INFORMATIVA CANDIDATI

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

provided to candidates who submit their application through the “Work with us” form, pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)

Website www.qualityservices.mt – “Work with us” section

QS Quality Services Ltd, in its capacity as Data Controller, pursuant to Article 13 of Regulation (EU) 2016/679 (hereinafter the “GDPR” or the “Regulation”) and to the Maltese implementing legislation (Data Protection Act, Chapter 586 of the Laws of Malta), provides candidates with the following information regarding the processing of personal data collected through the “Work with us” form available on the website, by means of which it is possible to apply for open positions or to submit an unsolicited application, attaching one’s Curriculum Vitae.

1. DATA CONTROLLER

The Data Controller is QS Quality Services Ltd, with registered office at 3, Triq G. Flores, Advance Business Center, Santa Venera SVR 1950 – Malta and operational office at 493, Triq St Pawl – SPB 3416 St Pawl Il Bahar – Malta, which may be contacted at the e-mail address info@qualityservices.com.mt.

2. DATA PROTECTION OFFICER (DPO)

The Data Protection Officer (DPO) may be contacted at the following details: [insert DPO e-mail address].

3. CATEGORIES OF PERSONAL DATA PROCESSED

Through the “Work with us” form and the attached Curriculum Vitae, the Controller processes in particular:

• personal identification and contact data (first name, surname, e-mail address, telephone number, and any address of residence);
• data relating to professional and educational background contained in the Curriculum Vitae and in any covering letter (educational qualifications, work experience, skills, qualifications, language and IT knowledge);
• any further data voluntarily entered by the candidate in the free-text field of the form or in the Curriculum Vitae.

Please note that, should the Curriculum Vitae contain, by the candidate’s own choice, photographs or references from which it is possible to infer data belonging to special categories within the meaning of Article 9 GDPR (for example ethnic origin, religious beliefs, health status, trade union membership), such data will be processed by the Controller solely to the extent necessary for the assessment of the application and with the safeguards provided for by the applicable legislation. Candidates are therefore invited not to include in the Curriculum Vitae any data beyond those necessary to present their professional and educational experience.

4. PURPOSES AND LEGAL BASES OF THE PROCESSING

• assessment of the application for the purposes of the possible establishment of an employment or collaboration relationship — legal basis: pre-contractual steps taken at the request of the data subject (Article 6(1)(b) GDPR);
• retention of the application for future selection processes consistent with the candidate’s professional profile, including in the absence of open positions at the time of submission — legal basis: consent of the data subject (Article 6(1)(a) GDPR), given by submitting the form, which may be withdrawn at any time;
• compliance with legal obligations connected with the management of personnel selection procedures — legal basis: Article 6(1)(c) GDPR;
• establishment, exercise or defence of a legal claim in court — legal basis: legitimate interest of the Controller (Article 6(1)(f) GDPR).

5. METHODS OF PROCESSING AND SECURITY MEASURES

The processing is carried out using IT and electronic tools, with logic strictly related to the purposes indicated above, adopting technical and organisational measures appropriate to ensure the security, integrity and confidentiality of the data pursuant to Article 32 GDPR, including access restricted solely to authorised personnel responsible for personnel selection. The processing does not involve automated decision-making processes or profiling of the candidate within the meaning of Article 22 GDPR.

6. RECIPIENTS OF THE DATA

Personal data may be processed by the Controller’s authorised personnel responsible for personnel selection and communicated to third parties acting as Processors within the meaning of Article 28 GDPR (for example the provider of the IT platform used to collect applications), as well as to public bodies to which communication is mandatory by law. The data are not disseminated and are not communicated to third parties for purposes unrelated to personnel selection.

7. TRANSFERS OF DATA OUTSIDE THE EU

Should data be transferred to countries outside the European Economic Area in connection with the use of IT services and platforms for the management of applications, the transfer will take place in compliance with the safeguards provided for in Chapter V of the GDPR (for example adequacy decisions of the European Commission or standard contractual clauses).

