Privacy Policy

PRIVACY POLICY & COOKIE POLICY

Effective Date: March 07, 2025
Last update: July 15, 2025

INTRODUCTION

At SISU TALENTS, we are committed to protecting your privacy and safeguarding your personal data. We understand the importance of maintaining the confidentiality of information entrusted to us and are dedicated to processing your data with transparency and fairness in strict accordance with applicable data protection laws.

This Privacy Policy outlines how we collect, use, store, protect, and disclose personal information in compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”). We have designed this policy to provide clear and comprehensive information about our data handling practices, enabling you to make informed decisions about sharing your personal information with us.

We encourage you to read this Privacy Policy carefully to understand our practices regarding your personal data and how we will treat it. By using our services or website or otherwise providing us with your personal information, you acknowledge that your personal data will be processed in accordance with this Privacy Policy.

1. DATA CONTROLLER

Your personal data is collected by SISU TALENTS, registered address 168, St Christopher Street, Valletta VLT 1467, Malta, registered with the Maltese Business Registry under number C 111930.

By Article 24 of the GDPR, SISU TALENTS acts as the data controller for all personal data processed under this policy. This means we determine the purposes and means of processing your personal data and are responsible for implementing appropriate technical and organizational measures to ensure and demonstrate compliance with data protection principles.

We have appointed a Data Protection Officer (“DPO”) who is responsible for overseeing questions with this Privacy Policy and ensuring our ongoing compliance with data protection laws. Our DPO provides advice on data protection obligations, monitors compliance, and acts as a contact point for data subjects and supervisory authorities.

You can contact our Data Protection Officer at any time by email at support@sisutalents.com or by writing to our registered address with the reference “For the attention of the Data Protection Officer.”

2. DATA COLLECTION AND PURPOSES

2.1 Types of data we collect

SISU TALENTS collects and processes personal data that is adequate, relevant, and limited to what is necessary for the purposes for which it is processed. In line with the principle of data minimization, we strive to collect only the information required to provide our services effectively.

We primarily collect data directly from you through various interactions:

When you request information about our services: We collect your contact details and information about your specific requirements to provide you with relevant information.
When you visit our website and use our services: We automatically collect certain information about your device, browsing actions, and patterns. This is collected using cookies and similar technologies, detailed further in Section 8 of this policy.
When you contact our customer service team: We record the nature of your inquiry, the correspondence that takes place, and any actions taken to resolve your query.
When you participate in surveys or provide feedback: We collect your opinions, preferences, and experiences to improve our services.

The personal data we collect may include:

Identity information: This includes your full name, title, gender, age, date of birth, and other identifiers that allow us to personalize our communications with you and comply with age verification requirements where applicable.
Contact information: We collect your email address, postal address, telephone number, and social media handles to communicate with you about our services, respond to your inquiries, and provide customer support.
Communication records: We maintain copies of correspondence with our customer service team, including email communications, live chat transcripts, and records of telephone conversations (with prior notification).
Feedback data: This includes your responses to surveys, questionnaires, and any opinions or comments you share with us about our services or your experience with SISU TALENTS.
Technical information: When you visit our website, we automatically collect technical data about your equipment, browsing actions, and patterns. This includes your IP address, login information, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website. We may also collect information about how you use our website, including the pages you view, the links you click, and other actions you take.
Profile data: Information about your preferences, interests, and choices when using our services, which helps us tailor our offerings to your needs.
Usage data: Information about how you use our website, products, and services, including the features you use, the time spent on our platform, and your interaction patterns.
Transaction data: Details about purchases or orders you make through our services, including payment information (though we do not store complete payment card details).

2.2 Special categories of personal data

SISU TALENTS does not intentionally collect any special categories of personal data (also known as sensitive personal data) as defined under the GDPR, which includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, or data concerning a person’s sex life or sexual orientation.

If you inadvertently or intentionally submit such information to us, we will treat it as sensitive personal data and process it in accordance with applicable laws.

2.3 Children’s data

Our services are intended for use only by individuals who have reached the age of majority in their country of residence (typically 18 years or older, but may vary depending on local laws). We do not knowingly collect or process personal data from individuals who have not reached the legal age of majority applicable in their jurisdiction. If we become aware that we have collected personal data from someone who has not reached the applicable age of majority without verification of parental consent, we take steps to remove that information from our servers.

