHER LEGAL ENTITIES? ” below. Whenever it is not possible or feasible for Us to make use of anonymous and/or anonymised data (in a manner that does not identify any Users of the Site or recipients of Our services), We are nevertheless committed to protecting Your privacy and the security of Your Personal Data at all times. We collect Personal Data in various ways both digitally via the Site (either when You choose to provide Us with certain data or in some cases, automatically or from third parties) as well as non-digitally (for example when a statutory form is submitted to Us or You fill in a physical form to benefit from one or more of Our services). WHAT ABOUT INFORMATION RELATING TO COMMERCIAL PARTNERSHIPS (INCLUDING COMPANIES) AND OTHER LEGAL ENTITIES ? Information relating to legal persons (having a Juridical Personality) as opposed to natural persons does not amount to personal data. Limited liability companies and other legal entities have a distinct legal personality that is separate from that of their owners or even their directors or administrators. This means that information relating to such legal entities (as opposed to the details of the owners, shareholders or even directors or administrators) will not, in most cases, constitute personal data and falls outside the scope of the GDPR. Having said the above, in all those cases where natural persons (such as company directors, shareholders, partners, administrators, founders, controllers, supervisory council members, protectors and even sole traders inter alia ) are individually identifiable, and where information relates to such individuals in their personal capacity as opposed to them acting as representatives of a legal person , MBR will treat such information as personal data and will afford to such individuals (who would be deemed as data subjects) all the data protection rights listed below, as may be applicable . PERSONAL DATA MBR COLLECTS ABOUT YOU There are various categories of Personal Data that We collect about You, namely: CONTACT DETAILS (WITHOUT NEED FOR REGISTRATION ON THE SITE): Name Email Comments containing any personal data You choose to send us. REGISTRATION DATA: Title First Name Surname Date of birth Residential Address E-mail address Telephone Mobile (optional) Fax Number (optional) Nationality ID/Passport Number Username Password INCORPORATION/DECLARATION DATA: Identification details (ID) which shall include but are not limited to the nationality and country of residence. In line with Article 2(5) of the Companies Act, Chapter 386 (“the Companies Act’’), article 29(1)(e) and article 49(2)(f) of the Second Schedule to the Civil Code (CAP 16) (the “Schedule”)“For the purposes of the above-mentioned legislation, where a document required to be delivered to the Registrar for registration is required to state the name and residence or address of a person, it shall be deemed to require further the official identification, by number or otherwise of such person, as may be applicable. Moreover, Article 401(1)(d) paragraph (i) of the Companies Act and the second proviso to Regulation 7 (1)(c) paragraph (i) of the Companies Act (Register of Beneficial Owners) Regulations ( S.L. 386.19) regulation 4(1)(a) of Civil Code (Second Schedule) (Register of Beneficial Owners – Associations) (S.L. 16.17) and regulation 4(1)(a) of Civil Code (Second Schedule) (Register of Beneficial Owners – Foundations) (S.L. 16.18) further allows for the Registrar to obtain identification details and any other information supported by documents including, certified true copies of ID cards, passports, residence cards and other identification documents in order to verify the identification details being disclosed to the Registry. Nationality Country of Residence Registered Office (only considered personal data if this is the home address of the individual sending Us this information). Contact details of shareholders, directors, company secretaries, and other members of the applicant including as applicable: Name Residential address Email address Nationality Business Occupation Contact details of persons liaising and submitting documents on behalf of applicant (for example, a legal representative) including: Name Email address Police conduct and/or certificate of good standing processed in line with Article 10 of the GDPR and the DPA, as authorised by Maltese company law and anti-money-laundering legislation).) (only in specific circumstances) Bank references (only in specific circumstances) Evidence that the commercial partnership (including companies) and other legal entities can use the address as the registered office (only in specific circumstances) TRACKING DATA: IP address Location Data Location Data FINANCIAL INFORMATION: Bank account details (for example, where required for refunds or for other payment-related administration, where applicable) Billing details (for example, billing address, invoice details, receipt details, and similar payment administration data) Payment transaction details (for example, amount, date/time, payment status, and transaction reference/identifier) For the avoidance of doubt, where online payments are processed through Our payment service provider (currently Stripe), Your full card number and card security code (CVC/CVV) are processed directly by Stripe (and/or relevant financial institutions/payment method providers) and are not stored by MBR. EVENT / TRAINING INFORMATION (WHERE APPLICABLE): Event registration details Attendance information Communications relating to an event CPE/CPD ACCREDITATION DATA (where applicable): the minimum attendee information required to verify attendance and to issue/record CPE/CPD accreditation Please note that the online payment functionality will only be made available when an event is approaching and registrations are open; once the event ends (or registration closes), the online payment functionality will be switched off. ADDITIONAL INFORMATION: In some cases, (for example, if You are a recipient [or prospective recipient] of Our services, via the Site, any App or otherwise – even if the service in question is merely information You request from Us), We may request additional Personal Data as a means of securely identifying You or for another similar lawful purpose (which will be explained in the table below and/or in a condensed policy/notice that may have directed You here). The additional information We may request from You to be able to provide You with Our services includes: More secure identification methods Credentials/references Details of Your next of kin Certain special categories of data (sensitive Personal Data) such as health conditions/status/details or trade union membership (only where necessary and with the necessary safeguards in place) in terms of Article 9 (2) of the GDPR Your police conduct and/or certificate of good standing which We may require for the incorporation of legal entities in certain cases, and which We process, primarily for verification purposes in line with Article 10 of the GDPR and the DPA, as authorised by Maltese company law and anti-money-laundering legislation.. Many of the categories of Personal Data above are collected directly from You (for example, Your Contact Details and Your Registration Data). However, WE MAY ALSO COLLECT PERSONAL DATA FROM OTHER SOURCES , including authorised members (e.g. directors, administrators or company secretaries) of the company or other legal entities You may be associated with, third party data companies, publicly accessible databases, social media platforms, other Government agencies and Government bodies (both local as well as foreign bodies within the EU) and other third parties. We may also receive Personal Data about You from third parties when We need to confirm Your Contact Details or even certain Financial Information. Should this be the case, We will take all measures as required by law to further inform You about the source of such Personal Data as well as the categories of Personal Data We collect and process (unless We are satisfied that You already have that information). There are certain instances at law where We are specifically forbidden from disclosing to You such activity (for example, when carrying out due diligence for anti-money laundering purposes). For a detailed description of the reasons why We process the categories of Personal Data above (and any other specific Personal Data We process) as well as the corresponding legal ground(s) for doing so please see the ‘What We Use Your Personal Data For (Purpose of Processing)’ below . For information/ Personal Data that We may collect automatically via the Site, please see the Cookies section below . HOW AND WHY WE COLLECT PERSONAL DATA As a general rule, We do not collect any Personal Data, that is, information that identifies You as an individual other than that which You choose to provide to Us such as the data (including Contact Details and Registration Data) You provide when contacting Us via Our Site (where registration is not required) or registering with the said Site (where this is available), when registering a company or other entity with MBR (if this applies to You as an identifiable natural person), when filing documents with Us on behalf of any legal entity (if this applies to You as an identifiable natural person) when otherwise contacting Us with enquiries relating to Our services, when subscribing to any service offered by Us or via Our Site, such as any newsletters as may be issued by Us from time to time (see Personal Data We Collect About You above). Unless otherwise specified and subject to various controls, as a general rule, we only collect Personal Data (from You or elsewhere) that we: need to be able to provide You with the services/information You request from Us. are legally required to collect/use and to keep for a predetermined period of time. believe to be necessary for the performance of a task carried out in the public interest and believe it to be necessary for the performance of a task carried out in the exercise of official authority vested in Us (as a Government agency). For a detailed description of the reasons why We process specific categories of Personal Data as well as the corresponding legal ground(s) for doing so, please see the ‘ What We Use Your Personal Data For (Purpose of Processing) ’ below . PERSONAL DATA RELATING TO THIRD PARTIES By providing Us with or allowing Us to access Personal Data relating to individuals other than Yourself (such as when You list other involved persons pertaining to company registration or registration of other legal entities with MBR), You are letting Us know that You have the authority to send Us those Personal Data or the authority to permit Us to access those data in the manner described in this Privacy Policy. WHAT WE USE YOUR PERSONAL DATA FOR (PURPOSE OF PROCESSING) The following is a description (in a clear and plain manner) of what We use Your Personal Data for and the corresponding legal ground(s) We rely on for doing so. For more detail on what is meant by terms such as ‘ Contact Details’ , ‘ Registration Data’ and other categories of Personal Data used in the tables below, please see the section above relating to Personal Data We Collect About You . Please note that in the rare instances (if any) where We rely on your consent, this can always be