Privacy Policy
Effective date: 10 November 2026 | Last updated: 10 November 2026
No Deposit Cars Malta Limited ("we", "us", "our") is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains what personal data we collect when you contact us, visit our showroom, use our website at https://nodepositcarsmalta.com, or apply to buy a used car from us on our no-deposit monthly-instalment basis, and how we use, share, store and protect that data.
We sell used cars in Malta and offer customers the option to buy with no deposit upfront and to pay the price in monthly instalments. To do this responsibly, we need to collect and process certain personal information. This Policy describes how, including what happens while your agreement runs: the messages we send you about it (Section 5), the GPS tracking device in the vehicle (Section 6) and credit referencing through the Malta Association of Credit Management (Section 7).
This Policy is written to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Maltese Data Protection Act (Chapter 586 of the Laws of Malta).
1. Who we are (data controller)
The data controller responsible for your personal data is:
No Deposit Cars Malta Limited
Trading as: No Deposit Cars Malta
Address (registered office and showroom): 89, Triq il-Mastrudaxxa, Ħal Qormi QRM 3572, Malta (opposite MaltaPost Head Office)
Company registration number: C 85780
VAT number: MT25113631
Telephone: +356 9905 7487
Email: info@nodepositcarsmalta.com
Website: https://nodepositcarsmalta.com
If you have any questions about this Policy or about how we handle your personal data, you can contact us using the details in Section 16, or our data-protection contact, Joseph Camenzuli, Managing Director, at info@nodepositcarsmalta.com.
2. The personal data we collect
We only collect the personal data we need for the purposes described in this Policy. Depending on how you interact with us, this may include:
2.1 Enquiry and contact data
When you fill in an enquiry or contact form, message us, or speak to us about a vehicle, we collect:
- your name;
- your phone number;
- your email address;
- the vehicle you are interested in (for example make, model, or a specific car in our stock);
- the content of your message or enquiry, and any details you choose to share with us (such as your budget or the type of car you are looking for).
The message form on our website. A message sent through the form on our website is delivered to our team by email; the website itself does not keep a copy of it. To keep automated spam out, the form uses Cloudflare Turnstile, a verification service from Cloudflare, Inc. that checks a submission comes from a person rather than a program. To do this Cloudflare receives technical information from your browser, such as your IP address and device and browser details, and we send it nothing you type into the form. The email is delivered through Resend, an email delivery provider that handles the message on our behalf for that purpose only. Both providers may process this data outside the EEA, under the safeguards described in Section 10.
2.2 Purchase and monthly-instalment application data
If you decide to buy a car from us and want to pay in monthly instalments with no deposit upfront, we need more information to set up and manage that arrangement. Depending on the circumstances, this may include:
- Identity information: your full name, date of birth, and a copy or details of an identity document (for example identity card, passport or driving licence);
- Contact and address information: your home address, mobile number and email address;
- The information needed to arrange and manage monthly payments, which may include details about your income, employment, regular financial commitments and similar affordability information, together with the bank or payment details needed to set up and collect instalments;
- Transaction and account information: the vehicle purchased, the agreed price, the instalment schedule and the bills of exchange signed for it, payments made and outstanding, any late-payment charges, and related correspondence;
- Vehicle information: the insurance policy covering the vehicle, and any traffic contraventions and fines relating to it while it is registered in our name.
We will tell you at the point of collection which information is necessary to proceed with a purchase or instalment arrangement. If you choose not to provide information that we genuinely need, we may not be able to sell you a vehicle on a no-deposit instalment basis.
2.3 Other people named in your agreement
If your agreement names other people, such as a joint hirer, a person who signs for a company and stands surety, or an additional authorised driver, we collect their name, contact details and identity details, and for drivers their driving-licence details, for the same purposes. Please make sure they have seen this Policy.
2.4 Vehicle location data
A car bought from us on instalments has, or may have, a GPS tracking device fitted, which shows where the vehicle is. Section 6 explains when we use it.
2.5 Messages between us
We keep a record of the messages we exchange with you about your agreement: what we send, your replies, and for WhatsApp messages whether each one was delivered and read. Section 5 explains more.
2.6 Website data
When you use our website, our hosting provider handles technical information such as your IP address and browser details in order to deliver the site and keep it secure. Our website does not use analytics or advertising cookies (see Section 12).
We do not deliberately collect special categories of data (such as health, racial or ethnic origin, or political opinions). Please do not send us such information unless we specifically ask for it.
3. How we collect your data
We collect personal data:
- Directly from you: when you complete a form on our website, call or message us, email us, visit our showroom, or apply to buy a vehicle and arrange monthly instalments;
- From the GPS tracking device fitted to a vehicle bought on instalments (see Section 6);
- Automatically, when you use our website (see Section 2.6);
- From third parties, where applicable: for example, where we use partners to help confirm your identity or to set up and process instalment or payment arrangements, we may receive information back from them in connection with your purchase.
