Privacy policy

Kosmic has developed this privacy notice because we want you to feel confident about the privacy and security of your personal information. Please read it carefully, so that you are aware of how and why we are using such information and what your rights are under data protection legislation.

Applicability of this notice

This privacy notice has been drafted in accordance with the provisions of the General Data Protection Regulation — Regulation (EU) 2016/679 (the "GDPR") — and applies in all instances where Kosmic acts as a controller of personal data relating to users of our website. The terms "us", "we" and "our" refer to Kosmic; "you" and "your" refer to the data subject.

Amendments

We may make changes to this privacy notice from time to time and will identify the changes we have made on this page. Where a change materially affects the way in which we collect or use your personal information, we will notify you of the change and you shall have the right to object to it or withdraw your consent.

Personal data

"Personal data" or "personal information" means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect and process personal data that you voluntarily give us when you use our website — for example, when you fill in the contact form you provide us with your name, email address, message, selected interests and timing, and optionally your company and phone number.

In addition, we may use technology to collect aggregated data, such as statistical data about website usage. Aggregated data may be derived from your personal data but is not considered personal data in law, as it does not directly or indirectly reveal your identity. If we ever combine aggregated data with your personal data so that it can identify you, we treat the combined data as personal data used in accordance with this notice.

How we use your data

When you fill in the contact form on this website, we use the personal information submitted only to respond to your message or act on your request. This information will not be kept longer than necessary and will be deleted once your request has been dealt with.

The provision of your personal data is not a statutory or contractual requirement — it is your choice whether to provide it. However, without your name and email address we will not be in a position to respond to your message.

You may withdraw your consent to the processing of your personal data at any time. Such withdrawal does not affect the legality of any processing carried out on the basis of your consent before its withdrawal.

Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy policies.

Data sharing

As a general rule, any information gathered through the use of our website is used solely by us and, save as otherwise permitted herein and/or required by law, will not be transferred to third parties. We may, however, have to share your personal data with:

selected individuals within our company;
our intra-group companies and affiliates; and
our agents and third parties that provide services to us.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes, and only permit them to process it for specified purposes and in accordance with our instructions.

Data security and data retention

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal information to those who have a business need to know it, and they are subject to a duty of confidentiality. Details of these measures may be obtained by emailing christian.agius@kosmic.mt.

Personal information is not kept for longer than necessary and is deleted once your request has been dealt with, unless we are required to keep it due to a statutory obligation and/or accepted standards (including where processing may be necessary for the establishment, exercise or defence of legal claims).

Access logs and analytics

If you read or download information from our site, we automatically collect and store standard technical information such as: the requested page or download; whether the request was successful; the date and time of access; the internet address from which the site was accessed; and the operating system and browser used.

Server access logs are separate from optional analytics. Google Analytics is loaded through Google Tag Manager only after you accept analytics in our cookie popup. Its processing can include cookie identifiers, page addresses, events, and browser or device information. Analytics consent is optional and can be withdrawn in Cookie settings in the footer. Read our cookie policy for storage durations and details of Google’s processing, which may take place outside the European Economic Area.

When direct form sending is configured, EmailJS and our email provider process the enquiry details you submit so we can respond. The form loads EmailJS when you submit, rather than on every page visit. When the form prepares an email instead, no enquiry is sent until you send it through your email app.

Marketing

Any marketing would be carried out primarily by email, and Kosmic shall always seek your prior consent. You may withdraw consent to processing for marketing purposes at any time by emailing christian.agius@kosmic.mt, or by using the unsubscribe link in any marketing email you receive. Withdrawal does not affect the lawfulness of processing carried out before it.

Use of cookies

Our website uses cookies — small pieces of information a website transfers to your device for record-keeping purposes. For further information, please refer to ourcookie policy.

Your rights

For as long as we retain your personal data, you have certain rights in relation to it, including:

Right of access — to ascertain the personal data we hold about you and receive a copy of it;
Right to rectification — to update or correct any inaccurate personal data we hold about you;
Right to erasure — in certain circumstances, to request that we delete the personal data we hold about you;
Right to object — to request that we cease processing based on our, or a third party's, legitimate interest;
Right to restriction — to request that we stop using your personal data in certain circumstances;
Right to portability — to receive certain personal data you provided to us in a structured, commonly used, machine-readable format;
Right to withdraw consent — where processing is based on your consent, at any time and without affecting prior processing;
Right to be informed of the source — where your personal data was not provided to us directly by you; and
Right to complain — to lodge a complaint with the supervisory authority for data protection matters.

Please note that under applicable law, your rights in relation to your personal data are not absolute.

You may exercise these rights by contacting us atchristian.agius@kosmic.mt. If you consider that our processing of your personal information infringes data protection laws, you have a legal right to lodge a complaint with a supervisory authority. In Malta, this is theInformation and Data Protection Commissioner.