8. RETENTION PERIOD

The personal data and the Curriculum Vitae submitted through the “Work with us” form are retained for a maximum period of 6 (six) months from the date of receipt of the application. Upon expiry of that period, the data and the Curriculum Vitae are permanently deleted from all of the Controller’s systems and archives, unless the candidate is selected for the establishment of an employment or collaboration relationship, in which case the data will be retained in accordance with the timeframes and methods indicated in the separate privacy notice provided to employees and collaborators. Should the candidate wish his or her application to remain available for future selection processes beyond that period, a renewal of consent may be requested before the expiry of the 6 months.

9. DATA SUBJECT’S RIGHTS

As a data subject, pursuant to Articles 15 to 22 of the GDPR, you have the right to:

• access your personal data and obtain a copy thereof;
• request their rectification, updating or erasure, in the cases provided for;
• obtain restriction of processing or object to the processing, in the cases provided for;
• receive the data in a structured format (portability), where applicable;
• withdraw at any time the consent given to the retention of your application for future selection processes, without affecting the lawfulness of the processing carried out before the withdrawal;
• lodge a complaint with the competent supervisory authority, identified in Malta as the Office of the Information and Data Protection Commissioner (IDPC), Level 2, Airways House, High Street, Sliema SLM 1549, Malta.

To exercise your rights you may contact the Controller at the contact details indicated in point 1.

10. NATURE OF THE PROVISION OF DATA

The provision of the data requested through the “Work with us” form and the attachment of the Curriculum Vitae is optional; failure to provide them, however, means that the Controller will be unable to assess the application and to follow it up.

11. AMENDMENTS TO THIS INFORMATION NOTICE

The Controller reserves the right to amend or update, in whole or in part, this information notice, including as a result of changes in the applicable legislation. Candidates are therefore invited to consult this page periodically.

 

Santa Venera, 15/07/2026 – QS Quality Services Ltd

INFORMATIVA CLIENTI

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

provided to clients and their contact persons, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

Certification, inspection and training services provided by QS Quality Services Ltd

QS Quality Services Ltd, in its capacity as Data Controller, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter the “GDPR” or the “Regulation”) and to the Maltese implementing legislation (Data Protection Act, Chapter 586 of the Laws of Malta), provides the following information regarding the processing of the personal data of clients who are natural persons and of the contact persons, legal representatives or employees of clients that are legal persons (hereinafter, collectively, the “Clients”) who request and use the certification, inspection and training services provided by QS Quality Services Ltd in its capacity as a Certification and Inspection Body.

This information notice replaces and updates any previous privacy notice provided to Clients by QS Quality Services Ltd.

1. DATA CONTROLLER

The Data Controller is QS Quality Services Ltd, in the person of its legal representative pro tempore, with registered office at 3, Triq G. Flores, Advance Business Center, Santa Venera SVR 1950 – Malta and operational office at 493, Triq St Pawl – SPB 3416 St Pawl Il Bahar – Malta, which may be contacted at the e-mail address info@qualityservices.com.mt.

The processing of personal data within the organisation is entrusted to QS Quality Services Ltd personnel specifically authorised and trained for the specific type of processing carried out, pursuant to Article 29 GDPR and under the responsibility of the Controller.

2. DATA PROTECTION OFFICER (DPO)

The Data Protection Officer (DPO) may be contacted at the following details: [insert DPO e-mail address].

3. CATEGORIES OF PERSONAL DATA PROCESSED

In the context of the provision of certification, inspection and training services, the Controller processes in particular:

• personal identification and contact data of the client who is a natural person, or of the contact person, legal representative or employee of the client that is a legal person responsible for relations with QS Quality Services Ltd (first name, surname, role or job title, e-mail address, telephone number, address);
• tax, administrative and contractual data necessary for the management of the order, the contract and invoicing (by way of example: VAT number, tax code, bank details for payments);
• data relating to certification, inspection and training processes (technical documentation relating to the client’s management system, audit and inspection reports, findings and non-conformities, minutes, certificates issued, certificates of attendance of training courses);
• data of the client’s personnel involved in audits or inspections (names, roles, duties, competences), to the extent necessary to verify the conformity of the management system subject to certification;
• data relating to participants in training courses (personal identification data, contact data, results of learning assessments, certificates issued).