withdrawn at will . GENERAL PROCESSING OPERATIONS PROSPECTIVE RECIPIENTS / USERS OF THE SITE / NEW RECIPIENTS OF OUR SERVICES: PURPOSE OF THE PROCESSING CATEGORIES OF PERSONAL DATA LEGAL BASIS FOR PROCESSING Evaluating application(s)/requests You send Us to use/receive any of Our services) Registration Data Contact Details Financial Information Other Communication Data Incorporation/Declaration Data References Contractual Necessity Official Authority Public Interest Legal Obligations Set up a record on our systems Registration Data Contact Details Financial Information Incorporation/Declaration Data Other Communication Data Contractual Necessity Legal Obligations To manage our relationship with You Registration Data Contact Details Financial Information Incorporation/Declaration Data Other Communication Data Transaction and Usage data Contractual necessity Compliance with the legal obligations To carry out mandatory verification in compliance with applicable laws (anti- money laundering and combatting the financing of terrorism legislation) Registration Data Contact Details Financial Information Incorporation/Declaration Data Identification and verification data Background Checks Compliance with our legal obligations To establish and investigate any suspicious behaviour in order to protect Our systems from any risk and fraud Registration Data Contact Details Identification and Verification Data Log in Data Tracking Data Compliance with the legal obligations To keep an accurate and up to date legal entities database (open to the public) Contact Details (in addition to the specific details of the legal entity that require updating) Incorporation/Declaration Data Compliance with the legal obligations To monitor our premises via CCTV for security purposes, when not exercising any of Our official tasks CCTV footage (deleted after 7 days) Legitimate Interests To ask visitors to enter their name and surname when entering Our premises Login details (deleted after 7 days) Legitimate Interests Legal Obligations To administer event/training registrations and attendance (including related communications), where applicable Registration Data. Contact Details. Other Communication Data. Event / Training Information. Financial Information (only where an event payment is required). Transaction and Usage data (where applicable) Contractual necessity (where applicable); Official Authority / Public Interest (where applicable); Compliance with legal obligations (where applicable) To verify attendance and to issue/record CPE/CPD accreditation (where applicable), including sharing the minimum necessary attendee information with the relevant professional accreditation body Contact Details. Event / Training Information. Other Communication Data. Registration Data (where applicable) Contractual necessity (where applicable); Official Authority / Public Interest (where applicable); Compliance with legal obligations (where applicable) ONGOING RECIPIENTS OF OUR SERVICES: PURPOSE OF THE PROCESSING CATEGORIES OF PERSONAL DATA LEGAL BASIS FOR PROCESSING To be able to continue providing You with (some or all of) Our services Registration Data Contact Details Financial Information Other Communication Data Incorporation/Declaration Data Contractual Necessity Official Authority Public Interest Legal Obligations Maintain records on our systems Registration Data Contact Details Financial Information Incorporation/Declaration Data Other Communication Data Contractual Necessity Legal Obligations Continue to manage Our relationship with you Registration Data Contact Details Financial Information Incorporation/Declaration Data Other Communication Data Transaction and Usage data Contractual necessity Compliance with the legal obligations To pass on certain information to public authorities (including the Malta Financial Services Authority and National Statistics Office) & compile internal statistics and reports Registration Data Incorporation/Declaration Data Contact Details Legal Obligation Public Interest Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (within the limits permitted by law). To process and manage payments transactions (where applicable) Financial Information Registration Data Contact details (where applicable) Contractual necessity To help you with your specific concerns/requests, including any requests/applications relating to any entity Registration Contact Details Incorporation/Declaration Data Financial Information (depending on request) Contractual Necessity Official Authority Public Interest Legal Obligations To administer event/training registrations and attendance (including related communications), where applicable Registration Data. Contact Details. Other Communication Data. Event / Training Information. Financial Information (only where an event payment is required). Transaction and Usage data (where applicable) Contractual necessity (where applicable); Official Authority / Public Interest (where applicable); Compliance with legal obligations (where applicable) To verify attendance and to issue/record CPE/CPD accreditation (where applicable), including sharing the minimum necessary attendee information with the relevant professional accreditation body Contact Details. Event / Training Information. Other Communication Data. Registration Data (where applicable) Contractual necessity (where applicable). Official Authority / Public Interest (where applicable). Compliance with legal obligations (where applicable) OTHER SPECIFIC PROCESSING OPERATIONS: Register of Companies and Register of Legal Persons: PURPOSE OF THE PROCESSING CATEGORIES OF PERSONAL DATA LEGAL BASIS FOR PROCESSING Evaluating any request to register any commercial partnership (including companies) and other legal entities and to be able to keep an accurate database of such (including their members) in line with Our obligations at law (Cap 386 and Subsidiary Legislation 386.18 and CAP 16 and S.L. 16.17 & S.L. 16.18) Incorporation/Declaration Data Contact details of shareholders, directors, company secretaries and/or other involved parties Police conduct and/or certificate of good standing Compliance with the legal obligations Contractual Necessity Official Authority Public Interest Register of Beneficial Owners: PURPOSE OF THE PROCESSING CATEGORIES OF PERSONAL DATA LEGAL BASIS FOR PROCESSING To be able to keep an accurate database of beneficial owners of legal entities in line with Our obligations at law (S.L 386.19, S.L 16.17 and S.L 16.18) Name Date of Birth Nationality/Nationalities Country of Residence Incorporation/Declaration Data ID Number / Passport Beneficial Interest/Role Compliance with legal obligations (S.L. 386.19, S.L 16.17 and S.L 16.18) Official Authority Public Interest Disclosures Re Commercial Partnerships (including Companies) and other Legal Entities. To disclose relevant details of the beneficial owners of commercial partnerships (including companies) and other legal entities to persons requesting the same (where permitted or required and subject to applicable restrictions). For persons listed in S.L. 386.19 (7) (1) and regulation 10 of S.L. 16.17 & S.L. 16.18 to the following categories. (a) competent authorities in terms of the above mentioned regulation including but not limited to the Malta FIAU, national tax authorities, etc. that request information about the beneficial owners of commercial partnerships (including companies) and other legal entities: Personal Data shall be disclosed by Us without any restriction and without alerting the legal entity/ies concerned. (b ) subject persons/obliged entities: For this category, Personal Data may be disclosed by Us provided that the request We receive must relate to purposes of carrying out due diligence for the prevention, detection and combating of money laundering or the associated predicate offences or the financing of terrorism. (c ) general public : Provided they have a Legitimate Interest as explained in the below Legitimate Interest section. Compliance with Legal Obligations (S.L. 386.19 (7)) and regulation 10(9) of S.L. 16.17 & S.L. 16.18 – Provided that the registrar may refuse access to subject persons/obliged entities and the general public (as stipulated as outlined in terms of the above mentioned regulations), in full or in part, where in exceptional circumstances to be justified by means of documentary evidence and to be determined on a case by case basis, access to such beneficial ownership information would expose the beneficial owner to the risk of fraud, kidnapping, blackmail, violence or intimidation, or where the beneficial owner is a minor or otherwise incapable. Should We need to process Your data for a new purpose in the future, which is entirely unrelated to the above, We will inform You of such processing in advance and You may exercise Your applicable rights (as explained below) in relation to such processing. Finally, do note that without certain Personal Data relating to You, We may not be in the position to provide some or all of the services You expect from Us , as well as commercial partnerships (including companies)and other legal entities registration/incorporation and requests for information from Us) or even to guarantee the full functionality of Our Site. Legitimate Interest : Commercial Partnerships (including companies) The MBR shall grant access to the Register of Beneficial Owners (“RBO”) upon the demonstration of legitimate interest in the prevention and combating of money laundering, its predicate offences, or the financing of terrorism in terms of regulation 7 (1) (c) of the Companies Act ( Register of Beneficial Owners) Regulations ( S.L.386.19). Such requests for access based on Legitimate Interest would have to be made to the MBR via email on accesstobo@mbr.mt , along with the filing of a Request Form and a Declaration. These would have to be further accompanied by supporting documentation (including, but not limited to, identification documents). Such identification documents shall not be made publicly available and are required for the purpose of making an assessment on the veracity of the individual filing the request for access to beneficial ownership information. MBR shall not retain identification documentation once the necessary data is collected but it shall retain your data in accordance with the retention period for Personal Data mentioned below. The terms of this Privacy Policy shall mutatis mutandis apply to You unless it is otherwise deemed inconsistent. In gaining such access, the persons claiming Legitimate Interest and, therefore, gaining access to the RBO, would be confirming also that they are assuming the role of a data controller under the applicable laws and regulations relating to data protection as in force in Malta. Foundations and Associations In respect of S.L 16.17 and S.L 16.18, a similar process is undertaken where persons or organisations forming part of the general public, provided that they have a legitimate interest, are granted BO information as requested on satisfactory compliance with the above mentioned respective subsidiary legislations. The requests are sent via email on foundations.associations@mbr.mt , along with the filing of the supporting documentation, including but not limited to identification documents. Such identification documents shall not be made publicly available and are required