IWho is responsible
This website, carloschembri.com, is the portfolio of Carlo Schembri, a designer working from his studio at Block A, Level 1, Halmann Business Centre, Mosta Road, Lija LJA 2021, Malta (trading as Carlo Schembri &bold; “I”, “we” or “the studio” below).
Carlo Schembri personally is the controller of any personal data processed through this website, within the meaning of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) and Malta’s Data Protection Act (Cap. 586). For anything about your data, write to carlo@carloschembri.eu. Every message is read personally.
IIWhat we collect
Very little. Most visits leave nothing on our side that identifies you. The exceptions are:
- Messages you send us. The contact form on this site does not send anything to our server. When you press Send message, it opens your own email application with a pre-written draft. If you then send that email, we receive your name, email address and whatever you choose to write, like any other email.
- Server logs. Like every web server, ours records technical access logs: IP address, date and time, the page requested, the referring page, the browser’s user-agent string and the response status. We use them to keep the site running and secure. They are deleted after 30 days and are never combined with other data.
- Browser storage. The site keeps a few small notes in your own browser so the intro and page transitions behave well. They never leave your device and contain nothing about you. See the cookie policy for the full list.
- The private admin area. A password-protected area at
/adminis used only by the site owner to update the archive. Sign-in attempts are rate-limited by IP address, held briefly in the server’s memory and never written to disk. That page also loads typefaces from Google Fonts. None of this applies to visitors.
We do not use analytics, advertising cookies, tracking pixels, fingerprinting, social-media plug-ins or any form of profiling.
IIIWhy, and on what basis
Article 6 of the GDPR requires a lawful basis for each use of personal data. Ours are:
| Data | Purpose | Lawful basis |
|---|---|---|
| Emails you send us | Reading and answering your enquiry, and, if it leads to one, preparing a commission | Steps at your request before a contract (Art. 6(1)(b)) or legitimate interest in answering correspondence (Art. 6(1)(f)) |
| Server access logs | Running the site, diagnosing faults, preventing abuse | Legitimate interest (Art. 6(1)(f)) |
| Admin sign-in rate limiting | Protecting the admin area from password guessing | Legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, we have weighed it against your rights: the data is minimal, short-lived and never used to profile you.
IVHow long we keep it
- Server logs: rotated and deleted after thirty days.
- Emails: kept for as long as the conversation or resulting project is active, then for as long as Maltese accounting and tax law requires where a commission followed, and otherwise deleted within two years of the last exchange.
- Admin rate-limit records: held in memory for minutes and discarded automatically.
- Browser storage: controlled by you; see the cookie policy.
VWho else sees it
No one outside the studio. We do not sell, rent or share personal data, and we do not pass it to advertisers or data brokers.
Two kinds of service provider handle data on our behalf, strictly as processors under Article 28 of the GDPR: the company whose server hosts this website (for the access logs) and the provider of the studio’s email service (for messages you send). They may not use it for their own purposes.
VIOutside the European Union
We aim to keep personal data within the European Economic Area. If a provider we use processes it elsewhere, that happens only under a safeguard recognised by the GDPR, such as an adequacy decision of the European Commission or the Commission’s standard contractual clauses. You can ask us for details.
VIILinks to other sites
This site links to Instagram and to carloschembri.shop (Oggetti). Those sites are run under their own terms and privacy policies, and nothing is sent to them until you choose to follow a link.
VIIIYour rights
Under the GDPR you have the right to:
- ask for a copy of the personal data we hold about you (access);
- have inaccurate data corrected (rectification);
- have your data deleted (erasure);
- ask us to limit how we use it (restriction);
- receive data you gave us in a portable format (portability);
- object at any time to processing based on legitimate interest;
- complain to the supervisory authority, the Office of the Information and Data Protection Commissioner of Malta: idpc.org.mt, or to the authority in the EU country where you live or work.
To use any of these rights, write to carlo@carloschembri.eu. We will answer within one month and will not charge you. We may ask for something that confirms your identity before releasing data.
IXSecurity
The site is served only over encrypted HTTPS. The admin area is password protected, its session cookie cannot be read by scripts, and sign-in attempts are throttled. No method of transmission is perfectly secure, but we keep what we hold to the minimum so that there is little to protect.
XAutomated decisions
We make no decisions about you by automated means and do no profiling.
XIChildren
This is a professional portfolio and is not aimed at children. We do not knowingly collect personal data from anyone under sixteen. If you believe a child has written to us, a parent or guardian can ask us to delete the message at any time.
XIIChanges to this policy
If this policy changes in a meaningful way, the effective date at the top of this page will change with it. This version has been in force since 25 September 2026.