The small print, in plain words
Privacy policy
What we collect, why, how long we keep it and how to reach us about it. We collect as little as we can.
Who we are
This website is run by Operations &bold. Ltd, trading as HAIKUU (“HAIKUU”, “we”, “us”). We are the data controller for the personal data described here.
- Company
- Operations &bold. Ltd
- Address
- Block A, Level 1, Halmann Business Centre, Mosta Road, Lija LJA 2021, Malta
- hello@haikuu.com
- Phone
- +356 7907 9166
We are not required to appoint a data protection officer. Questions about privacy go to the email above and are answered by a partner of the company.
What we collect and why
| Situation | Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|---|
| You send us an enquiry (contact form or email) | Name, email address, the services you are interested in, your message, timing, rough budget | To reply, discuss the project and prepare a proposal | Steps at your request before a contract (6(1)(b)); our legitimate interest in answering messages (6(1)(f)) |
| You become a client | Contact details, correspondence, project and billing records | To deliver the work, invoice and keep accounts | Contract (6(1)(b)); legal obligation for accounting and tax records (6(1)(c)) |
| You apply for a job or send an open application | Name, contact details, CV, portfolio links and anything else you choose to send | To assess your application and reply | Steps at your request before a contract (6(1)(b)); consent if you ask us to keep your details for future roles (6(1)(a)) |
| You browse the site | Technical data our hosting provider records automatically: IP address, browser, pages requested, date and time | To deliver the site securely and fix problems | Legitimate interest in a secure, working website (6(1)(f)) |
| You choose cookie settings | Your choice, a random identifier and the date | To respect your choice and show we asked | Legal obligation (6(1)(c)) and legitimate interest (6(1)(f)) |
We do not use your data for automated decision-making or profiling, we do not buy personal data, and we never sell or rent it. Please do not send us special category data (for example about health) in an enquiry; we do not need it.
Where the data comes from
Almost always from you. If someone refers you to us, we may receive your name and contact details from them; we will tell you so when we first write.
Who we share it with
Only with service providers who help us run the studio, under contracts that oblige them to protect the data and use it only on our instructions (GDPR art. 28):
- our website hosting provider;
- our email and file-storage providers;
- a form-delivery service, if the contact form sends messages through one;
- our accountants, auditors and legal advisers, where needed;
- public authorities, where the law requires it.
Transfers outside the EU
Some providers may process data outside the European Economic Area. When they do, we rely on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework for certified companies) or on the Commission’s standard contractual clauses, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
How long we keep it
- Enquiries that do not lead to work: up to 24 months after our last exchange, then deleted.
- Client records: for the length of the engagement and then as long as Maltese accounting and tax law requires (generally up to 10 years), plus any period needed for legal claims.
- Job applications: 6 months after the role is filled, or 12 months if you agree that we keep them for future roles.
- Hosting logs: as set by our hosting provider, normally no more than 30 days.
- Your cookie choice: 180 days, after which we ask again.
Your rights
Under the GDPR you can ask us to:
- confirm whether we hold data about you and give you a copy (access);
- correct data that is wrong or incomplete (rectification);
- delete data (erasure), restrict how we use it, or move it to another provider in a common format (portability);
- stop using data that we process on the basis of legitimate interests (objection);
- withdraw consent at any time, without affecting what we did before you withdrew it. For cookies, use .
Write to hello@haikuu.com. We reply within one month, free of charge, and may need to confirm your identity first.
You also have the right to complain to the Maltese supervisory authority: the Office of the Information and Data Protection Commissioner, Floor 2, Airways House, Triq Il-Kbira, Tas-Sliema SLM 1549, Malta, idpc.org.mt, +356 2328 7100. We would appreciate the chance to put things right first.
Security
The site is served only over an encrypted connection (HTTPS). Access to enquiries and client files is limited to the people who need it, protected by strong passwords and two-factor authentication, and our systems are kept up to date. We collect only what we need and delete what we no longer need. No method is perfectly secure; if a breach affecting your data occurs, we will notify the regulator and, where the law requires, you.
Children
This site is for businesses and professionals and is not aimed at children. We do not knowingly collect data from anyone under 16. If you believe a child has sent us personal data, tell us and we will delete it.
Links to other websites
Our case studies link to live websites run by our clients and others. Their privacy practices are their own; please read their policies.
Changes
We update this policy when our practices or the law change. The date at the top shows the latest version. If a change matters to you, for example a new purpose, we will tell you clearly before it applies.