for the purpose of making an assessment on the veracity of the individual filing the request for access to beneficial ownership information. MBR shall retain your data in accordance with the retention period for Personal Data mentioned below. The terms of this Privacy Policy shall mutatis mutandis apply to You unless it is otherwise deemed inconsistent. All persons entitled to access and receive information in terms of S.L. 16.17 and S.L. 16.18 are duty bound to comply with the applicable laws and regulations relating to data protection as in force in Malta. DATA WHICH WE MAKE PUBLICLY AVAILABLE: MBR is required by Article 401 (1) (d) of the Companies Act () and article 31C of the Second Schedule to the Civil Code, as well as by the Companies Act (System of Interconnection of Registers) Regulations (S.L 386.18 ) and regulation 14 of S.L. 16.17 & S.L. 16.18 to make certain information, which You may provide to Us inter alia for the purposes of commercial partnerships (including companies) and other legal entities incorporation, including any Personal Data, where applicable, (such as those pertaining to the name and address of the directors and other relevant persons of the legal entity) relating thereto, publicly available. Thus, whenever MBR makes such information public it relies on its legal obligation to do so as a legal basis for processing Personal Data. The Personal Data that We make public in relation to all commercial partnerships (including companies) and other legal entities registered with Us includes the following: A list of shareholders, directors, company secretaries and other persons vested with administration including such details as: Name Residential address Nationality Business occupation In the case of foundations and associations, information on beneficial owners is not made publicly searchable or openly available to the general public. Access to information held in the Register of Beneficial Owners is granted only to the categories of persons and under the conditions set out in the applicable regulations. Any access granted to subject persons/ onbliged entities or to members of the public is provided on a case-by-case basis following a written request and submission of the required documentation, and is limited to the specific foundation/association and the relevant beneficial owner(s). Only competent authorities as stated in regulation 10 of S.L. 16.17 & 16.18 have access without restriction to the information on the beneficial owners of the organisations. When a commercial partnership (including companies) and other legal entities is struck off the register, such data shall no longer be available to the public. Please note that although such Personal Data will no longer be available to the public, MBR will still retain such information, and this according to Our retention policy. For more background information, please read the sections WHAT ARE PERSONAL DATA and WHAT ABOUT INFORMATION RELATING TO COMMERCIAL PARTNERSHIPS (INCLUDING COMPANIES) AND LEGAL ENTITIES? Above. Please see the table above regarding the Register of Beneficial Owners for more information regarding the rules for how We may disclose information regarding ultimate beneficial owners of companies, foundations and associations and how, in certain instances, We are obliged to do so. ACCURACY OF PERSONAL DATA All reasonable efforts are made to keep any Personal Data We may hold about You up-to- date and as accurate as possible. You can check the information that We hold about You at any time by contacting Us in the manner explained below . If You find any inaccuracies, We will correct them and where required and in accordance with the law (provided that the law permits such deletion), delete them as necessary. Please see below for a detailed list of Your legal rights in terms of any applicable data protection law. TRANSFERS TO THIRD COUNTRIES As a general rule, the data We process about You (collected via the Site, any of our Apps or otherwise) will be stored and processed within the European Union (EU)/European Economic Area (EEA) or any other non-EEA country deemed by the European Commission to offer an adequate level of protection (the so-called ‘white-listed’ countries listed here: https://ec.europa.eu/info/law/law-topic/data-protection_en . In some cases, it may be necessary for Us to transfer Your Personal Data to a non-EEA country not considered by the European Commission to offer an adequate level of protection (for example to one or more of Our data processors located there). In such cases, apart from all appropriate safeguards that We implement, in any case, to protect Your Personal Data, We have put in place additional adequate measures. For example, We have ensured that the recipient is bound by the EU Standard Contractual Clauses (the EU Model Clauses) designed to protect Your Personal Data as though it were an intra-EEA transfer. You are entitled to obtain a copy of these measures by contacting Us as explained below. INTERNET COMMUNICATIONS You will be aware that data sent via the Internet may be transmitted across international borders even where sender and receiver of information are located in the same country. We cannot be held responsible for anything done or omitted to be done by You or any third party in connection with any Personal Data prior to Our receiving it including but not limited to any transfers of Personal Data from You to Us via a country having a lower level of data protection than that in place in the European Union, and this, by any technological means whatsoever (for example, WhatsApp, Dropbox, etc.) Moreover, We shall accept no responsibility or liability whatsoever for the security of Your data while in transit through the Internet unless Our responsibility results explicitly from a law having effect in Malta . AUTHORISED DISCLOSURE Without prejudice to anything contained in this Privacy Policy and in the interest of full transparency, We reserve the right to disclose (and otherwise process) any relevant Personal Data relating to You which We may be processing (including in certain cases relevant IP addresses) to authorised third parties in or outside the EU/EEA if such disclosures are allowed under the Data Protection Laws (whether or not You have provided Your consent) including but not limited to: For the purpose of preventing, detecting or suppressing fraud (for example, if You provide false or deceptive information about Yourself or attempt to pose as someone else, We may disclose any information We may have about You in Our possession so as to assist any type of investigation into Your actions); In the event of MBR being involved in a restructure, transfer or absorption into another Government department (or similar event analogously applicable to Government agencies); To protect and defend Our rights (including the right to property), safety, or those of Our affiliates, of Users of Our Site, of Our members or even Your own; To protect against abuse, misuse or unauthorised use of Our Site; For any purpose that may be necessary for the performance of any agreement You may have entered into with Us (including the request for provision of services by third parties) or in order to take steps at Your request prior to entering into a contract; To comply with any legal obligations such as may arise by way of response to any Court subpoena or order or similar official request for Personal Data; or As may otherwise be specifically allowed or required by or under any applicable law, for example, under anti-money laundering legislation or as part of MBR’s obligation to make certain information available to the public through the system of interconnection of EU Business registers at: https://e-justice.europa.eu/topics/registers-business-insolvency-land_en?language=en (S.L 386.18 S.L. 16.17 and S.L. 16.18) SHARING OF PERSONAL DATA WITH OTHER CATEGORIES OF RECIPIENTS Relevant data will also be disclosed or shared as appropriate (and in all cases in line with the Data Protection Laws) to/with staff/employees and/or officials of MBR, and/or to/with entities within the Maltese Central Government and/or to/with other Government agencies, departments, or similar entities (including such entities of other EU Member States) and/or other entities considered as competent authorities in terms of PMLFTR including but not limited to the Financial Intelligence Analysis Unit, the Malta Police Force, the Malta Financial Services Authority, Asset Recovery Bureau and also entities such as credit reference agencies and/or sub-contractors established within the European Union if pertinent to any of the purposes listed in this Privacy Policy (including to/with Our service providers who facilitate the functionality of the Site and/or any service You may require). Personal information will only be shared by Us to provide the services You request from Us or for any other lawful reason (including authorised disclosures not requiring Your consent) such as Our legal obligation to make available electronic copies of the documents which We are required to retain and register in terms of the Companies Act and S.L. 16.17 and S.L. 16.18 and through the system of interconnection of EU Business Registers at: https://e-justice.europa.eu/topics/registers-business-insolvency-land_en?language=en . Any such authorised disclosures will be done in accordance with the Data Protection laws (for example all Our processors are contractually bound by the requirements in the said Data Protection Laws, including a strict obligation to keep any information they receive confidential and to ensure that their employees/personnel are also bound by similar obligations). The said service providers (Our processors) are also bound by a number of other obligations (in particular, Article 28 of the GDPR). In certain cases, the recipients of Your Personal Data with whom We share Personal Data will not be acting on Our behalf but will be acting in their own capacity as entities/data controllers separate and independent from Us (e.g. Government agencies, Malta Financial Services Authority, Financial Intelligence Analysis Unit etc.). We are not responsible for whatever these entities may do with Your Personal Data and encourage You to read through their respective privacy policies to find out more about how they handle Your Personal Data. YOUR PERSONAL DATA WILL NEVER BE SHARED WITH THIRD PARTIES FOR THEIR MARKETING PURPOSES. The third parties who We may disclose to and/or share Your Personal Data with are, at the date of this Privacy Policy, the following: Category of Recipient Purpose of Processing Cloud Service Providers Hosting of data under state-of-the-art security protocols and our exclusive control IT Service Providers Maintenance and support of our IT systems/Website(s) – with restricted access and under our strict controls` Auditors Compliance with our auditing obligations – with access granted only to essential Personal Data Legal Advisors Compliance with our legal obligations or when necessary for the establishment, exercise or defence of legal claims. Other EU Member State Business Registers under the Business Registers Interconnection System (Directive 2017/1132/EU) and Regulation 2015/884) Compliance with Our legal obligations Other Government agencies, departments or entities (including the Malta Financial Services Authority