4. Why we use your data and our lawful bases
Under the GDPR we must have a lawful basis for processing your personal data. We rely on the following:
| What we do | Why | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Respond to your enquiries and contact requests, and discuss vehicles with you | To deal with your enquiry and take steps you ask for before any purchase | Art. 6(1)(b), steps taken at your request prior to entering a contract; and Art. 6(1)(f), our legitimate interest in responding to enquiries |
| Assess and set up a purchase and monthly-instalment arrangement, including the information needed to arrange affordable monthly payments | To take pre-contract steps you request and to enter into and perform the sale and instalment agreement with you | Art. 6(1)(b), pre-contract steps and performance of a contract |
| Manage your purchase and collect monthly instalments | To perform our agreement with you and administer your account | Art. 6(1)(b), performance of a contract |
| Send you messages about your agreement, including reminders of instalments that are due or overdue (see Section 5) | To run your agreement and recover what is owed under it | Art. 6(1)(b), performance of a contract; and Art. 6(1)(f), our legitimate interest in recovering amounts due |
| Locate the vehicle with its GPS tracking device, and recover it where your agreement allows (see Section 6) | To protect the vehicle, which stays our property until it is fully paid for | Art. 6(1)(f), our legitimate interest in protecting our property; and Art. 6(1)(b), performance of a contract |
| Pass information about a default to MACM and other third parties legally entitled to receive it (see Section 7) | Credit management and responsible lending | Art. 6(1)(f), legitimate interests |
| Transfer or endorse the bills of exchange signed under your agreement | To exercise our rights under the agreement | Art. 6(1)(b), performance of a contract; and Art. 6(1)(f), legitimate interests |
| Recover debts, and establish, exercise or defend legal claims | To protect our legal rights | Art. 6(1)(f), legitimate interests |
| Deal with traffic contraventions and fines on a vehicle registered in our name | To apply your agreement and meet our obligations as the registered owner | Art. 6(1)(b), performance of a contract; and Art. 6(1)(f), legitimate interests |
| Keep proper business, accounting and tax records | To comply with our legal obligations | Art. 6(1)(c), legal obligation |
| Improve our website, services and customer experience, and keep our systems secure | Our legitimate interest in running and improving our business safely | Art. 6(1)(f), legitimate interests |
| Send you limited marketing about our vehicles and offers | To promote our business | Art. 6(1)(f), legitimate interests for existing customers regarding similar products, or Art. 6(1)(a), consent where required |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms. You can object to this processing: see Section 14.
Where we rely on consent (for example for certain marketing), you can withdraw it at any time, without affecting processing already carried out.
5. Messages about your agreement, including WhatsApp
While your agreement runs, we contact you about it: for example to remind you of instalments that are due or overdue, to send you notices, and to answer your questions. We do this by phone, SMS, email, letter and WhatsApp, using the mobile number and addresses you gave us.
For WhatsApp we use the WhatsApp Business Platform, a service provided by Meta. Meta handles the messages we exchange with you, your phone number and each message's delivery status on our behalf, in order to deliver them, and may do so outside the EEA (see Section 10).
These are service messages about your agreement, not marketing. We keep a record of each one for as long as we keep your agreement's records (see Section 11).
6. GPS tracking of the vehicle
A car bought from us on instalments has, or may have, a GPS tracking device fitted, as clause 3 of your agreement explains. The vehicle stays registered in our name, and remains our property, until it is fully paid for.
We use the device only to protect our interest in the vehicle. We look at the vehicle's location when we reasonably suspect that it is not being used in line with your agreement, or that the agreement has been broken: for example, to find a vehicle we are entitled to recover. We do not use it to follow your day-to-day journeys.
Because a vehicle's location can show where its driver is, only staff who need it for these purposes can view it. The tracking service is run by a provider that handles the location data on our behalf.
7. Credit referencing through MACM
We are a member of the Malta Association of Credit Management (MACM). As clause 14 of your agreement explains, if you default on the agreement we may pass information about you and the agreement to third parties legally entitled to receive it, including MACM.
MACM is a credit referencing agency and a data controller in its own right for the personal data it holds, which it processes in pursuit of its legitimate interests, such as promoting responsible lending. MACM explains how it handles personal data at https://www.macm.org.mt/dataprotection, and its Data Protection Officer can be contacted at dataprotectionofficer@macm.org.mt.
8. Marketing
If we send you marketing about our vehicles, offers or services, we will do so in line with the law. You can opt out at any time, by using the unsubscribe link in any marketing email or by contacting us using the details in Section 16. Opting out of marketing will not affect any purchase or instalment arrangement you have with us, or our service messages about your account.