Please note that, in the context of specific types of audit (for example those relating to occupational health and safety management systems, such as ISO 45001), the documentation examined may incidentally contain data belonging to special categories within the meaning of Article 9 GDPR (for example data relating to accidents or to workers’ health status). Such data are processed by the Controller solely to the extent necessary for the performance of the audit activity, with the safeguards provided for by the applicable legislation, and are not retained beyond what is strictly necessary for that purpose.

4. PURPOSES AND LEGAL BASES OF THE PROCESSING

• performance of the certification, inspection or training contract and compliance with the legal and contractual obligations arising therefrom — legal basis: performance of a contract or pre-contractual steps taken at the request of the data subject (Article 6(1)(b) GDPR);
• management, organisational, statistical, administrative and accounting purposes connected with the provision of the services — legal basis: performance of the contract and compliance with legal obligations (Article 6(1)(b) and (c) GDPR);
• monitoring the performance of Auditors and Inspectors for the purposes of maintaining and improving their qualifications, in accordance with the relevant requirements of the ISO 19011 standard and as required by the ISO/IEC 17021-1 and ISO/IEC 17020 standards — legal basis: legitimate interest of the Controller and compliance with the obligations arising from accreditation (Article 6(1)(c) and (f) GDPR);
• effective management of business relations with Clients — legal basis: legitimate interest of the Controller (Article 6(1)(f) GDPR);
• compliance with tax, civil law and any other applicable legal obligations — legal basis: Article 6(1)(c) GDPR;
• formal communications , as required by law or arising from contractual obligations — legal basis: Article 6(1)(b) and (c) GDPR;
• audits by accreditation bodies on the files of Clients certified or inspected by QS Quality Services Ltd, including at the Clients’ premises, for the purposes of maintaining the Controller’s accreditation — legal basis: compliance with legal/regulatory obligations and legitimate interest of the Controller (Article 6(1)(c) and (f) GDPR);
• establishment, exercise or defence of a legal claim in court — legal basis: legitimate interest of the Controller (Article 6(1)(f) GDPR).

Any promotional communications relating to services similar to those already requested, or subscription to newsletters, are governed by the separate privacy notice dedicated to the newsletter service, made available on the website.

5. METHODS OF PROCESSING AND SECURITY MEASURES

The processing is carried out in automated and/or manual form, using IT and electronic tools and, where necessary, on paper, by specifically appointed persons, in accordance with the provisions of Article 32 GDPR on security measures and in compliance with the provisions of Article 29 GDPR. In particular: access to IT systems is selected and authorised only for authorised personnel; the accuracy of the recorded data is periodically verified by authorised personnel; the security of data processed on electronic media is ensured by means of authentication systems and periodic backup procedures; the confidentiality of paper documentation is ensured by keeping the documents in archives with controlled access, authorised only for the appointed personnel. The processing does not involve automated decision-making processes or profiling within the meaning of Article 22 GDPR.

6. RECIPIENTS OF THE DATA

In compliance with the principles of lawfulness and data minimisation, the data collected are never disseminated and are not communicated to third parties except to the extent necessary for the purposes indicated above. In particular, the data may be communicated, as independent Controllers or as Processors within the meaning of Article 28 GDPR, to:

• the sales network and authorised partners of QS Quality Services Ltd;
• credit institutions, debt collection and credit insurance companies, and business information companies, for administrative and credit management purposes;
• outsourcing companies (for example auditing and consultancy firms), providers of IT and management services;
• labour consultants, chartered accountants, law firms, professionals and consultants appointed by the Controller;
• external auditors and technical experts appointed by QS Quality Services Ltd to carry out audit and inspection activities;
• supervisory bodies and competent public bodies/authorities, where communication is mandatory by law;
• accreditation bodies (by way of example, NAB and ESYD – Hellenic Accreditation System), in the context of audit activities on the files of Clients certified or inspected by QS Quality Services Ltd, including at the Clients’ premises;
• IAF (International Accreditation Forum), EA (European co-operation for Accreditation) and the other international associations of accreditation bodies, in the context of the mutual recognition systems (Multilateral Recognition Arrangements) which may entail the inspection of the files of the accreditation bodies.