and the National Statistics Office) Credit Reference Agencies (e.g. Malta Association of Credit Management or CreditInfo, The Malta Police Force) Compliance with legal obligations, in the public interest and/or Our exercise of official authority as necessary in the public interest Website platform / hosting provider Wix.com Ltd. (and its affiliated companies), which processes data of visitors/Users of the Site on Our behalf in order to provide and operate the website and related services. Payment service provider Stripe (including Stripe Payments Europe, Limited and/or Stripe, LLC, and their affiliates/sub-processors) for the processing of online payments and related payment operations. Professional accreditation bodies (CPE/CPD) (where applicable) Where an event is accredited for CPE/CPD purposes, We may share the minimum necessary attendee information with the relevant professional accreditation body solely to verify attendance and facilitate the issuance/recording of accreditation. Such bodies will process that information as separate controllers in accordance with their own privacy notices. SECURITY MEASURES The personal information which We may hold (and/or transfer to any affiliates/partners/subcontractors as the case may be) will be held securely in accordance with Our internal security policy and the law. We use reasonable efforts to safeguard the confidentiality of any and/or all Personal Data that We may process relating to You and regularly review and enhance Our technical, physical and managerial procedures so as to ensure that Your Personal Data is protected from: Unauthorised access Improper use of disclosure Unauthorised modification Unlawful destruction or accidental loss To this end We have implemented security policies, rules and technical and organisational measures to protect the Personal Data that We may have under Our control. All Our members, staff and data processors (including specific subcontractors, such as cloud service providers established within the European Union), who may have access to and are associated with the processing of Personal Data, are further obliged (under contract) to respect the confidentiality of Our Users’ or recipients’ Personal Data as well as other obligations as imposed by the Data Protection Laws. Despite all the above, We cannot guarantee that a data transmission or a storage system can ever be 100% secure. For more information about Our security measures please contact Us in the manner described below . Authorised third parties, and external/third party service providers acting as Our data processors, with permitted access to Your information (as explained in this Privacy Policy) are specifically required to apply appropriate technical and organisational security measures that may be necessary to safeguard the Personal Data being processed from unauthorised or accidental disclosure, loss or destruction and from any unlawful forms of processing. As stated above, the said service providers (Our data processors) are also bound by a number of other obligations in line with the Data Protection Laws (particularly, Article 28 of the GDPR). RETENTION PERIODS We will retain Your Personal Data only for as long as is necessary (taking into consideration the purpose for which they were originally obtained). The criteria We use to determine what is ‘necessary’ depends on the particular Personal Data in question and the specific relationship We have with You (including its duration). Our normal practice is to determine whether there is/are any specific EU and/or Maltese law(s) permitting or even obliging Us to keep certain Personal Data for a certain period of time (in which case We will keep the Personal Data for the maximum period indicated by any such law). For example, S.L 386.19, S.L. 16.17 and S.L. 16.18 obliges Us to retain Personal Data relating to beneficial owners until the lapse of five (5) years after the name of the concerned commercial partnership (including companies) and other legal entities has been struck off the register and in the case of a private foundation for ten (10) years. Incorporation/Declaration Data (as defined above will be kept for as long as the legal entity is active. Once the legal entity is struck off, only minimal information will be kept publicly accessible and this, in line with the principle of data minimisation. We would also have to determine whether there are any laws and/or contractual provisions that may be invoked against Us by You and/or third parties and if so, what the prescriptive periods for such actions are. In this case, We will keep any relevant Personal Data that We may need to defend Ourselves against any claim(s), challenge(s) or other such action(s) by You and/or third parties for such time as is necessary. Where Your Personal Data are no longer required by Us (in line with all applicable laws), We will either securely delete or anonymise the Personal Data in question. Please note that certain laws oblige Us to disclose some Personal Data to other Government entities (for example, the Malta Financial Services Authority and National Statistics Office) or to other EU Member State Central Registries as part of the Central Registers Interconnection System in which case, such entities (as separate controllers) would then determine their own retention policies (which in such cases may be much longer than those described above). PROCESSING FOR RESEARCH AND STATISTICAL REASONS Research and statistics using User or recipient information is only carried out so that We may understand Our Users’ and/or recipients’ needs, to develop and improve Our services/activities and/or for tasks carried out in the public interest or under the exercise of official authority representative of MBR’s purpose. In any case, where applicable, We will always ensure to obtain any consent We may legally require from You beforehand. As in all other cases, We will also ensure to implement all appropriate safeguards as may be necessary. LINKS TO THIRD PARTY SOURCES Links that We provide to third-party sources (such as websites) are clearly marked and We are not in any way whatsoever responsible for (nor can We be deemed to endorse in any way) the content of such sources (including any applicable privacy policies or data processing operations of any kind). We suggest that You should read the privacy policies of any such third-party sources (including the websites and respective policies or data processing operations of any kind). COOKIES When You visit Our Site, We collect certain categories of Personal Data automatically using cookies and similar technologies. For more detailed information including what cookies are and how and why We process such data in this manner (including the difference between essential and non-essential cookies) please read Our detailed but easy-to-read Cookie Policy . MINORS The Site and Our online services (entering into contracts with MBR) are not intended to be used by any persons under the age of eighteen (18) and therefore We will never intentionally collect any Personal Data from such persons unless under a specific legal exemption. If You are under the age of consent, please consult and get Your parent’s or legal guardian’s permission to use the Site and to use Our services. We shall consider that any Personal Data of persons under the age of eighteen (18) received by Us, shall be sent with the proper authority and that the sender can demonstrate such authority at any time, upon Our request. Provided that persons who have attained the age of sixteen (16) are eligible to be appointed as administrators of voluntary organisations enrolled with the office of voluntary organisations in terms of article 16B(3) of the Voluntary Organisations Act (CAP 492) and hence, are not required to submit authorisation. With respect to Personal Data of minors that We process as part of Our legal obligations (for example, where a minor or minors appear as shareholder(s) and/or ultimate beneficial owner(s)), such Personal Data will be processed by Us with additional layers of protection as required by law. For example, when members of the public enquire about the beneficial owner of a commercial partnerships (including companies) or other legal entities, should this owner be a minor, We are not obliged to disclose the said information save as otherwise stated above. On the contrary We will examine the facts of the case very carefully before making any disclosure (in whole or in part) and in any case, the general principles of the GDPR will be adhered to at all times. AUTOMATED DECISION-MAKING We do not rely on any decisions taken solely by automated means (in other words, without significant human intervention) – including any profiling. Should this position change in the future (and only as We may be legally permitted to do), You will be notified accordingly. YOUR RIGHTS UNDER THE DATA PROTECTION LAWS Before addressing any request you make with Us, We may first need to verify Your identity. In all cases We will try to act on Your requests as soon as reasonably possible. As explained in the Retention Periods section above, We may need to keep certain Personal Data for compliance with Our legal retention obligations but also to complete transactions that You requested prior to the change or deletion that You requested. Your various rights at law include: Your Right of Access : [RG1] You may, at any time request Us to confirm whether or not We are processing Personal Data that concerns You and, if We are, You shall have the right to access that Personal Data and to the following information: What Personal Data We have, Why We Process Them, Who We disclose them to, How long We intend on keeping them for (where possible), Whether We transfer them abroad and the safeguards We take to Protect them, What Your Rights are, How You can make a complaint, Where We got Your Personal Data from, Whether We have carried out any automated decision-making (including profiling) as well as related information. Upon request, We shall (without adversely affecting the rights and freedoms of others including Our own) provide You with a copy of the Personal Data undergoing processing within one month of receipt of the request, which period may be extended by two months where necessary, taking into account the complexity and number of the requests. We shall inform You of any such extension within one month of receipt of the request, together with the reasons for the delay. Your Right to Rectification : You have the right to ask Us to rectify inaccurate Personal Data and to complete incomplete Personal Data concerning You. We may seek to verify the accuracy of the data before rectifying it. Your Right to Erasure (The Right to be Forgotten) : You have the right to ask Us to delete Your Personal Data and We shall comply without undue delay but only where: The Personal Data are no longer necessary for the purposes for which they were collected; or You have withdrawn Your consent (in those rare instances where We process on the basis of Your consent) and We have no other legal ground to process Your Personal Data; or You shall have successfully exercised Your right to object (as explained below); or Your Personal Data has been processed unlawfully; or There exists a legal obligation to which We are subject; or Special circumstances exist in connection with