Legal
Privacy notice
Data protection is our work, so we have tried to make this notice as clear as the advice we give. It explains what personal data we collect, why, who sees it, how long we keep it and what you can do about it.
Last updated 15 October 2026
Who we are
Ilma Advisory is the trading name of Yasmine Aquilina, an independent advisor (“Ilma Advisory”, “we”, “us”).
For the personal data described in this notice, Yasmine Aquilina is the controller: she decides why and how it is used.
Questions about this notice or about your personal data can be sent to info@ilmaadvisory.com. Please write “Privacy” in the subject line so it reaches the right person quickly.
Who this notice is for
This notice explains how we handle personal data about people outside our firm who deal with us, in particular:
- visitors to ilmaadvisory.com;
- people who contact us by email, through the contact form or by booking a call;
- contacts at our clients, prospective clients, suppliers and partners;
- people who send us a CV or ask about working with us;
- people who interact with us on LinkedIn.
When we act for a client. When we advise a client, for example as its outsourced data protection officer or on a workplace matter, we may see personal data about that client’s employees, customers or other people. That data is handled under our engagement terms with the client and the client’s own privacy notice, not this one. If your data reached us that way, the client is usually the best first point of contact, but you are always welcome to write to us.
Using our website
When you visit ilmaadvisory.com, some technical data is processed automatically so the site can be delivered to your device and kept secure. This includes your IP address, browser and device type, the pages you request and the date and time of your visit.
This data is processed by our hosting provider and appears in server logs used for security and troubleshooting. We do not use it to identify you, build a profile of you, or combine it with other data we hold.
The website uses fonts served by Google Fonts. To show them, your browser connects to Google’s servers, which receive your IP address. Google states that it does not use this data to profile visitors.
Why we may use it: our legitimate interest in running a secure, working website.
When you contact us
When you write to us, use the contact form or book a call, we receive the details you give us: usually your name, email address, organisation, the subject of your enquiry and your message. If you book a call, you do so on Calendly’s booking page, which records the time you choose and any notes you add. Calendly handles that information as our service provider; its own privacy notice also applies while you use its page. Messages sent through the contact form are delivered to us by Formspree, which acts as our service provider.
We use these details to reply to you, to arrange and hold the conversation you asked for, and to keep a record of the exchange. We do not add you to a mailing list, and we do not use your enquiry for any unrelated purpose.
Please share only what we need to understand the question. If your enquiry involves sensitive information about you or someone else, such as health data or details of a workplace dispute, a short outline is enough for a first conversation.
Why we may use it: to take steps you ask for before entering into an engagement with us, and our legitimate interest in answering enquiries and keeping proper records.
Clients and business contacts
If you are a contact at a client, prospective client, supplier or partner, we hold your business contact details, your role, and our correspondence and meeting notes with you. We use them to deliver and manage our services, to run conflict and identity checks where required, and to invoice, keep accounts and meet our legal obligations.
Why we may use it: to perform our contract with your organisation, to comply with legal obligations (such as tax and accounting rules), and our legitimate interest in managing our business relationships.
From time to time we may send a client contact a short update that we think is genuinely relevant to their work with us. Every such message lets you opt out, and you can also opt out at any time by writing to us.
If you send us your CV
If you send us your CV or ask about working with us, we use the details you provide, such as your contact details, work history and qualifications, and our notes of any conversation, to consider you for a current or future role.
If we do not take your application further, we keep it for six months and then delete it, unless you agree that we may keep it longer for future opportunities. You can withdraw that agreement at any time.
Why we may use it: to take steps you ask for before entering into a contract, our legitimate interest in recruiting, and your consent where we keep your details longer.
LinkedIn and social media
If you follow, message or comment on our LinkedIn page, we see the information you make available to us there, such as your name, profile and messages. We use it to reply to you and to manage our page. LinkedIn processes your data under its own privacy policy, and for page statistics it acts as a joint controller with us.
Why we may use it: our legitimate interest in communicating with people who engage with us.
Our legal bases
Under the General Data Protection Regulation (GDPR) and Malta’s Data Protection Act (Chapter 586), we rely on one or more of the following for each use described above:
- Contract: the processing is needed to perform a contract with you, or to take steps you ask for before entering into one.
- Legal obligation: the law requires it, for example for accounting and tax records, or to answer a lawful request from an authority.
- Legitimate interests: the processing is needed for our legitimate interests or those of a third party, and those interests are not overridden by your interests and rights. You can ask us for more detail on how we weighed them.
- Consent: you have agreed to it. You can withdraw consent at any time, without affecting anything done before.
We do not make decisions about you based solely on automated processing.
Transfers outside Europe
We aim to keep personal data within the European Economic Area (EEA). Some of our service providers, or their own suppliers, may process data outside the EEA. Where that happens, we make sure the transfer is protected by an adequacy decision of the European Commission (for example, the EU–US Data Privacy Framework for certified US companies), or by the Commission’s standard contractual clauses together with any further measures needed.
You can ask us for details of the safeguards that apply.
How long we keep it
We keep personal data only as long as we need it for the purpose it was collected for, to meet legal requirements, and to deal with any questions or claims. In practice:
| Data | How long |
|---|---|
| Enquiries that do not lead to an engagement | 12 months from our last exchange |
| Client files and correspondence | For the engagement, then for as long as claims may arise or the law requires, usually up to 6 years |
| Accounting and invoicing records | For the period required by tax and accounting law |
| CVs not taken further | 6 months, or longer if you agree |
| Website server logs | A short period set by our hosting provider for security purposes |
When the period ends, we delete the data or make it anonymous.
Keeping it safe
We use appropriate technical and organisational measures to protect personal data, including access controls, encrypted connections, multi-factor authentication on our accounts, and confidentiality duties for anyone who handles data for us. Advising on data protection is our work, and we hold ourselves to the standard we recommend to clients.
Your rights
Under the GDPR, and subject to some conditions, you have the right to:
- ask for a copy of the personal data we hold about you (access);
- ask us to correct data that is inaccurate or incomplete;
- ask us to delete your data;
- ask us to restrict how we use your data;
- object to our use of your data based on legitimate interests, and to any direct marketing at any time;
- receive data you gave us in a portable format, or have it sent to another organisation;
- withdraw your consent, where we rely on it.
To make a request, write to info@ilmaadvisory.com. We reply within one month, and tell you if we need longer for a complex request. We may ask you to confirm your identity first. Making a request is free, unless it is clearly unfounded or excessive.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first, and we will try to put it right.
You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live, work or think the problem occurred. Our lead authority is:
Office of the Information and Data Protection Commissioner (IDPC)
Floor 2, Airways House, Triq il-Kbira, Tas-Sliema SLM 1549, Malta
idpc.org.mt
Changes to this notice
We may update this notice when our services, suppliers or the law change. The date at the top shows when it was last updated. If we make a significant change that affects you, we will tell you directly where we can.
Contact us
Yasmine Aquilina, trading as Ilma Advisory
info@ilmaadvisory.com