7. TRANSFERS OF DATA OUTSIDE THE EU

The Controller does not habitually transfer Clients’ personal data to countries outside the European Economic Area (EEA). Should this become necessary, for example in connection with requests from accreditation bodies or agencies established outside the EEA in the context of the mutual recognition systems referred to in point 6, or in connection with the use of IT services and platforms, the transfer will take place in compliance with the safeguards provided for in Chapter V of the GDPR (for example adequacy decisions of the European Commission or standard contractual clauses).

8. RETENTION PERIOD

Personal data are retained for the entire duration of the contractual relationship and of the certification, inspection or training cycle. At the end of that period, the data are retained for the further period provided for by the applicable legal obligations in accounting, tax and civil law matters in Malta, including, by way of example, a period of not less than 9 years pursuant to the Income Tax Management Act (Chapter 372 of the Laws of Malta) and 6 years pursuant to the VAT Act (Chapter 406 of the Laws of Malta), as well as, with reference to the technical documentation relating to certification and inspection activities, for the period provided for by the rules of the relevant accreditation body, typically not less than the entire certification cycle in progress. Upon expiry of those periods, the data are permanently deleted from all of the Controller’s systems and archives, unless their further retention is necessary for the establishment, exercise or defence of a legal claim in court.

9. DATA SUBJECT’S RIGHTS

As a data subject, pursuant to Articles 15 to 22 of the GDPR, you have the right to:

• access your personal data and obtain a copy thereof (right of access, Article 15 GDPR);
• request their rectification, where inaccurate, or their completion, where incomplete (right to rectification, Article 16 GDPR);
• request their erasure, in the cases provided for by Article 17 GDPR (right to be forgotten);
• obtain restriction of processing, in the cases provided for by Article 18 GDPR;
• receive the data in a structured, commonly used and machine-readable format, and transmit them to another controller (right to data portability, Article 20 GDPR), where applicable;
• object at any time to processing based on the legitimate interest of the Controller, on grounds relating to your particular situation (Article 21 GDPR);
• withdraw at any time any consent given, without affecting the lawfulness of the processing carried out before the withdrawal;
• object to an automated decision-making process concerning you, including profiling, within the meaning of Article 22 GDPR (without prejudice to what is indicated in point 5, namely that the Controller does not adopt processes of this kind);
• lodge a complaint with the competent supervisory authority, identified in Malta as the Office of the Information and Data Protection Commissioner (IDPC), Level 2, Airways House, High Street, Sliema SLM 1549, Malta.

Requests to exercise the rights indicated above may be sent in writing to the Controller, at the postal address of the registered office (3, Triq G. Flores, Advance Business Center, Santa Venera SVR 1950, Malta) or at the e-mail address info@qualityservices.com.mt. The Controller will provide a response without undue delay and, in any event, at the latest within one month of receipt of the request, a time limit which may be extended by a further two months in the event of particular complexity or a high number of requests, with a reasoned communication to the data subject pursuant to Article 12(3) GDPR.

10. NATURE OF THE PROVISION OF DATA

The provision of the data necessary for the management of the contractual relationship, for the provision of the certification, inspection or training services, for invoicing and for tax and accounting obligations is mandatory; any refusal to provide the data requested means that QS Quality Services Ltd will be unable to provide the activities and services requested.

11. ABSENCE OF AUTOMATED DECISION-MAKING PROCESSES

QS Quality Services Ltd does not adopt any automated decision-making process concerning natural persons, including the profiling referred to in Article 22(1) and (4) of the GDPR. Decisions relating to certification, inspection or training are always taken by competent personnel of the Controller, in compliance with the principles of impartiality provided for by the applicable accreditation schemes.

12. AMENDMENTS TO THIS INFORMATION NOTICE

The Controller reserves the right to amend or update, in whole or in part, this information notice, including as a result of changes in the applicable legislation or in the manner in which its services are provided. Clients are therefore invited to consult this page periodically.