certain children’s rights. In any case, We shall not be legally bound to comply with Your erasure request if the processing of Your Personal Data is necessary: for compliance with a legal obligation to which We are subject (including but not limited to Our duty to retain an accurate database of commercial partnerships (including companies) and other legal entities records and Our data retention obligations); for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in so far as Your exercise of this right to erasure is likely to render impossible or seriously impair the achievement of the objectives of such processing; for the establishment, exercise or defence of legal claims. There are other legal grounds entitling Us to refuse erasure requests although the three instances above are the most likely grounds that may be invoked by Us to deny such requests. Your Right to Data Restriction : You have the right to inform Us to restrict (that is, store but not further process) Your Personal Data but only where: The accuracy of Your Personal Data is contested (see the right to data rectification above), for a period enabling Us to verify the accuracy of the Personal Data; or The processing is unlawful, and You oppose the erasure of Your Personal Data; or We no longer need the Personal Data for the purposes for which they were collected but You need the Personal Data for the establishment, exercise or defence of legal claims; or You exercised Your right to object and verification of Our legitimate grounds to override Your objection is pending. Following Your request for restriction, except for storing Your Personal Data, We may only process Your Personal Data: Where We have Your consent (if any exists); or For the establishment, exercise or defence of legal claims; or For the protection of the rights of another natural or legal person; or For reasons of important public interest. Your Right to Data Portability: You have the right to ask Us to provide Your Personal Data (that You shall have provided to Us) to You in a structured, commonly used, machine-readable format, or (where technically feasible) to have it ‘ported’ directly to another data controller, provided this does not adversely affect the rights and freedoms of others. This right shall apply in relation to where: the legal basis is consent or contract and the processing is carried out by automated means . (Portability is separate from the rights below. It does not apply to all processing—only the above scenarios.) Your Right to Withdraw Consent (when We rely on consent) In the rare instances where We may have relied on Your consent to process Your Personal Data (which, in any case, We would have obtained in the manner required by the GDPR), You may withdraw any such consent at any time in a manner that is as easy as when You first provided the said consent to Us. Your Right to Object to Certain Processing In those cases where We only process Your Personal Data when this is; 1.) necessary for the performance of a task carried out in the public interest or in the exercise of Our official authority, OR 2.) when processing is necessary for the purposes of the legitimate interests pursued by a third party, You shall have the right to object to processing of Your Personal Data by Us. Where an objection is entered, the processing of data shall cease, unless We as data controller provide compelling and legitimate grounds requiring the continuation of the data processing which outweigh the objections You may have raised. For the avoidance of all doubt, when We process Your Personal Data when this is necessary for the performance of a contract, when necessary for compliance with a legal obligation to which We are subject or when processing is necessary to protect Your vital interests or those of another natural person, this general right to object shall not subsist. Your Right to Lodge a Complaint You also have the right to lodge complaints with the appropriate Data Protection Supervisory Authority. The competent authority in Malta is the Office of the Information and Data Protection Commissioner ‘’IDPC’’) . We kindly ask that You please attempt to resolve any issues You may have with Us first even though, as stated above, you have a right to contact the competent authority at any time. WHAT WE MAY REQUIRE FROM YOU As one of the security measures We implement, before being in the position to help You exercise Your rights as described above, We may need to verify Your identity to ensure that We do not disclose to or share any Personal Data with any unauthorized individuals. TIME LIMIT FOR A RESPONSE We try to reply to all legitimate requests within one month from receiving them. In some particular cases (for example, if the matter is particularly complex or if You send Us multiple requests), it may take Us longer than a month. In such cases, We will notify You accordingly and keep You updated. MBR DETAILS The Malta Business Registry is a Government Agency registered in Malta whose address is Malta Business Registry, AM Business Centre, Triq il-Labour, Zejtun ZTN 2405, Malta and is the data controller responsible for processing Your Personal Data that takes place via the Site or in the manner explained above (or in one of Our condensed privacy policies or notices that directed you here). If you have any questions/ comments about privacy or should you wish to exercise any of your individual rights, please contact Us at: info.mbr.@ mbr.mt or by writing to Malta Business Registry, AM Business Centre, Triq il-Labour, Zejtun ZTN 2405 or by phoning Us using telephone number (+356) 2258 2300 (during normal office hours Monday – Thursday: 09:00 – 12:00 & 13:00 – 14:30 and Friday: 09:00-13:00) or by contacting Our Data Protection Officer directly at dpo.mbr@mbr.mt UPDATES We reserve the right, at Our complete discretion, to change, modify, add and/or remove portions of this Privacy Policy at any time. If you are an existing natural person with whom We have a contractual relationship you shall be informed by Us of any changes made to this Privacy Policy (as well as other terms and conditions relevant to the Site). We shall also archive and store previous versions of the Privacy Policy for Your review. As a User of the Site with which We have no contractual relationship or even a lawful way of tracing, it is in your interest to regularly check for any updates to this Privacy Policy (which are usually deemed to be effective on the date they are published on the Site), in the event that Our attempts to notify you of of such updates do not reach you. Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

Privacy Policy - Malta Business Wallet Version 1.0. Last updated 14th May 2026 1.0. INTRODUCTION Welcome to the Malta Business Registry’s (“ MBR ”, “Controller” ) Privacy Policy relating to the provision of the Services provided via the Malta Business Wallet , a software application which you can download and install onto your mobile device and/or access via any related website, sub-website and/or associated domains (and/or sub-domains) under which the services of the Malta Business Wallet may be offered (“ MBW ”, “Software ”), where Personal Data is processed by the same relating to you. This Privacy Policy supplements the MBRs Master Privacy Policy which may be accessed via https://mbr.mt/privacy-policy/ . Whilst the storage, collection and other related processing activities relating to the Personal Data stored on the Software is dictated by this Privacy Policy, when the user of the Software decides to share documentation and/or reports he may have uploaded or generated through the Software with the MBR (as explained in this Privacy Policy), that Personal Data will be processed by the MBR in accordance with its Master Privacy Policy. MBR respects your privacy and is committed to protecting your Personal Data and processing it in compliance with any applicable data protection legislation. As a Government agency established in Malta, EU, the main privacy laws that are applicable to us in so far as you are concerned, are as follows: The Maltese Data Protection Act (Chapter 586 of the Laws of Malta) as well as the various subsidiary legislation issued under the same (the “DPA”); and The Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC ( General Data Protection Regulation ) (the “ GDPR ”). All the above, as may be amended from time to time, referred to together as the “ Applicable Data Protection Laws ”. 2.0. SUMMARY AND CONTENTS OF THIS PRIVACY POLICY In summary of this Privacy Policy we think that the following information is the most relevant for you: Purpose of processing: Primarily, we process your personal data for the purpose of providing you with our services, to allow your access and use of the Software, and to comply with our legal obligations; Controller: When processing your Personal Data, MBR acts as a controller; Your rights: You have a number of rights afforded by applicable laws. When we process your data on the basis of your consent, you can withdraw it at any time. You also have a right to request access to all of the personal data that is undergoing processing and a right to erasure of the data that are no longer necessary; and Implications of processing: Processing of personal data will result in the provision of services (or denial thereof of part or the entire use of the Software if certain data is not provided). We however recommend that you read this Privacy Policy in full, with care. For the ease of your understanding, these are the contents of this Privacy Policy: 1.0. INTRODUCTION 2.0. SUMMARY AND CONTENTS OF THIS PRIVACY POLICY 3.0. IMPORTANT INFORMATION AND WHO WE ARE 3.1. PURPOSE OF THIS PRIVACY POLICY 3.2. CONTROLLER 3.3. CONTROLLER’S CONTACT DETAILS 3.4. CHANGES TO THE PRIVACY POLICY AND OUR DUTY TO INFORM YOU OF CHANGES 4.0. THE PERSONAL DATA WE COLLECT ABOUT YOU 4.1. WHAT IS PERSONAL DATA? 4.2. WHAT ABOUT INFORMATION RELATING TO COMMERCIAL PARTNERSHIPS AND LEGAL ENTITIES? 4.3. DATA WE COLLECT ABOUT YOU 4.4. PERSONAL DATA RELATING TO THIRD PARTIES 4.5. SPECIAL CATEGORIES OF PERSONAL DATA 4.6. IF YOU FAIL TO PROVIDE PERSONAL DATA 5.0. WHY AND HOW WE USE YOUR PERSONAL DATA 5.1. WHY WE USE YOUR PERSONAL DATA 5.2 DETAILED PURPOSES AND LEGAL BASIS 6.0. RETENTION 7.0. RECIPIENTS OF YOUR PERSONAL DATA 7.1. DETAILS ON THE CATEGORIES OF RECIPIENTS OF THE PERSONAL DATA 7.2. AUTHORISED DISCLOSURE 8.0. DATA ACCURACY 9.0. INTERNATIONAL TRANSFERS 10.0. DATA SECURITY 11.0. YOUR RIGHTS UNDER THE DATA PROTECTION LAWS 11.1. YOUR RIGHT OF ACCESS 11.2. THE RIGHT TO RECTIFICATION 11.3. THE RIGHT TO ERASURE (THE RIGHT TO BE FORGOTTEN) 11.4. THE RIGHT TO DATA RESTRICTION 11.5. THE RIGHT TO DATA PORTABILITY 11.6. THE RIGHT TO OBJECT TO CERTAIN PROCESSING 11.7. RIGHT TO WITHDRAW CONSENT (WHEN WE PROCESS YOUR DATA ON THE BASIS OF CONSENT) 11.8. THE RIGHT TO LODGE A COMPLAINT 11.9. WHAT WE MAY NEED FROM YOU 11.10. TIME LIMIT TO RESPOND 12.0. AUTOMATED PROCESSING 13.0. COOKIES 3.0. IMPORTANT INFORMATION AND WHO WE ARE 3.1. PURPOSE OF THIS PRIVACY POLICY This Privacy Policy aims to give you information on how we collect and process your personal data through or in conjunction with your use of the Software. This Privacy Policy stipulates details and conditions of collecting and processing your Personal Data and provides you with information in accordance with the transparency principle and requirements under the Applicable Data Protection Laws. 3.2. CONTROLLER The Malta Business Registry is a Government Agency registered in Malta whose address is Malta Business Registry, AM Business Centre, Triq il-Labour, Zejtun ZTN 2401, Malta and is the data controller responsible for processing your Personal Data that takes place via the Software. 