This page explains what Karen Vella — EU Rights Advisory does with the information you give it, and what you can ask us to do about it. It is written to be read, not to be survived.
The short version: we collect what we need to answer your question, we keep it to ourselves, and the advice itself is never sent by email.
Who is responsible
The data controller is Karen Vella — EU Rights Advisory, [ registered address ], [ company registration number, if any ]. You can reach us about anything on this page at .
[ If you have appointed a data protection officer, name them here. Most practices this size have not, and are not required to. ]
What we collect, and why
When you send an enquiry we ask for:
- <strong>Your name and email address</strong>, so we can reply and so your conversation is yours.
- <strong>Your nationality and the country your problem concerns.</strong> Which EU rules apply depends on both, so without them an answer is guesswork.
- <strong>What happened</strong>, in your own words, and whether you have already contacted anyone about it.
- <strong>Any documents you choose to attach</strong> — a refusal letter, a decision, a form. These often contain a lot about you. You decide what to send; nothing is required.
If you pay for an answer, we also hold the date, the amount and a payment reference. We never see or store your card number.
If you create an account, we hold your name, your email address and an encrypted form of your password that cannot be read back.
Our lawful basis
We handle your information to take steps at your request before entering a contract, and then to perform that contract — in plain terms, to answer the question you asked us. Keeping records of what we advised and what was paid is a legal obligation and our legitimate interest in being able to account for our own work.
A document you attach may contain special category data — health, for example, or information that reveals your ethnic origin or immigration situation. Where it does, we handle it because you have made it available to us for the purpose of obtaining legal advice, and because it may be necessary for the establishment, exercise or defence of legal claims. [ Have this paragraph checked: it is the one a lawyer will want to look at hardest. ]
Who else sees it
Not many, and never for marketing. We do not sell anything to anybody.
- <strong>Our hosting provider</strong>, [ name, country ], which runs the servers this site sits on.
- <strong>Brevo</strong>, which delivers our email. Our notification emails deliberately carry no detail about your case — only that there is something new and a link to read it here.
- <strong>Stripe</strong>, which processes payments. You enter your card details on Stripe’s own pages; they never pass through this site.
- [ Anyone else — an accountant, a professional indemnity insurer, a regulator. List them. ]
We would only hand your information to an authority if the law required it, and we would tell you unless we were forbidden to.
Where it is kept
Documents you attach are stored on the website’s own server, outside the ordinary media library and behind rules that stop them being fetched directly. They can only be opened from inside the practice’s dashboard, by someone signed in with permission to do so.
[ Say where your host’s servers are. If any provider you use is outside the EU, say which, and on what basis the transfer is made — this is the section a supervisory authority looks for. ]
How your conversation is protected
Advice about your situation should not sit in an email that can be forwarded or read over your shoulder, so it never travels by email at all. It lives on a page reachable only by a long secret link sent to you, and nowhere else.
Those links expire after 90 days, so an old email does not stay a key forever. If yours stops working, you can ask for a new one and it will be sent to the address the enquiry was made from — never to whoever asked.
These pages are not indexed by search engines, are not cached, and pass no referrer to any site you click through to.
How long we keep it
[ This is yours to decide, and it is the question people ask most. A workable shape: enquiries that go nowhere are deleted after X months; cases we advised on are kept for Y years, because that is how long a claim could be brought and how long our insurer requires; records of payment are kept for Z years for tax. Put real numbers in and we will hold ourselves to them. ]
What you can ask us to do
You have the right to see what we hold about you, to have it corrected, to have it deleted, to restrict or object to what we do with it, and to receive it in a portable form. You can exercise all of these by writing to us — and for the first and last of them, you do not even need to ask.
Sign in to your account and, under My account → Your data, you can download everything we hold about you as a file, and you can request deletion. Deletion is a request rather than a button because some records have to be kept: an invoice has a statutory retention period, and a case we are mid-way through advising on cannot be half-erased. You will get a reply saying exactly what went, what stayed, and why.
If you are not happy with how we have handled this, you can complain to the Information and Data Protection Commissioner in Malta, or to the supervisory authority where you live. We would rather you told us first.
Changes
If this page changes in a way that matters, we will say so here and date it. [ Last updated: add the date when you publish. ]