2.4 Purposes of processing

SISU TALENTS processes your personal data for specific, explicit, and legitimate purposes. We have outlined these purposes below to ensure you have a clear understanding of how we use your information:

2.4.1 Administrative management

Processing and fulfilling orders, including managing the delivery of products or services
Creating and maintaining customer accounts
Generating and issuing invoices
Managing payments and collections
Maintaining accounting records and complying with tax regulations
Verifying identity when required for service provision

2.4.2 Customer relationship management

Managing customer feedback and reviews to improve our services
Conducting satisfaction surveys to understand customer needs and preferences
Administering loyalty programs and reward schemes
Personalizing customer experiences based on preferences and past interactions
Providing customer support and assistance
Notifying you about changes to our terms or privacy policy
Responding to your inquiries and fulfilling your requests

2.4.3 Complaint handling

Providing effective after-sales service
Processing data subject requests (access, rectification, deletion, etc.)
Managing disputes and addressing complaints
Investigating and resolving technical issues
Maintaining records of complaint resolutions for service improvement

2.4.4 Marketing and website improvement

Analyzing website traffic and user behavior to enhance user experience
Conducting customer segmentation for targeted marketing
Optimizing website performance and functionality
Developing new products, services, or features based on user preferences
Delivering relevant content and advertisements
Measuring the effectiveness of promotional campaigns
Conducting market research and analysis

For each processing activity, we maintain appropriate records as required by Article 30 of the GDPR, documenting the categories of data processed, purposes, data recipients, security measures, retention periods, and international transfers where applicable.

2.5 Tax Data Collection (DAC7 Compliance)

In accordance with our obligations under the EU Directive 2021/514 (DAC7), SISU TALENTS is legally required to collect and retain certain tax-related information from Sellers operating on our platform. This information may include:

Full legal name
Date of birth (for individuals)
Primary residential or business address
Tax Identification Number (TIN)
VAT number (if applicable)
Company registration number (if applicable)
Details of income or earnings generated through the platform

This information is collected solely for the purpose of fulfilling our obligations to national tax authorities and may be disclosed as required by law. The legal basis for this processing is compliance with a legal obligation (Article 6(1)(c) GDPR).

Even if you close your account or request erasure of your personal data, we are legally obligated to retain this information for a period of five (5) years following the end of the relevant tax reporting period.

3. LEGAL BASIS FOR PROCESSING

Under the GDPR, we must have a lawful basis for processing your personal data. We rely on different legal bases depending on the specific processing activity:

3.1 Contractual necessity

We process your personal data where it is necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering into a contract. This includes:

Processing your orders and fulfilling our contractual obligations
Creating and managing your customer account
Providing customer support related to our services
Processing payments and managing invoicing
Delivering products or services you have purchased
Communicating with you about operational matters related to our services

3.2 Legitimate interests

We process your personal data when necessary for the purposes of our legitimate interests or those of a third party, provided these interests do not override your fundamental rights and freedoms. Our legitimate interests include:

Improving and developing our products and services
Protecting our business against fraud and other illegal activities
Ensuring network and information security
Managing our customer relationships
Conducting direct marketing of products and services that may be of interest to you as an existing customer
Analyzing usage patterns to improve user experience
Enforcing or applying our terms of service and other agreements

For each legitimate interest, we conduct a balancing test to ensure that our interests do not override your rights and freedoms.

3.3 Legal obligation

We process your personal data when necessary to comply with a legal obligation to which we are subject, including:

Maintaining records for tax purposes
Complying with accounting and financial reporting requirements
Responding to requests from regulatory bodies or law enforcement
Complying with court orders or legal proceedings
Meeting employment law obligations
Fulfilling statutory record-keeping requirements

3.4 Consent

We process your personal data based on your specific, informed, and unambiguous consent for certain activities, such as:

Sending marketing communications where not justified by legitimate interests
Placing non-essential cookies on your device
Processing special categories of personal data, when applicable
Using your data for purposes that are not covered by another legal basis

Where we rely on consent as a legal basis, you have the right to withdraw your consent at any time. This will not affect the lawfulness of processing based on your consent before its withdrawal.