 

Santa Venera, 15/07/2026 – QS Quality Services Ltd

INFORMATIVA FORNITORI

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

provided to suppliers and their contact persons, pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)

Relationships for the supply of goods and services to QS Quality Services Ltd

QS Quality Services Ltd, in its capacity as Data Controller, pursuant to Article 13 of Regulation (EU) 2016/679 (hereinafter the “GDPR” or the “Regulation”) and to the Maltese implementing legislation (Data Protection Act, Chapter 586 of the Laws of Malta), provides the following information regarding the processing of the personal data of suppliers who are natural persons and of the contact persons, legal representatives or employees of suppliers that are legal persons (hereinafter, collectively, the “Suppliers”) with whom QS Quality Services Ltd establishes, or considers establishing, a relationship for the supply of goods, services or professional services.

1. DATA CONTROLLER

The Data Controller is QS Quality Services Ltd, with registered office at 3, Triq G. Flores, Advance Business Center, Santa Venera SVR 1950 – Malta and operational office at 493, Triq St Pawl – SPB 3416 St Pawl Il Bahar – Malta, which may be contacted at the e-mail address info@qualityservices.com.mt.

2. DATA PROTECTION OFFICER (DPO)

The Data Protection Officer (DPO) may be contacted at the following details: [insert DPO e-mail address].

3. CATEGORIES OF PERSONAL DATA PROCESSED

In the context of the supply relationship, the Controller processes in particular:

• personal identification and contact data of the supplier who is a natural person, or of the contact person, legal representative or employee of the supplier that is a legal person responsible for relations with QS Quality Services Ltd (first name, surname, role or job title, e-mail address, telephone number, address);
• tax, administrative and banking data necessary for the management of the order, the contract and invoicing (by way of example: VAT number, tax code, bank details for payments);
• data relating to the qualification and evaluation of the supplier (professional references, certifications held, results of periodic qualification assessments), collected in the context of the quality management system adopted by QS Quality Services Ltd in accordance with the accreditation requirements applicable to its activity as a Certification Body (including the ISO/IEC 17021-1 standard);
• data contained in commercial correspondence and in contractual documentation (orders, contracts, correspondence, tender specifications).

4. PURPOSES AND LEGAL BASES OF THE PROCESSING

• management of the pre-contractual and contractual supply relationship with the supplier who is a natural person — legal basis: performance of a contract or pre-contractual steps taken at the request of the data subject (Article 6(1)(b) GDPR);
• management of relations with the contact person of the supplier that is a legal person (the contract being entered into with the company and not with the natural person) — legal basis: legitimate interest of the Controller in the proper performance of the supply relationship (Article 6(1)(f) GDPR);
• compliance with accounting, tax and administrative obligations connected with the supply — legal basis: Article 6(1)(c) GDPR;
• qualification, evaluation and periodic monitoring of suppliers in the context of the quality management system and of the accreditation and impartiality requirements applicable to its activity as a Certification Body — legal basis: legitimate interest of the Controller and compliance with legal or regulatory obligations (Article 6(1)(c) and (f) GDPR);
• establishment, exercise or defence of a legal claim in court — legal basis: legitimate interest of the Controller (Article 6(1)(f) GDPR).

5. METHODS OF PROCESSING AND SECURITY MEASURES

The processing is carried out using IT and electronic tools and, where necessary, in paper format, adopting technical and organisational measures appropriate to ensure the security, integrity and confidentiality of the data pursuant to Article 32 GDPR, including access restricted solely to authorised personnel responsible for purchasing, administration and quality management. The processing does not involve automated decision-making processes or profiling within the meaning of Article 22 GDPR.

6. RECIPIENTS OF THE DATA

Personal data may be processed by the Controller’s authorised personnel and communicated to third parties acting as Processors within the meaning of Article 28 GDPR, by way of example: credit institutions for the management of payments, tax consultants and chartered accountants, providers of IT and management services. The data may also be communicated to accreditation bodies (for example ESYD or other competent bodies) in the context of audit activities on suppliers and on third parties involved in certification processes, as well as to public bodies to which communication is mandatory by law. The data are not disseminated.

