Privacy policy

Who we are

Kosta is a sea safety planning service for Malta, operated from Malta. This policy covers the kostamalta.com website. The Kosta application at app.kostamalta.com is covered separately.

If you have a question about this policy or about your data, write to info@kostamalta.com.

This site sets no cookies

That is why you were not asked to accept any. We use Cloudflare Web Analytics, which was built to measure a website without identifying the people visiting it. In Cloudflare’s own words, it does not use "any client-side state, like cookies or localStorage, for the purposes of tracking users", and it does not "fingerprint individuals via their IP address, User Agent string, or any other data".

Nothing is written to your browser’s storage. There is no consent banner because there is nothing to consent to storing.

We previously used Google Analytics. We removed it: the only way to run it without cookies also stopped it reporting anything at all, and we were not willing to add a consent banner to get it back.

What we collect

This site has no accounts, no forms and no payments, so we collect nothing you type.

When you load a page, a small script reports the page you looked at, the site you arrived from, your browser and device type, your rough country, and how quickly the page loaded. Cloudflare deliberately does not log query strings, to avoid picking up anything sensitive that might be in a link.

Without a cookie or any other identifier there is no way to join these reports up into a profile of you, or to recognise you on a later visit. A "visit" is simply counted as a page view that arrived from another website. We see totals, not people. We use them to understand which parts of the site are useful, and we do not sell or share them with anyone for advertising.

Our legal basis

We rely on legitimate interest under Article 6(1)(f) of the GDPR: understanding, in aggregate, how our site is used so we can improve it. We have kept that interest narrow on purpose by removing cookies entirely, which is what makes it proportionate to your privacy.

The separate consent rule for cookies, under Malta’s Processing of Personal Data (Electronic Communications Sector) Regulations, applies to storing or reading data on your device. Because we do neither, it is not engaged.

Cloudflare as our processor

Cloudflare, Inc. serves this website and processes the analytics described above on our behalf, under its data processing addendum and standard contractual clauses. Cloudflare operates a global network, so this processing may take place outside the European Economic Area, including in the United States.

Because Cloudflare also delivers the site itself, it necessarily handles your IP address in order to send you these pages at all. That is unavoidable for any website and is not something we use to identify you.

Opting out

Because we process this under legitimate interest rather than consent, you have the right to object to it at any time. Write to us and we will honour it.

You can also stop the measurement yourself, without asking us: the analytics script is a single file served from cloudflareinsights.com, and content blockers and privacy-focused browsers block it as standard. Nothing on this site attempts to work around them, and the site works exactly the same when it is blocked.

Your rights

Under the GDPR you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to how it is processed, and to receive it in a portable format. Because we hold no account or contact records for this website, in practice these rights apply to the analytics data described above.

To exercise any of them, write to info@kostamalta.com. If you are not satisfied with our response, you have the right to complain to the Office of the Information and Data Protection Commissioner in Malta.