4. DATA HOSTING AND SECURITY

4.1 Data storage location

All personal data collected by SISU TALENTS is hosted on secure servers located within the European Union. We have selected hosting providers that comply with strict data protection standards and implement appropriate security measures.

4.2 Security measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk associated with the processing of personal data. These measures are designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

Our security measures include:

Encryption and pseudonymization: We encrypt personal data during transmission and at rest where appropriate. We also implement pseudonymization techniques to enhance data protection.
Access controls: We maintain strict access controls, ensuring that only authorized personnel with a legitimate need have access to personal data.
Authentication measures: We use multi-factor authentication for accessing systems containing personal data.
Regular security assessments: We conduct periodic vulnerability assessments and penetration testing to identify and address potential security weaknesses.
Security monitoring: We employ continuous monitoring systems to detect and respond to security incidents in a timely manner.
Backup and recovery procedures: We maintain regular backups of personal data to ensure availability and restore access in the event of a physical or technical incident.
Security awareness training: All our staff receive regular training on data protection and security best practices.
Documented security policies: We maintain comprehensive security policies and procedures, which are regularly reviewed and updated.

4.3 Data breach procedures

In the event of a personal data breach, we have established procedures to detect, report, and investigate the breach. If the breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach.

If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly unless we have implemented appropriate technical and organizational protection measures or subsequent measures that ensure the high risk is no longer likely to materialize.

5. DATA RECIPIENTS

SISU TALENTS is the primary recipient of your personal data. We understand the trust you place in us when sharing your data and are committed to maintaining this trust. We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

We may, however, share your data with the following categories of recipients:

5.1 Service providers

We may share your personal data with carefully selected third-party service providers who perform certain functions on our behalf. These service providers are bound by contractual obligations to keep personal information confidential and use it only for the purposes for which we disclose it to them. Our service providers include:

IT and system administration service providers
Cloud hosting providers
Payment processors
Delivery and logistics companies
Customer service platforms
Marketing and communication platforms
Analytics providers
Survey and feedback collection tools

5.2 Professional advisers

We may share your personal data with professional advisers including:

Lawyers
Auditors
Insurers
Accountants
Consultants

These advisers provide professional services to us and are bound by contractual confidentiality obligations.

5.3 Regulatory bodies and law enforcement

We may disclose your personal data to regulatory bodies, government agencies, law enforcement officials, and other authorities when:

Required to do so by law
In response to a valid legal request, such as a court order, government investigation, or other legal process
When we believe disclosure is necessary to prevent physical harm, financial loss, or to report suspected illegal activity

5.4 Business transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or other similar event, your personal data may be transferred to our successor or assigned if permitted by and done per applicable laws.

All third parties with whom we share your data are required to respect the security of your personal data and to treat it following the law. We ensure this through appropriate contractual clauses and due diligence procedures.

6. DATA RETENTION

We retain your personal data only for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider:

The amount, nature, and sensitivity of the personal data
The potential risk of harm from unauthorized use or disclosure
The purposes for which we process the data and whether we can achieve those purposes through other means
The applicable legal, regulatory, tax, accounting, or other requirements

Specifically:

6.1 Customer data

Active customer accounts and related personal data are retained for the duration of our contractual relationship plus a reasonable period thereafter to address any follow-up queries or issues.
After the end of the contractual relationship, we may retain certain data for up to ten (10) years to comply with legal obligations, including tax, accounting, and financial reporting requirements.
Invoice and payment information is retained in accordance with tax and accounting laws, typically for seven (7) to ten (10) years.

6.2 Marketing data

For individuals who have provided consent for marketing communications, we retain contact details and preference information for three (3) years from the last active interaction with our marketing communications.
If you withdraw your consent to receive marketing communications, we will maintain a record of your preference not to be contacted to ensure we respect your wishes.

6.3 Website usage data

Cookies and similar technologies data is retained according to our Cookie Policy, typically no longer than 13 months.
Anonymized analytical data may be retained indefinitely as it can no longer be associated with an identifiable individual.

6.4 Customer service communications

Customer service inquiries and related correspondence are retained for two (2) years after resolution of the inquiry, or longer if required for legal purposes.
Records of complaints and their resolution are retained for three (3) years to help improve our services and address any recurring issues.

