Privacy Policy
1. Who we are
110 Analytics Ltd (“110 Analytics”, “we”, “us”) is a company registered in Malta.
Controller 110 Analytics Ltd · Company registration number C 113879 (Malta)
Registered office: 81, Triq il-Falkunier, Fgura FGR 1934, Malta
Privacy contact admin@110analytics.io · +356 7988 2880
For the personal data described in this policy, 110 Analytics Ltd is the controller under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Maltese Data Protection Act (Chapter 586 of the Laws of Malta).
We have not appointed a Data Protection Officer. We are not a public authority, our core activities do not consist of large-scale processing of special category data, and we do not carry out large-scale systematic monitoring of individuals. We keep that assessment under review and will appoint a DPO if it changes.
2. What this policy covers
This policy applies to personal data we process when you:
- visit 110analytics.io or go.110analytics.io, including any campaign or landing page on those domains;
- complete a form, book a call, or otherwise contact us;
- interact with our pages on LinkedIn, Facebook or Instagram;
- view a publicly accessible dashboard we publish, including the Malta Media Battle dashboard;
- receive business communications from us.
What this policy does not cover
Where we deliver services to a client, we process data inside that client’s systems on the client’s instructions. In that work the client is the controller and we act as a processor under a written data processing agreement. The client owns that data, the client’s own privacy notice governs it, and this policy does not apply to it. If you believe your data sits inside a client system we work on, please contact that organisation.
Our websites link to third-party sites we do not control. This policy does not cover them.
3. The personal data we process
| What | Where it comes from |
|---|---|
| Full name | Forms, booking pages, email, phone |
| Business email address | Forms, booking pages, email |
| Mobile or telephone number | Forms, booking pages |
| Company name and, where you tell us, your role | Forms, booking pages, conversation |
| The content of your enquiry, and notes we make during a call | Forms, email, calls, meetings |
| Marketing consent, and the date and wording you consented to | Form submission record |
We do not ask for special category data and we ask that you do not send it to us. We do not knowingly collect data from anyone under 16.
3.1 Data collected automatically
IP address, approximate location derived from it, device and browser type, operating system, referring page, pages viewed, time on page, clicks and scroll depth, and cookie or similar identifiers. On non-essential collection, see section 6. Nothing beyond what is strictly necessary is collected before you agree to it.
We also count visits to our pages without cookies or anything that identifies you: each visit adds one to a daily total for that page and the advert that led there, and nothing about you is stored.
If you accept analytics cookies, we also use Microsoft Clarity to see how our pages are used: where people click or tap, how far they scroll, and short recordings of a visit. Anything typed into a form is masked, so we never see it.
3.2 Data from other sources
- Business contact details from public and professional sources, including LinkedIn, company websites and business directories, where we identify an organisation that may be a fit for our services. We use the individual’s name, role, employer and business contact details for business-to-business outreach on the basis of our legitimate interests (section 4). We do not buy consumer marketing lists.
- Referrals, where an existing contact passes on your details. We will tell you who referred you if you ask.
- Our booking and CRM system, where a booking or form submission generates a record.
4. Why we process it, and our lawful basis
| Purpose | Data | Lawful basis |
|---|---|---|
| Responding to an enquiry and arranging a call | Identity, contact, enquiry content | Legitimate interests (responding to a request made to us); performance of a contract where one is in place |
| Running and improving our websites, and keeping them secure | Technical and usage data | Legitimate interests (operating a secure, functioning website) |
| Analytics and measuring which campaigns work | Usage data, cookie identifiers | Consent (via the cookie banner) |
| Advertising and measuring advertising | Usage data, cookie and advertising identifiers | Consent (via the cookie banner) |
| Business-to-business outreach to organisations we believe we can help | Name, role, employer, business contact details | Legitimate interests (developing our business, B2B only) |
| Sending marketing emails about our services | Name, email address, engagement | Consent, given by ticking the opt-in box |
| Administering a client relationship, and our own accounting and tax records | Identity, contact, contractual and billing data | Performance of a contract; legal obligation |
| Establishing, exercising or defending legal claims, and handling complaints | Whatever is relevant to the matter | Legitimate interests; legal obligation |
Where we rely on legitimate interests we have weighed our interest against your rights and freedoms. Our outreach is limited to business contact details, in a business context, about services relevant to the recipient’s role; every message identifies us and offers a simple way to stop hearing from us. You can object at any time (section 9) and we will stop.
Where we rely on consent, you can withdraw it at any time: use the unsubscribe link in any marketing email, change your cookie choices using the Cookie settings button in section 6 of this policy, or email admin@110analytics.io. Withdrawing consent does not affect processing already carried out.
5. Who we share it with
We do not sell personal data. We share it with the following categories of recipient, each under a written contract that limits them to processing it on our instructions.