9. Who we share your data with
We do not sell your personal data. We share it only where necessary, and with appropriate safeguards in place. Recipients may include:
- IT, hosting and software providers who help us run our website, store data and manage customer records;
- Communications providers who act on our instructions: Meta, for WhatsApp messages (Section 5); Resend, which delivers messages sent through our website form by email; and Cloudflare, whose Turnstile service checks that the website form is used by a person (Section 2.1);
- The GPS tracking provider for vehicles sold on instalments (Section 6);
- MACM and other third parties legally entitled to receive information about a default (Section 7);
- Anyone to whom a bill of exchange signed under your agreement is transferred or endorsed, as clause 14.2 of your agreement allows;
- Insurers: the insurer of the vehicle, on whose policy our interest is noted (clause 5.4 of your agreement), and insurers involved in a claim;
- Banks and payment or identity-verification partners, where applicable, that process your instalment payments or help us confirm your identity;
- Professional advisers such as accountants, auditors and lawyers, where needed;
- Public authorities and courts, where we are required to share information by law, to deal with traffic contraventions on a vehicle registered in our name, or to establish, exercise or defend legal claims.
Where we use providers who process personal data on our behalf, we put written agreements in place requiring them to protect your data and to use it only for the purposes we specify.
10. International transfers
We aim to keep your personal data within the European Economic Area (EEA). Some of our providers, namely Meta (for WhatsApp), Cloudflare and Resend, may process data outside the EEA. Where that happens, we make sure appropriate safeguards are in place as required by the GDPR: for example, transfers to countries the European Commission has decided provide an adequate level of protection, or transfers made under Standard Contractual Clauses approved by the European Commission, together with any additional measures needed. You can ask us for more information about these safeguards using the contact details in Section 16.
11. How long we keep your data
We keep your personal data only for as long as we need it for the purposes set out in this Policy, and then delete or anonymise it.
- Enquiry and contact data (where you do not go on to buy): kept only for as long as we need it to deal with your enquiry, then deleted.
- Purchase and instalment records, including the messages we exchange with you about your agreement: kept for the duration of your agreement and afterwards for as long as needed to manage the relationship and to meet our legal, accounting and tax obligations.
- Vehicle location data: kept only for as long as needed for the purposes in Section 6.
- Your website shortlist: stays in your own browser until you clear it (see Section 12).
When deciding how long to keep data, we consider the amount and sensitivity of the data, the risk of harm from unauthorised use, the purposes we process it for, and our legal obligations.
12. Cookies and your browser's storage
Our website does not use analytics, advertising or tracking cookies. If you save cars to your shortlist, the list is stored in your own browser (its "local storage") so that it is still there when you come back. It stays on your device, and we do not receive it unless you send it to us with an enquiry. You can remove it at any time by clearing your browser's data for our website.
The enquiry form uses Cloudflare Turnstile to keep out automated spam, as Section 2.1 explains.
13. How we protect your data
We take the security of your personal data seriously and use appropriate technical and organisational measures to protect it against loss, misuse, unauthorised access, disclosure or alteration. These measures include access controls, secure storage, and limiting access to staff and providers who need it to do their job. While no system can be guaranteed completely secure, we work to keep our safeguards appropriate to the data we hold.
14. Your rights
Under the GDPR you have the following rights in relation to your personal data:
- Access: to ask for a copy of the personal data we hold about you;
- Rectification: to ask us to correct data that is inaccurate or incomplete;
- Erasure: to ask us to delete your data in certain circumstances ("right to be forgotten");
- Restriction: to ask us to limit how we use your data in certain circumstances;
- Objection: to object to processing based on our legitimate interests, and to object to direct marketing at any time;
- Portability: to ask us to provide certain data to you, or to another controller, in a structured, commonly used, machine-readable format;
- Withdraw consent: where we rely on your consent, to withdraw it at any time, without affecting processing already carried out;
- Rights related to automated decision-making: not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make decisions about you in this way; if that ever changes, we will tell you and explain your rights.
To exercise any of these rights, contact us using the details in Section 16. We will respond within the time limits set by law (normally one month). We may need to verify your identity before acting on a request. Exercising these rights is normally free of charge.
These rights are not always absolute and may be subject to legal exceptions: for example, we may need to keep certain information to meet our legal obligations or to manage an active instalment agreement.
15. Complaints and the IDPC
If you have a concern about how we handle your personal data, please contact us first using the details in Section 16; we will do our best to put things right.
You also have the right to lodge a complaint with the supervisory authority in Malta:
Office of the Information and Data Protection Commissioner (IDPC)
Floor 2, Airways House, Triq Il-Kbira, Tas-Sliema SLM 1549, Malta
Telephone: +356 2328 7100
Email: idpc.info@idpc.org.mt
Website: https://idpc.org.mt
Complaints can be lodged using the complaint form on the IDPC's website, at https://idpc.org.mt/file-a-complaint/.
16. How to contact us and exercise your rights
To contact us about this Policy, your personal data, or to exercise your rights, please use:
No Deposit Cars Malta Limited
89, Triq il-Mastrudaxxa, Ħal Qormi QRM 3572, Malta
Telephone: +356 9905 7487
Email: info@nodepositcarsmalta.com
Data-protection contact: Joseph Camenzuli, Managing Director
17. Changes to this Policy
We may update this Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make changes, we will update the "Last updated" date at the top of this Policy and, where the changes are significant, we will take reasonable steps to bring them to your attention. Please review this Policy periodically. Continued use of our website or services after an update means you are aware of the current version.
Governing law: this Policy and any matter arising from it are governed by the laws of Malta.