When your personal data is no longer required, we will securely delete or anonymize it so that it can no longer be associated with you. In some circumstances, we may anonymize your personal data for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

6.5 Tax-related seller data

For users who act as Sellers on our platform, we collect tax identification and related information as required under the EU Directive 2021/514 (DAC7). This data is retained for a minimum of five (5) years following the end of the tax year in which the Seller was last reported, even if the Seller’s account is closed or deleted before that time. This retention period is required by law and overrides any general account deletion or data erasure requests under Article 17 of the GDPR.

7. YOUR RIGHTS

Under the GDPR, you have several important rights with respect to your personal data. We are committed to respecting these rights and have implemented procedures to facilitate your exercise of them.

7.1 Right to access

You have the right to request a copy of the personal data we hold about you, as well as information about how we use it. This includes the purposes of processing, categories of personal data concerned, recipients of the data, retention period, and information about your other data protection rights.

7.2 Right to rectification

You have the right to request correction of any inaccurate personal data we hold about you. You also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

7.3 Right to erasure

You have the right to request the deletion of your personal data in certain circumstances, such as:

The personal data is no longer necessary for the purposes for which it was collected
You withdraw your consent (where consent was the legal basis for processing)
You object to the processing and there are no overriding legitimate grounds for the processing
The personal data has been unlawfully processed
The personal data must be erased for compliance with a legal obligation

This right is not absolute and may be limited by our legal obligations or legitimate interests in certain circumstances.

7.4 Right to restriction of processing

You have the right to request restriction of processing of your personal data in certain circumstances, including:

You contest the accuracy of the personal data
The processing is unlawful, but you oppose erasure
We no longer need the data for the original purpose, but you require it for legal claims
You have objected to processing pending verification of whether our legitimate grounds override yours

7.5 Right to data portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You also have the right to request that we transmit this data directly to another controller, where technically feasible, provided that the processing is based on consent or contract and is carried out by automated means.

7.6 Right to object

You have the right to object to the processing of your personal data in certain circumstances, including:

Processing based on legitimate interests or for the performance of a task in the public interest
Direct marketing (including profiling)
Processing for scientific or historical research or statistical purposes

Upon receiving an objection to processing based on legitimate interests, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

7.7 Rights related to automated decision-making and profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless:

It is necessary for entering into or performing a contract between you and us
It is authorized by EU or Member State law applicable to us
It is based on your explicit consent

SISU TALENTS does not currently make decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals.

7.8 How to exercise your rights

To exercise any of these rights, please contact us at: support@sisutalents.com or write to our registered address. To protect your privacy and security, we may require you to verify your identity before processing your request.

We will respond to all legitimate requests within one month. If your request is particularly complex or you have made several requests, we may need to extend this period by up to two additional months. If this is the case, we will notify you and keep you updated on the progress of your request.

You will not have to pay a fee to access your personal data or to exercise any of your other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

7.9 Right to complain to a supervisory authority

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement. The supervisory authority in Malta is the Office of the Information and Data Protection Commissioner (IDPC), which can be contacted at:

Office of the Information and Data Protection Commissioner Level 2, Airways House High Street Sliema SLM 1549 Malta Email: idpc.info@idpc.org.mt Phone: +356 2328 7100

8. COOKIE MANAGEMENT POLICY

A cookie is a small text file that our website may store on your device when you visit our site. SISU TALENTS uses various types of cookies to enhance your browsing experience, improve our services, and provide tailored content and advertising.

8.1 Functional cookies

Functional cookies are essential for the proper functioning of our website. They enable core features such as secure login, maintaining your session, remembering your preferences, and accessing your personal account.

These cookies do not gather information about you that could be used for marketing or tracking where you have been on the internet. Without these cookies, certain services you have requested cannot be provided.

Examples: Session cookies, authentication cookies, security cookies
Retention period: Session duration (deleted when you close your browser) or short-term persistence (typically up to 24 hours)
Impact of refusal: Without these cookies, you may not be able to use our website normally or access secure areas

8.2 User experience optimization cookies

These cookies allow us to optimize our website’s performance and adapt its presentation to your preferences. They collect information about how you use our website, helping us understand which parts of our website are most interesting and useful, and how visitors move around our site.