3.3. CONTROLLER’S CONTACT DETAILS Although our goal is to always be as clear and transparent as possible, if you need any clarification on this Privacy Policy or a specific legal basis we are relying on to process your Personal Data for a specific processing operation, we would be happy to provide you with any such information you may need. Please feel free to contact Us at: info.mbr@mbr.mt or by writing to Malta Business Registry, AM Business Centre, Triq il-Labour, Zejtun ZTN 2401 or by phoning us using telephone number (+356) 2258 2300 (during normal office hours Monday – Thursday: 09:00 – 12:00 & 13:00 – 14:30 and Friday: 09:00-13:00). We have appointed a data protection officer (The “ DPO ”) who is also responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy, including any requests to exercise rights please feel free to contact our DPO directly at dpo.mbr@mbr.mt 3.4. CHANGES TO THE PRIVACY POLICY AND OUR DUTY TO INFORM YOU OF CHANGES We reserve the right, at our complete discretion, to change, modify, add and/or remove portions of this Privacy Policy at any time. You shall be, in advance, informed by us of any material changes made to this Privacy Policy. We shall also archive and store previous versions of the Privacy Policy for your review. 4.0. THE PERSONAL DATA WE COLLECT ABOUT YOU 4.1. WHAT IS PERSONAL DATA? Personal Data means any information that identifies you as an individual or that relates to an identifiable individual. Information relating to legal persons (such as companies) does not amount to Personal Data. For more information on this important distinction, please read the section “ WHAT ABOUT INFORMATION RELATING TO COMPANIES? ” below. Whenever it is not possible or feasible for us to make use of anonymous and/or anonymised data (in a manner that does not identify any users of the Software or recipients of our services through the Software), we are nevertheless committed to protecting your privacy and the security of your Personal Data at all times. 4.2. WHAT ABOUT INFORMATION RELATING TO COMMERCIAL PARTNERSHIPS AND LEGAL ENTITIES? Information relating to legal persons as opposed to natural persons does not amount to Personal Data. Limited liability companies and other legal entities have a distinct legal personality that is separate from that of their owners or even their directors. This means that information relating to such legal entities (as opposed to the details of the owners, shareholders or even directors) will not, in most cases, constitute Personal Data and falls outside the scope of the Applicable Data Protection Laws. Having said the above, in all those cases where natural persons (such as company directors, shareholders, partners and even sole traders) are individually identifiable, and where information relates to such individuals in their personal capacity as opposed to them acting as representatives of a legal person, MBR will treat such information as Personal Data and will afford to such individuals (who would be deemed as data subjects) all the data protection rights listed below, as may be applicable. 4.3. DATA WE COLLECT ABOUT YOU You may, at your own choice and discretion (with the exception of data necessary to register, authenticate and securely verify your use of the Software), through your use of the Software, choose to upload onto the Software different forms of personal data relating to you which we have grouped together as follows: Registration Data provided by you when you register and/or open your account on the Software for the first time including first name, last name, date of birth, gender, nationality, country of birth, and your profile image. To simplify your registration, as well as for identification, security and verification purposes, the sign-up procedure is facilitated through third party providers including third party identity verification providers, the Electronic Identity Account or the eIDAS Node as issued by the Government of Malta. Once this procedure is utilised, the personal data (Registration and Contact Data) which would typically be provided by you during your registration, where available, will be automatically fed to your profile from such third party sources and used as further specified in this Privacy Policy. Any documents that you may upload onto the portal of any third party identity verification providers during your registration are only temporarily stored by such third party sources, until such documents are verified and authorised and any relevant metadata is extracted from such documents and fed into your profile as described above, upon which such documents will be securely deleted in line with the third party identity verification provider’s applicable privacy policies and/or notices. Company Involvement Data includes data related to your involvement and position within any legal entities. As explained above, whilst information relating to legal persons does not constitute personal data, information that directly identifies you and your involvement in a legal entity constitutes personal data. Identification Document Data includes any identification documents that you may freely choose to upload onto the Software, including your ID Card, Residence Card, Passport, or any other form of identification document which is accepted by the Software, and any personal information that may be contained within such documents. Verification of Address Data includes any personal data contained within documents which you may freely choose to upload onto the Software that may be used to verify any residential and/or commercial address, including rental agreements, bank statements, utility bills, and any government issued documentation. Source of Wealth Data includes includes any personal data contained within documents which you may freely choose to upload onto the Software that may be used to verify your source of wealth/income such as bank issued statements, statements of investments/shares, evidence of inheritance, contract of employment, payslips, income statements, profit and loss accounts, and receipts. Know Your Customer (KYC) Data refers to data stored within KYC reports generated through the Software by us at your request, which includes a compilation of your Registration Data, your Company Involvement Data, your Identification Document Data, your Verification of Address Data, and your Source of Wealth Data, as applicable. Contact Data includes your email address and telephone numbers. Payments Data includes bank/payment account details, as well as information pertaining to a transaction such as currency, location, amount/value, client IP, user ID, and token. Log in Data includes internet protocol (IP) address, your login logs, duration of logins, device/browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access the Software. In order to prevent and detect fraud and misuse of our systems, certain Log In Data such as; IP address, device model/type, browser information, operating system and device or other identification data may be sourced and processed by us through the services of third-party fraud detection software providers. Profile Data includes internal notes to your account, your preferences, and feedback. Communications Data includes your preferences in receiving communications from us (opt in/opt out), as well as your Contact and Registration Data. It also includes other Communication Data generated as part of communications with us or with other third parties via the Software which may include various data such as network communication data, the free-text content of the communications, as well as internal communication and notes. Analytics Data include various data generated with respect to your use of our Software such as your language, location, browser data and device data. Certain information may be collected using cookies and/or similar tracking technology, for which we kindly direct you to the section “ COOKIES ” below. Many of the categories of Personal Data above are collected directly from you when you opt to upload documents and information on the Software. However, there are also instances where we may also collect personal data from other sources, including authorised members (e.g. directors or company secretaries) of the company or other legal entities you may be associated with as well as other Government agencies and Government bodies (both local as well as foreign bodies within the EU) and other third parties. 4.4. PERSONAL DATA RELATING TO THIRD PARTIES By providing us with or allowing us to access Personal Data relating to individuals other than yourself (such as when you list other involved persons pertaining to company registration or registration of other entities with MBR), you are letting us know that you have the authority to send us those Personal Data or the authority to permit us to access those data in the manner described in this Privacy Policy. 4.5. SPECIAL CATEGORIES OF PERSONAL DATA We do not knowingly and purposefully collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). However, from our experience, we may not exclude that you, at your own discretion and on the basis of your own explicit consent, upload such personal data on the Software. Please note that although ID cards and other forms of official government issued documentation are processed, images contained therein are not technically processed by the Controller to allow or confirm a unique identification match. Therefore, such data is not to be considered biometric data, and consequently shall not be considered a special category of personal data. Please also note that although there are instances where biometric authentication may be utilised to access the Software, this process will be carried out on the basis of your explicit consent and the MBR will have no access to or controls on any biometric data that may be utilised by any third party identity verification providers to allow your access to the Software, as the MBR only receives a positive or negative check by such third party identity verification providers. Please also note that in case you do not consent to biometric authentication you may still opt for a manual verification but please bear in mind that such manual verification may not be as time efficient and may delay your access to the Software until such manual verification is completed. 4.6. IF YOU FAIL TO PROVIDE PERSONAL DATA Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have with you for the provision of our services via the Software. 5.0. WHY AND HOW WE USE YOUR PERSONAL DATA 5.1. WHY WE USE YOUR PERSONAL DATA We will only use your personal data when the Applicable Data Protection laws allow us to. Most commonly, we will use your Personal Data in the following circumstances: To allow you access and use of our services via the Software; For identification, security, authentication and verification proposes; To facilitate and expedite your interaction/s with Government agencies, Government bodies and other third parties; To abide by our legal requirements to collect/use and to keep such personal data for a predetermined period of time; For the performance of a task carried out in the public interest; For the performance of a task carried out in the exercise of official authority vested in us as a Government agency; For the prevention and detection of illegal or fraudulent behaviour; and for analytics purposes. 