| Recipient | What they do for us |
|---|---|
| The Growth Bully (Malta), our marketing agency, acting as our processor | Builds and operates our campaign landing pages, forms and booking calendar, and the CRM those records sit in. HighLevel Inc. (GoHighLevel), its platform provider, acts as its sub-processor. |
| Netlify, Inc. (United States) | Hosts 110analytics.io and runs the code behind its booking and contact forms (your details pass through it on the way to us), and hosts the Malta Media Battle dashboard |
| Microsoft Ireland Operations Ltd / Microsoft Corporation | Microsoft Clarity: heat maps and recordings of how our pages are used, only if you accept analytics cookies. What you type into forms is masked. |
| Google Ireland Ltd / Google LLC | Google Workspace (our email and documents), Google Analytics 4 (property G-4TN1G1ZJQ8), Google Tag Manager, Google Ads; Google Calendar (a booking made on our site creates the event in our calendar and sends you the invitation); Google Sheets and Gmail (enquiries and bookings are recorded in a sheet for follow-up, and our team is emailed when one arrives); Google Maps (the map on our contact page, which loads only when you press the button; Google sets cookies when it does) |
| Meta Platforms Ireland Ltd | Our Facebook and Instagram pages, and advertising and measurement on those platforms |
| LinkedIn Ireland Unlimited Company | Our LinkedIn presence, and advertising and measurement on that platform |
| Slack Technologies Limited (Ireland), part of Salesforce | Tells our team, in a private channel, when an enquiry or booking arrives: name, company, contact details and your message |
| Squarespace Ireland / Squarespace, Inc. | Domain registration and DNS for 110analytics.io |
| Our professional advisers: accountants, auditors, lawyers, insurers | Professional services to us, each as controller or processor as applicable |
We will also disclose personal data where we are required to by law, by a court, or by a competent authority, and to a buyer or successor if our business is sold or reorganised.
A note on our social media pages. When you interact with our pages on Facebook, Instagram or LinkedIn, the platform gives us aggregated audience statistics (Page Insights or their equivalent). For that statistical processing we and the platform act as joint controllers. We do not receive data identifying individual visitors through it, and we have no control over the platform’s own processing of your account data. That is governed by the platform’s own terms and privacy notice.
6. Cookies and similar technologies
We use three groups of cookies and similar technologies.
- Strictly necessary. Needed for the site to work: security, load balancing, remembering your cookie choices. These are set without consent because the site cannot function without them. Examples include our consent-preference cookie, which lasts up to 12 months.
- Analytics. Tell us how the site is used so we can improve it. Examples: Google Analytics 4
_ga(up to 24 months) and_ga_<container-id>(up to 24 months); Microsoft Clarity_clck(up to 12 months) and_clsk(1 day). - Advertising. Let us show relevant advertising and measure whether it works. Examples: Google Ads
_gcl_au(up to 90 days), the Meta pixel_fbp(up to 90 days), and LinkedIn’sli_sugrandbcookie(up to 12 months).
Nothing in the analytics or advertising groups is set, and no analytics or advertising tag fires, before you accept it. Our cookie banner gives Accept, Reject and Settings equal prominence; rejecting is a single click and carries no penalty. Where Google’s Consent Mode is in use, your choice is passed to Google’s tags and they behave accordingly.
You can change your mind at any time using the button below, and you can block or delete cookies in your browser, though strictly necessary cookies cannot be turned off without affecting how the site works.
7. Transfers outside the EEA
Some of our providers are established outside the European Economic Area, or process data outside it. Where personal data is transferred outside the EEA, we rely on one of the following:
- an adequacy decision by the European Commission, including the EU–US Data Privacy Framework where the recipient is certified under it; or
- the European Commission’s Standard Contractual Clauses, together with a transfer risk assessment and, where needed, additional technical and organisational safeguards.
To ask which mechanism applies to a specific provider, or for a copy of the safeguards in place, email admin@110analytics.io.
8. How long we keep it
| Data | Retention |
|---|---|
| Enquiries and booking records that do not become a client relationship | 24 months from the last contact |
| Outreach contacts who do not respond | 12 months from the last message, then deleted |
| Marketing consent and unsubscribe records | For as long as we send marketing, plus 5 years, as evidence of consent |
| Client contract, correspondence and project records | 6 years from the end of the engagement |
| Accounting, invoicing and tax records | 10 years, as required by Maltese law |
| Google Analytics data | 14 months |
| Cookie consent records | 12 months, or until you change your choice |
Where a longer period is needed for a legal claim, we keep only what is relevant to that claim, for as long as it is live.
9. Your rights
Under the GDPR you have the right to:
- be informed about how we use your data, which is this policy;
- access the personal data we hold about you, and receive a copy;
- have inaccurate data corrected, and incomplete data completed;
- have your data erased, where one of the grounds in Article 17 applies;
- restrict our processing while a dispute about accuracy or lawfulness is resolved;
- receive your data in a portable format, where we process it by automated means on consent or contract;
- object to processing based on our legitimate interests, and, with no need to give a reason, to direct marketing, which we will always honour; and
- withdraw consent at any time, where consent is the basis.
We do not carry out automated decision-making that produces legal effects for you, and we do not profile individuals in a way that has a significant effect on them.
To exercise any of these rights, email admin@110analytics.io or write to us at the address given in our Terms of Use. We will respond within one month. If your request is complex, or if you have made several, we may extend that by up to two further months and will tell you why. There is no charge unless a request is manifestly unfounded or excessive. We may ask for enough information to confirm your identity before we act.
If you are not satisfied, you can complain to the Maltese supervisory authority:
Information and Data Protection Commissioner (IDPC)
Level 2, Airways House, High Street, Sliema SLM 1549, Malta
+356 2328 7100 · idpc.info@idpc.org.mt · idpc.org.mt
You may also bring a claim before the Maltese courts. We would rather hear from you first, so please give us the chance to put it right.
10. Security
We hold personal data in access-controlled cloud services with encryption in transit, and we limit access to the people who need it for the purpose it was collected for. No system is perfectly secure, and we cannot guarantee the security of data while it travels to us over the internet. If a breach occurs that is likely to result in a risk to your rights, we will notify the IDPC within 72 hours and tell you directly where the law requires it.
11. Changes to this policy
We may update this policy as our processing changes. The version and date at the top always show the current one. Where a change materially affects how we use your data, we will say so on our website and, where we hold your contact details for that purpose, tell you directly.
12. Contact
Questions about this policy, or about how we handle your data:
110 Analytics Ltd
admin@110analytics.io · +356 7988 2880