These cookies remember your preferences (such as language or region) to provide an enhanced, personalized web experience.

Examples: Preference cookies, UI customization cookies
Retention period: 13 months
Impact of refusal: You may not benefit from a personalized browsing experience, and certain features may not function optimally

8.3 Technical performance cookies

Technical performance cookies help us monitor our website’s performance, detect problems, enhance security, and identify malicious activity. They collect information about how you use our website, such as which pages you visit most often, if you encounter error messages, and how effective our navigation paths are.

This information allows us to improve the quality of our services and enhance website functionality.

Examples: Load balancing cookies, error monitoring cookies, analytical cookies
Retention period: 13 months
Impact of refusal: No significant impact on your browsing experience, but it may limit our ability to optimize our website’s performance

8.4 Audience measurement cookies

These cookies allow us to analyze website traffic and usage patterns to improve our services and user experience. They collect anonymous information about how visitors use our website, which pages are most popular, where visitors come from, and whether they encounter errors.

We use this information to compile reports and help us improve the site. The data collected is aggregated and anonymous.

Examples: Analytics cookies, statistics cookies
Retention period: 13 months
Impact of refusal: No impact on your browsing experience, but it limits our ability to understand user behavior and improve our website

8.5 Advertising cookies

Advertising cookies help us deliver relevant advertisements based on your interests and limit the number of times you see an advertisement. They track which advertisements you have already seen to avoid showing you the same ones repeatedly and measure the effectiveness of our advertising campaigns.

These cookies are usually placed by third-party advertising networks with our permission.

Examples: Third-party advertising cookies, retargeting cookies
Retention period: 13 months
Impact of refusal: No impact on your browsing experience, but advertisements may be less relevant to your interests

8.6 Social network cookies

Our website may include buttons or modules from social networks (such as Facebook, Instagram, X, LinkedIn…) that allow you to share content on these platforms. When you use these features, the relevant social network may set cookies on your device that track your browsing activity, even if you don’t click on the buttons.

We have no control over the process that social networks use to collect information about your browsing activity. We recommend consulting the privacy policies of these social networks for more information about their cookies and how you can manage them.

Retention period: Determined by the social network
Impact of refusal: You may not be able to use social sharing features

8.7 Managing your cookie preferences

You can manage your cookie preferences in several ways:

Our cookie management tool: We provide a cookie management tool on our website that allows you to select which types of cookies you accept or reject.
Browser settings: Most web browsers allow you to control cookies through their settings. You can usually find these settings in the “Options” or “Preferences” menu of your browser. To understand these settings, the following links may be helpful:
Third-party tools: You can also visit www.aboutcookies.org or www.youronlinechoices.eu for comprehensive information on how to manage cookies in various browsers.

Please note that restricting cookies may impact your experience on our website, as some features may not function correctly.

9. INTERNATIONAL TRANSFERS

SISU TALENTS does not transfer your personal data outside the European Economic Area (EEA). All data processing activities are conducted within the EEA, ensuring that your data is protected by the high standards of data protection required by the GDPR.

In the event that we need to transfer your personal data outside the EEA in the future, we will ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR, such as:

Transferring to countries that have been deemed to provide an adequate level of protection by the European Commission
Using specific contracts approved by the European Commission (Standard Contractual Clauses) that give personal data the same protection it has in Europe
Implementing binding corporate rules for transfers within a corporate group

Any changes to our international transfer practices will be communicated through updates to this Privacy Policy.

10. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable laws and regulations. When we make changes to this Privacy Policy, we will update the “Effective Date” at the top of this document and take steps to inform you of significant changes, such as:

Displaying a prominent notice on our website
Sending you an email notification if we have your contact information
Obtaining your consent again if required by applicable law

We encourage you to review this Privacy Policy periodically to stay informed about our data protection practices. Your continued use of our services after any changes to this Privacy Policy constitutes your acceptance of the revised policy.

11. CONTACT US

If you have any questions about this Privacy Policy, our data practices, or would like to exercise your rights, please contact us using the following details:

Email: support@sisutalents.com

You can also contact our Data Protection Officer at the same email address with the subject line “For the attention of the Data Protection Officer.”

We are committed to addressing your concerns and resolving any issues regarding your personal data promptly and effectively.