Privacy policy
Last updated 17 October 2026
This policy explains what personal data ND App collects, why, and the rights you have over it. We collect as little as we need and never sell it.
01Who we are
ND App is a service of ND Web Design, based in Malta. For the personal data described in this policy, ND Web Design is the data controller, except where section 2 says otherwise.
- BusinessND Web Design
- AddressMalta
- Emailinfo@ndwebdesign.mt
- Websitendwebdesign.mt
02Our role
We act in two roles:
- As controller for people who visit this website, send us an enquiry, or hold an account to manage a venue.
- As processor for guests who use a venue's digital menu or review page. The venue decides what that page is for and is the controller of guest feedback sent through it. We handle that data only on the venue's instructions, under our terms of service. Guests who want to use their rights over feedback they sent should contact the venue, or write to us and we will pass the request on.
03Data we collect
Enquiries
When you fill in the get started form: business name, email address, phone number and the products you are interested in, plus your name, locality and a note if you choose to add them.
Venue accounts
Name and email address of account users, a securely hashed password, sign-in and session records, recovery codes, billing and payment records, and the content you add, such as menus, photos, logos and review page settings.
Guests of a venue
Digital menus can be read without giving any personal data. On a review page, a guest who sends private feedback provides a star rating and a message, and may add a name and email address so the venue can reply. We also count page visits, ratings chosen and links opened, without names, accounts or tracking cookies, so venues can see how their page performs.
Technical data
IP address, browser and device details and request times, which our servers record to deliver pages, prevent abuse and keep the service secure.
04How we use it and why
| Purpose | Legal basis (GDPR article 6) |
|---|---|
| Replying to your enquiry and preparing a quote | Steps taken at your request before a contract (6(1)(b)) |
| Providing your account and the service | Performance of a contract (6(1)(b)) |
| Service emails such as password resets and payment reminders | Performance of a contract (6(1)(b)) |
| Invoicing, accounting and tax records | Legal obligation (6(1)(c)) |
| Security, fraud and abuse prevention, rate limiting | Legitimate interests (6(1)(f)) |
| Improving the service using aggregated statistics | Legitimate interests (6(1)(f)) |
| Optional cookies, if we ever use them | Consent (6(1)(a)) |
06International transfers
Most data is stored in the European Economic Area. Some providers may process data outside the EEA. When that happens, the transfer is protected by an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework, or by the Commission's standard contractual clauses.
07How long we keep it
- Enquiries that do not lead to an account: up to 24 months after our last contact.
- Account data and content: while the account is open. After it closes, we delete it within 90 days, unless you ask us to keep it longer.
- Guest feedback: until the venue deletes it, or until the venue's account is deleted.
- Invoices and payment records: for as long as Maltese tax and accounting law requires.
- Security logs: for short periods, normally no more than 90 days.
08Your rights
Under the GDPR and the Data Protection Act (Cap. 586), you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have data erased, or its use restricted, in certain cases;
- receive data you gave us in a portable format;
- object to processing based on legitimate interests;
- withdraw consent at any time, without affecting earlier processing.
Email info@ndwebdesign.mt to use any of these rights. We reply within one month and may ask you to confirm your identity first.
You can also complain to the Information and Data Protection Commissioner (IDPC), Floor 2, Airways House, Triq Il-Kbira, Tas-Sliema SLM 1549, Malta, idpc.org.mt. We would appreciate the chance to sort out any concern first.
09Security
Data is encrypted in transit, passwords are stored as one-way hashes, and access to venue data is limited by account and role. Sign-in is rate limited and sessions expire automatically. No system is perfectly secure, but if a breach puts your rights at risk we will notify you and the IDPC as the law requires.
10Automated decisions and children
We do not make decisions about people based solely on automated processing that have legal or similarly significant effects. ND App is a service for businesses and is not directed at children.
12Changes to this policy
We may update this policy as the service or the law changes. The date at the top shows the latest version. If a change materially affects how we use your data, we will tell account holders by email before it applies.