7. TRANSFERS OF DATA OUTSIDE THE EU

Should data be transferred to countries outside the European Economic Area in connection with the use of IT services and platforms for the management of the supply relationship, the transfer will take place in compliance with the safeguards provided for in Chapter V of the GDPR (for example adequacy decisions of the European Commission or standard contractual clauses).

8. RETENTION PERIOD

The data relating to the contact person are retained for the entire duration of the supply relationship and, subsequently, for the period provided for by the applicable legal obligations in accounting, tax and civil law matters in Malta, including, by way of example, a period of not less than 9 years pursuant to the Income Tax Management Act (Chapter 372 of the Laws of Malta) and 6 years pursuant to the VAT Act (Chapter 406 of the Laws of Malta), without prejudice to any longer periods provided for by specific legal or regulatory provisions applicable to the individual relationship. The data collected during the qualification stage of suppliers that are not selected are retained for the time necessary for the relevant assessment and are subsequently deleted or anonymised, unless the supplier gives his or her consent to a longer retention for the purposes of future selection processes.

9. DATA SUBJECT’S RIGHTS

As a data subject, pursuant to Articles 15 to 22 of the GDPR, you have the right to:

• access your personal data and obtain a copy thereof;
• request their rectification, updating or erasure, in the cases provided for;
• obtain restriction of processing or object to the processing, in the cases provided for;
• receive the data in a structured format (portability), where applicable;
• lodge a complaint with the competent supervisory authority, identified in Malta as the Office of the Information and Data Protection Commissioner (IDPC), Level 2, Airways House, High Street, Sliema SLM 1549, Malta.

Requests to exercise the rights indicated above may be sent in writing to the Controller, at the postal address of the registered office (3, Triq G. Flores, Advance Business Center, Santa Venera SVR 1950, Malta) or at the e-mail address info@qualityservices.com.mt. The Controller will provide a response without undue delay and, in any event, at the latest within one month of receipt of the request, a time limit which may be extended by a further two months in the event of particular complexity or a high number of requests, with a reasoned communication to the data subject pursuant to Article 12(3) GDPR.

10. NATURE OF THE PROVISION OF DATA

The provision of the data necessary for the management of the supply relationship, for invoicing and for tax and accounting obligations is mandatory; failure to provide them means that the supply relationship cannot be established or continued. The provision of further data requested for the purposes of the qualification and evaluation of the supplier is, however, optional, without prejudice to the possibility for the Controller to take this into account for the purposes of supplier selection.

11. AMENDMENTS TO THIS INFORMATION NOTICE

The Controller reserves the right to amend or update, in whole or in part, this information notice, including as a result of changes in the applicable legislation. Suppliers are therefore invited to consult this information notice periodically.

 

Santa Venera, 15/07/2026 – QS Quality Services Ltd

INFORMATIVA NEWSLETTER

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

provided to subscribers to the newsletter service pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)

Website www.qualityservices.mt – newsletter service

QS Quality Services Ltd, in its capacity as Data Controller, pursuant to Article 13 of Regulation (EU) 2016/679 (hereinafter the “GDPR” or the “Regulation”) and to the Maltese implementing legislation (Data Protection Act, Chapter 586 of the Laws of Malta), provides the following information regarding the processing of the personal data of users who subscribe to the newsletter service through the dedicated form available on the website, as well as of clients who have provided their e-mail address when placing an order for the certification, inspection or training services offered by QS Quality Services Ltd.

1. DATA CONTROLLER

The Data Controller is QS Quality Services Ltd, with registered office at 3, Triq G. Flores, Advance Business Center, Santa Venera SVR 1950 – Malta and operational office at 493, Triq St Pawl – SPB 3416 St Pawl Il Bahar – Malta, which may be contacted at the e-mail address info@qualityservices.com.mt.

2. DATA PROTECTION OFFICER (DPO)

The Data Protection Officer (DPO) may be contacted at the following details: [insert DPO e-mail address].

