Legal

Privacy Policy

How we handle personal data under Maltese law and the GDPR — in plain language, with no small print games.

Last updated: 27 August 2026 · Governed by the laws of Malta.

1. Who we are

Owls Eye ("Owls Eye", "we", "us") is a travel discovery and affiliate comparison platform operating from Malta. We are the data controller for personal data processed through this website, within the meaning of Regulation (EU) 2016/679 (the "GDPR") as supplemented in Malta by the Data Protection Act (Chapter 586 of the Laws of Malta)and its subsidiary legislation.

Data protection contact: help@owls-eye.com.

Owls Eye is not a travel agency, tour operator or organiser of package travel. We surface offers and redirect you to third-party partners who conclude and fulfil any booking.

2. What personal data we collect

  • Data you give us: your name, email address and message content when you contact us or report a deal.
  • Search and preference data: destinations, dates, traveller numbers, driver age and similar inputs you type into our search tools.
  • Wishlist data: the items you save, stored on your own device (cookies and local storage) rather than in an account.
  • Technical data: IP address, device and browser type, pages visited, referring URL and timestamps.
  • Consent data: the cookie choices you make, when you made them and the policy version in force.

We do not knowingly collect special categories of personal data, nor payment card data — payments occur on partner sites.

3. Why we process it and our legal basis

  • Providing the search and wishlist features — Article 6(1)(b) GDPR (steps at your request) and, for non-essential cookies, your consent under Article 6(1)(a).
  • Responding to your enquiries — Article 6(1)(b) and our legitimate interests, Article 6(1)(f).
  • Security, fraud prevention and site stability — Article 6(1)(f).
  • Analytics and affiliate attribution — your consent, Article 6(1)(a), collected via our cookie banner.
  • Legal and accounting obligations under Maltese law — Article 6(1)(c).

4. Cookies and similar technologies

Cookies are governed by the Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01). Only strictly necessary cookies are placed without consent; everything else is set only after you agree through our cookie banner. Full detail is in our Cookie Policy.

5. Who we share data with

  • Affiliate and booking partners — when you click through, they receive the referral parameters and become independent controllers under their own policies.
  • Service providers — hosting, email and analytics providers acting as processors under Article 28 GDPR contracts.
  • Authorities — where we are legally required to disclose under Maltese or EU law.

We never sell personal data.

6. International transfers

Data is primarily processed within the EU/EEA. Where a provider processes data outside the EEA, we rely on an adequacy decision of the European Commission or on Standard Contractual Clauses together with appropriate supplementary measures.

7. How long we keep data

  • Enquiry correspondence: up to 24 months from the last exchange.
  • Cookie consent records: 6 months, then you are asked again.
  • Wishlist and preferences: on your device until you clear them.
  • Server and security logs: up to 12 months.

8. Your rights

Under the GDPR and Cap. 586 you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting prior lawful processing.

Write to help@owls-eye.com; we reply within one month. You may also lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC), Floor 2, Airways House, High Street, Sliema SLM 1549, Malta — idpc.org.mt.

9. Children

This website is not directed at children under 16. Our "Kids Destinations" pages are aimed at adults planning family travel. We do not knowingly process the data of minors.

10. Security and changes

We apply appropriate technical and organisational measures under Article 32 GDPR, including encryption in transit and access controls. We may update this policy; material changes are reflected in the "last updated" date and, where consent is affected, by re-asking through the cookie banner.