5.2. DETAILED PURPOSES AND LEGAL BASIS We have set out below, in a table format, a description of the possible ways we plan to use your Personal Data, and which of the legal bases we rely on to do so. Note that we may process your Personal Data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your Personal Data where more than one ground has been set out in the table below. PURPOSE OF PROCESSING CATEGORIES OF PERSONAL DATA LEGAL BASIS FOR PROCESSING To register you as a user of the Software; to allow you to access the Software Registration Data Contact Data Log-in Data Company Involvement Data Contractual Necessity Official Authority Public Interest Legal Obligations To manage our relationship with you; to communicate with you; to give you access to our service via the Software Registration Data Contact Data Log-in Data Company Involvement Data Profile Data Communications Data Contractual Necessity Official Authority Public Interest Legal Obligations To set up a record on our system Registration Data Contact Data Log-in Data Company Involvement Data Profile Data Identification Documents Data (if provided) Verification of Address Data (if provided) Source of Wealth Data (if provided) Know Your Customer (KYC) Data (if report is generated) Contractual Necessity Official Authority Public Interest Legal Obligations Consent To pass on certain information to public authorities (including the Malta Financial Services Authority and National Statistics Office) & compile internal statistics and reports Registration Data Company Involvement Data Profile Data Identification Documents Data (if provided) Verification of Address Data (if provided) Source of Wealth Data (if provided) Know Your Customer (KYC) Data (if report is generated Legal Obligation Public Interest Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (within the limits permitted by law). To allow you to upload your documents onto our Software Identification Documents Data (if provided) Verification of Address Data (if provided) Source of Wealth Data (if provided) Contractual necessity Consent Public Interest Official Authority To generate KYC reports for you, as requested by yourself through the Software Registration Data Company Involvement Data Identification Documents Data (if provided) Verification of Address Data (if provided) Source of Wealth Data (if provided) Know Your Customer (KYC) Data (if report is generated) Contractual necessity Official Authority To allow you to share documents, information and Know Your Customer (KYC) reports you have uploaded and/or generated on the Software with Government agencies, Government bodies, and other third parties (where applicable) Registration Data Company Involvement Data Profile Data Communications Data Identification Documents Data (if provided) Verification of Address Data (if provided) Source of Wealth Data (if provided) Know Your Customer (KYC) Data (if report is generated) Contractual necessity Consent Public Interest Official Authority Legal obligations To establish and investigate and suspicious behaviour in order to protect ourselves from risk and fraud Registration Data Company Involvement Data Profile Data Log-in Data Identification Documents Data (if provided) Verification of Address Data (if provided) Source of Wealth Data (if provided) Public Interest Official Authority Legal obligations To process and manage payments transactions (where applicable) Payments Data Registration Data Profile Data Contractual necessity Web & Software Analytics Analytics Data Official Authority Public Interest Legal Obligations Should we need to process your Personal Data for a new purpose in the future, which is entirely unrelated to the above, we will inform you of such processing in advance and you may exercise your applicable rights (as explained below) in relation to such processing. When relying on consent, mainly when choosing, at your own discretion, to upload documents to the Software, the consent is granted by you when registering on our site. 6.0. RETENTION We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal or reporting requirements. The criteria we use to determine what is ‘ necessary ’ depends on the nature of the particular personal data in question. Our normal practice is to determine whether there is/are any specific EU and/or national law(s) permitting or even obliging us to keep certain personal data for a period of time (in which case we will keep the personal data for the maximum period indicated by any such law) and if not, whether there are any laws and/or contractual provisions that may be invoked against us by you and/or third parties and if so, what the prescriptive periods for such actions are. In the latter case, We will keep any relevant personal data that we may need to defend ourselves against any claim(s), challenge(s) or other such action(s) by you and/or third parties. Where your personal data is no longer required by us, We will either securely delete or anonymise the personal data in question. We will generally retain your personal data for a maximum period of five (5) years from the closure of your account on the Software or after five (5) years of inactivity on your account. There are some exceptions to this retention period, namely: If you are under investigation or where we have identified possible fraudulent or other criminal activity, we may retain your personal data for longer and as required in order to cooperate with the relevant authorities; and If there is a legal dispute, we will retain your personal data for at least the entire duration of the dispute and as may be required in order to defend our rights in any subsequent claim or any subsequent proceeding arising from the same. Further details of retention periods for different aspects of your personal data are available in our retention policy which you can request by contacting us. 7.0. RECIPIENTS OF YOUR PERSONAL DATA As the Controller’s business partners, suppliers or service providers are responsible for certain parts of the overall functioning or operation of the Software, Personal Data is also processed by them for the above-mentioned purposes on behalf of the Controller. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow third-party service providers to use your personal data for their own purposes unless this is permitted or required by law, and only allow them to process your personal data for specified purposes and in accordance with our instructions, after thorough vetting of these partners and on the basis of strict data processing agreements. Furthermore, you have the faculty, at your own discretion, to share any documentation and/or reports you may seek to upload and/or generate through the software with Government agencies, Government bodies and other third parties. Such access to your personal data, unless required to do so by our legal obligations, is not done automatically by us and you may freely choose with whom to share such documentation and/or reports with. However, in such scenarios, the recipients of your personal data with whom you may choose to share personal data with through the Software will not be acting on our behalf but will be acting in their own capacity as data controllers separate and independent from us. We are not responsible for whatever these entities may do with your personal data and encourage you to read through their respective privacy policies and/or notices to find out more about how they handle your personal data. 7.1. DETAILS ON THE CATEGORIES OF RECIPIENTS OF THE PERSONAL DATA The third parties who we may disclose to and/or share your Personal Data with are, at the date of this Privacy Policy, the following: CATEGORY OF RECIPIENT PURPOSE OF PROCESSING Malta Information Technology Agency (MITA) Hosting of data under state of the art security protocols and our exclusive control Binderr Ltd Maintenance and support of our Software - with restricted access and under our strict controls Digital Application Providers To offer you our services on the Software and comply with our legal obligations, including the use of camera and/or recordings and audio permissions in relation to the verification of the user. Identity Verification Service Providers The IDV provider simply follows your instructions to check the ID against a database or perform a biometric "liveness" check. Auditors Compliance with our auditing obligations - with access granted only to essential personal data Advocates and/or Lawyers Compliance with our legal obligations or when necessary for the establishment, exercise or defence of legal claims. Subject Persons in terms of the Prevention of Money Laundering and Financing of Terrorism Regulations (PMLFTR) To offer you our services on the Software and comply with our legal obligations, during onboarding and due diligence as legally required by law. Government agencies, departments or entities and The Malta Police Force To offer you our services on the Software and comply with our legal obligations, in the public interest and/or our exercise of official authority Competent Authorities To offer you our services on the Software and comply with our legal obligations, in the public interest and/or our exercise of official authority in terms of the AML/CFT Laws. Other third parties with whom you choose to share your personal data To offer you our services on the Software Payment service providers (where necessary) To perform payment transactions and for the purposes of preventing fraud and enabling compliance with AML obligations 7.2. AUTHORISED DISCLOSURE Without prejudice to anything contained in this Privacy Policy and in the interest of full transparency, we reserve the right to disclose (and otherwise process) any relevant Personal Data relating to you which we may be processing (including in certain cases relevant IP addresses) to authorised third parties in or outside the EU/EEA if such disclosures are allowed under the Data Protection Laws (whether or not you have provided your consent) including but not limited to: For the purpose of preventing, detecting or suppressing fraud (for example, if you provide false or deceptive information about yourself or attempt to pose as someone else, we may disclose any information we may have about you in our possession so as to assist any type of investigation into Your actions); in the event of MBR being involved in a restructure, transfer or absorption into another Government department (or similar event analogously applicable to Government agencies); to protect and defend our rights (including the right to property), safety, or those of our affiliates, of users of our Software, of our members or even your own; to protect against abuse, misuse or unauthorised use of our Software; for any purpose that may be necessary for the performance of any agreement you may have entered into with us (including the request for provision of services by third parties) or in order to take steps at your request prior to entering into a contract; to comply with any legal obligations such as may arise by way of response to any Court subpoena or order or similar official request for Personal Data; or as may otherwise be specifically allowed or required by or under any applicable law, for example, under anti-money laundering legislation. 