01
Who is responsible
The controller for the processing of personal data on this website, under the EU General Data Protection Regulation (GDPR) and the Maltese Data Protection Act (Chapter 586), is:
Vexera Group Ltd.
Street and number, Postcode Mellieħa, Malta
Email: contact@vexera-group.com
For all questions about data protection, please write to the address above. If a data protection officer is appointed: name and contact.
02
Overview
- Visiting the website: technical data such as your IP address is processed briefly so the site can be delivered securely.
- Enquiries: the details you enter in the enquiry form are used to answer you and to prepare a possible agreement.
- Analytics: only if you agree in the cookie settings. Without your consent, no analytics runs.
- No selling, no advertising profiles: we do not sell personal data and do not use it for third-party advertising.
03
Hosting and security
This website is hosted and delivered by Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) through its global network. When you open a page, your browser sends technical data that is needed to deliver it: IP address, date and time, the page requested, browser type and operating system. Cloudflare also uses this data to detect and block attacks.
Legal basis is our legitimate interest in a fast, reliable and secure website (Art. 6(1)(f) GDPR). Log data is kept only briefly by Cloudflare for security purposes and is not combined with other data. We have a data processing agreement with Cloudflare.
The connection to this website is encrypted (TLS), so data you send cannot be read by third parties.
05
Enquiry form
When you send us an enquiry, we process the details you enter:
- the arrangement you are interested in
- name and email address
- phone number and a description of your properties, if you add them
- the page you sent the enquiry from, campaign parameters in the link (for example utm_source), and the time
We use these details to answer your enquiry, to prepare a possible portfolio management or leasing agreement and to keep track of our conversation. Legal basis is Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and our legitimate interest in handling enquiries well (Art. 6(1)(f) GDPR).
Your enquiry is stored in a database on Cloudflare's infrastructure and passed to our internal systems, where our team handles owner enquiries. We are notified by email through our email delivery provider Resend (Resend, Inc., USA). Where our internal tools help to sort or summarise enquiries, this happens inside our own systems; no decisions with legal effect are made automatically.
06
Spam protection
To protect the enquiry form from automated spam, we use Cloudflare Turnstile. When the form comes into view, Turnstile checks in the background whether the request comes from a person. For this, it processes technical data such as your IP address and browser characteristics. Turnstile does not use this data for advertising.
Legal basis is our legitimate interest in protecting our website and our team from abuse (Art. 6(1)(f) GDPR).
07
Contact by email
If you write to us by email, we process your address and the content of your message to answer you (Art. 6(1)(b) or (f) GDPR). Our email is hosted by Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg) in the EU region ….
08
Analytics, with your consent
To understand how our website is used and to improve it, we use PostHog, but only if you agree in the cookie settings. PostHog is provided by PostHog Inc.; we use its EU cloud, with data stored in Frankfurt, Germany. Requests are sent through our own domain.
With your consent, PostHog records pages visited, clicks and scroll depth, the device and browser type, approximate location (country or city, derived from the IP address, which is not stored in full) and, where enabled, anonymised session recordings and heatmaps. Entries in form fields are masked and not recorded.
Legal basis is your consent (Art. 6(1)(a) GDPR and S.L. 586.01). You can withdraw it at any time with effect for the future through the cookie settings. Analytics data is kept for 12 months.
Until the cookie settings are live, PostHog is not active on this website.
09
Fonts, images and videos
Fonts and images are served from our own website. No connection is made to Google Fonts or other font services.
If we show videos, they are hosted on Cloudflare Stream and delivered by Cloudflare, without tracking by video platforms.
10
Service providers
We work with carefully selected providers who process data on our behalf and under our instructions, based on data processing agreements (Art. 28 GDPR):
- Cloudflare, Inc.
- Hosting, security, database, spam protection, videos
- Resend, Inc.
- Delivery of enquiry notifications by email
- Amazon Web Services EMEA SARL
- Email hosting
- PostHog Inc.
- Website analytics, only with your consent
Beyond this, we only share data where the law requires it or where it is needed to carry out an agreement with you.
11
Transfers outside the EU
Some of our providers are based in the USA or may access data from there. Where this happens, transfers are covered by the EU–U.S. Data Privacy Framework, where the provider is certified under it, or by the EU Standard Contractual Clauses (Art. 46 GDPR).
12
How long we keep data
- Enquiries: 24 months after our last contact if no agreement follows. If an agreement follows, for its term and the statutory retention periods afterwards.
- Technical log data: only as long as needed for security, then deleted by Cloudflare.
- Analytics: see section 8.
13
Your rights
You have the right to:
- access the personal data we hold about you (Art. 15 GDPR)
- have incorrect data corrected (Art. 16 GDPR)
- have your data deleted (Art. 17 GDPR)
- restrict processing (Art. 18 GDPR)
- receive your data in a portable format (Art. 20 GDPR)
- object to processing based on legitimate interest (Art. 21 GDPR)
- withdraw a consent at any time, with effect for the future (Art. 7(3) GDPR)
To use these rights, write to contact@vexera-group.com. You also have the right to lodge a complaint with a supervisory authority. In Malta, this is the Information and Data Protection Commissioner (idpc.org.mt).
14
Changes to this policy
We update this policy when our website or the law changes. The current version is always available on this page; the date at the top shows when it was last updated.