8.0. DATA ACCURACY All reasonable efforts are made to keep any Personal Data we may hold about you up to date and as accurate as possible. You can check the information that we hold about you at any time by contacting us in the manner explained above or by going on your profile page. If you find any inaccuracies, we will correct them and where required and in accordance with the law (provided that the law permits such deletion), delete them as necessary. Please see below for a detailed list of your legal rights in terms of any applicable data protection law. Kindly note that if any inaccuracies relates to any documentation you have uploaded onto the Software, you have the technical ability to delete such documentation unilaterally and upload the correct and/or updated documentation. If you require any assistance with this process please contact us. 9.0. INTERNATIONAL TRANSFERS Generally, the recipients of your Personal Data (as listed above) are based within the European Economic Area (EEA). However, if the processing of your Personal Data will involve a transfer of data outside the EEA, we will ensure that a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented: The transfer of your personal data is performed to countries, territories, or subject to arrangements or mechanisms that have been deemed to provide an adequate level of protection for personal data by the European Commission. Where we use service providers which are not subject to an adequacy mechanism, we will ensure that additional contractual and non-contractual safeguards and measures are put in place as required (including by incorporating specific contracts approved by the European Commission such as the Standard Contractual Clauses). Please Contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA. 10.0. DATA SECURITY We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. This ensures confidentiality and integrity at all times. At an organisational level, the handling of all information is governed by our comprehensive Information Security Policies. This is complemented by an Information Security Awareness Programme designed specifically to ensure we embrace security best practices whenever it comes to handling information. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a need-to-know business requirement. They will only process your Personal Data on our instructions or subject to a lawful ground, as well as their duty of confidentiality. We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. Despite all the above, we cannot guarantee that a data transmission or a storage system can ever be fully secure. For more information about our security measures please contact us in the manner described above. Authorised third parties acting as our data processors with permitted access to your Personal Data (as explained in this Privacy Policy) are specifically required to apply appropriate technical and organisational security measures that may be necessary to safeguard the Personal Data being processed from unauthorised or accidental disclosure, loss or destruction and from any unlawful forms of processing. 11.0. YOUR RIGHTS UNDER THE DATA PROTECTION LAWS 11.1. YOUR RIGHT OF ACCESS You may, at any time, with reasonable intervals, request us to confirm whether or not we are processing any Personal Data that concerns you and, if we are, you shall have the right to access that Personal Data and to the following information: what personal data we have, why we process them, who we disclose them to, how long we intend on keeping them for (where possible), whether we transfer them abroad and the safeguards we take to protect them, what your rights are, how you can make a complaint, where we got your personal data from and whether we have carried out any automated decision-making as well as related information. 11.2. THE RIGHT TO RECTIFICATION Although all reasonable efforts will be made to keep your Personal Data updated, you are kindly requested to inform us promptly of any changes. To this end you have the right to ask us to rectify inaccurate Personal Data and to complete incomplete Personal Data concerning you. We may seek to verify the accuracy of the data before rectifying it. 11.3. THE RIGHT TO ERASURE (THE RIGHT TO BE FORGOTTEN) You have the right to ask us to delete your Personal Data and we shall comply without undue delay but only where: The personal data are no longer necessary for the purposes for which they were collected; You have withdrawn your consent (in those instances where we process on the basis of your consent) and we have no other legal ground to process your personal data; You have successfully exercised your right to object (as explained below); Your personal data have been processed unlawfully; There exists a legal obligation to erase the data to which We are subject; or Special circumstances exist in connection with certain children’s rights. Please note that if you wish to delete any data related to any documentation you have uploaded onto the Software, you have the technical ability to delete such documentation and any metadata derived therefrom unilaterally. If you require any assistance with this process please contact us. In any case, we shall not be legally bound to comply with your erasure request if the processing of your Personal Data is necessary: For compliance with a legal obligation to which we are subject (including but not limited to our data retention obligations); or For the establishment, exercise or defence of legal claims. There are other legal grounds entitling us to refuse erasure requests although the two instances above are the most likely grounds that may be invoked by us to deny such requests. You may request the erasure by contacting us. 11.4. THE RIGHT TO DATA RESTRICTION You have the right to ask us to restrict (that is, store but not further process) your Personal Data but only where: The accuracy of your personal data is contested (see the right to data rectification above), for a period enabling us to verify the accuracy of the personal data; The processing is unlawful, and you oppose the erasure of your personal data; We no longer need the personal data for the purposes for which they were collected but you need the personal data for the establishment, exercise or defence of legal claims; or You exercised your right to object and verification of our legitimate grounds to override Your objection is pending. Following your request for restriction, except for storing your personal data, we may only process your Personal Data: Where we have your consent; For the establishment, exercise or defence of legal claims; For the protection of the rights of another natural or legal person; or For reasons of important public interest. You may request the restriction by contacting us. 11.5. THE RIGHT TO DATA PORTABILITY You have the right to ask us to provide your Personal Data (that you shall have provided to us) to you in a structured, commonly used, machine-readable format, or (where technically feasible) to have it 'ported' directly to another data controller, provided this does not adversely affect the rights and freedoms of others. This right shall only apply where: The processing is based on your consent or on the performance of a contract with you; and The processing is carried out by automated means. 11.6. THE RIGHT TO OBJECT TO CERTAIN PROCESSING In those cases where we process your personal data for the performance of a task carried out in the public interest, you shall have the right to object to processing of your personal data by us. For the avoidance of all doubt, when we process your personal data when this is necessary for the performance of a contract, when necessary for compliance with a legal obligation to which we are subject or when processing is necessary to protect your vital interests or those of another natural person, this general right to object shall not subsist. 11.7. RIGHT TO WITHDRAW CONSENT (WHEN WE PROCESS YOUR DATA ON THE BASIS OF CONSENT) In those cases where we process Personal Data on the basis of your consent (which we will never presume but which we shall have obtained in a clear and manifest manner from you), you have the right to withdraw your consent at any time and this, in the same manner as you shall have provided it to us. Should you exercise your right to withdraw your consent, we will determine whether at that stage an alternative legal basis exists for processing your Personal Data (for example, on the basis of a legal obligation to which we are subject) where we would be legally authorised (or even obliged) to process your Personal Data without needing your consent and if so, notify you accordingly. When we ask for such Personal Data, you may always decline, however should you decline to provide us with necessary data that we require to provide the services of the Software, we may not necessarily be able to provide you with such services (especially if consent is the only legal ground that is available to us). Please note that consent is not the only ground that permits us to process your Personal Data as there are various grounds that we rely on when processing your Personal Data for specific purposes. 11.8. THE RIGHT TO LODGE A COMPLAINT You also have the right to lodge complaints with the appropriate Data Protection Supervisory Authority. Since the Malta Business Registry is a Government Agency registered in Malta, our Lead Supervisory Authority is the Maltese Information and Data Protection Commissioner (IDPC). We kindly ask that you please attempt to resolve any issues you may have with us first (even though, as stated above, you have a right to contact the competent authority at any time). 11.9. WHAT WE MAY NEED FROM YOU When exercising your rights by contacting us, we may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response. 11.10. TIME LIMIT TO RESPOND We try to respond to all legitimate requests within one month (unless a shorter period is required by law). Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. 12.0 AUTOMATED PROCESSING Your personal data will not be used for any decision solely taken on the basis of automated decision-making processes. 13.0. COOKIES If you are using a website instance of the Software, the Software uses cookies. For further information on what cookies are, which cookies we use, how and why we use cookies, and how you can control which cookies are dropped, please read our Cookies Policy. Advisory Committee Registrar / CEO Deputy Registrar / COO Registry Unit Compliance Unit Legal & Enforcement Unit Insolvency & Receirvership Service Unit Finanance & Admistration Unit Human Resources & Development Unit Information & Communication Technologies Unit Internation Affairs, Research & Communications Unit Money Laundering Reporting Officer Audit Committee Internal Audit Unit

TEST | C5567 Jurastiction: Malta TEST description Reporting Year Doc 5 | 03/07/2026 Download

We can’t find the page you’re looking for This page doesn’t exist. Go to Home and keep exploring. Go to Home