3. CATEGORIES OF PERSONAL DATA PROCESSED

In the context of the newsletter service, the Controller processes in particular:

• the e-mail address (and possibly the name) provided by the user at the time of subscription through the newsletter form available on the site;
• the e-mail address provided by the client when placing an order for the certification, inspection or training services offered by QS Quality Services Ltd;
• statistical data on sending (for example opening or non-delivery of the message), generated automatically by the platform used to send the communications.

4. PURPOSES AND LEGAL BASES OF THE PROCESSING

• sending the newsletter to users who have voluntarily subscribed through the form on the site, with updates on legislation, events, courses and webinars organised by QS for the certification sector — legal basis: consent of the data subject (Article 6(1)(a) GDPR), given at the time of subscription and which may be withdrawn at any time;
• sending communications relating to services similar to those already requested to clients who have provided their e-mail address when placing an order — legal basis: legitimate interest of the Controller (Article 6(1)(f) GDPR), within the limits of the exception for the direct marketing of its own similar products or services to existing clients, provided for by the Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01 of the Laws of Malta), without prejudice to the client’s right to object, free of charge, to the use of his or her e-mail address for such purposes, both at the time the data are collected and on the occasion of each subsequent communication;
• technical management of sending and aggregate statistical analysis of the communications sent, for the purposes of the proper functioning of the service — legal basis: legitimate interest of the Controller (Article 6(1)(f) GDPR).

5. METHODS OF PROCESSING

The processing is carried out using IT and electronic tools, including by means of a platform for sending and managing e-mail communications, adopting technical and organisational measures appropriate to ensure the security, integrity and confidentiality of the data pursuant to Article 32 GDPR. The processing does not involve automated decision-making processes or profiling of subscribers within the meaning of Article 22 GDPR.

6. RECIPIENTS OF THE DATA

Personal data may be processed by the Controller’s authorised personnel and communicated to third parties acting as Processors within the meaning of Article 28 GDPR, such as for example the provider of the IT platform used to send and manage the newsletter, as well as to public bodies to which communication is mandatory by law. Subscribers’ e-mail addresses are not transferred, communicated or disseminated to third parties for the latter’s own marketing purposes.

7. TRANSFERS OF DATA OUTSIDE THE EU

Should data be transferred to countries outside the European Economic Area in connection with the use of the newsletter sending and management platform, the transfer will take place in compliance with the safeguards provided for in Chapter V of the GDPR (for example adequacy decisions of the European Commission or standard contractual clauses).

8. RETENTION PERIOD

The e-mail address of subscribers to the newsletter service is retained until the withdrawal of consent or the data subject’s objection, which may be exercised at any time through the dedicated unsubscribe link at the bottom of each communication, or by sending a request to info@qualityservices.com.mt. E-mail addresses that are found to be no longer valid or that have been inactive for a prolonged period may also be deleted by the Controller on its own initiative, in compliance with the principle of storage limitation (Article 5(1)(e) GDPR).

9. DATA SUBJECT’S RIGHTS

As a data subject, pursuant to Articles 15 to 22 of the GDPR, you have the right to:

• access your personal data and obtain a copy thereof;
• request their rectification, updating or erasure, in the cases provided for;
• obtain restriction of processing, in the cases provided for;
• withdraw at any time the consent given to the newsletter subscription, without affecting the lawfulness of the processing carried out before the withdrawal;
• object at any time, free of charge and without the need to give reasons, to the sending of communications for direct marketing purposes, including where the processing is based on the legitimate interest of the Controller, pursuant to Article 21(2) and (3) GDPR: in such case your data will no longer be processed for such purposes;
• lodge a complaint with the competent supervisory authority, identified in Malta as the Office of the Information and Data Protection Commissioner (IDPC), Level 2, Airways House, High Street, Sliema SLM 1549, Malta.

To exercise your rights you may use the unsubscribe link included in each communication or contact the Controller at the contact details indicated in point 1.

10. NATURE OF THE PROVISION OF DATA

The provision of the e-mail address for the purposes of subscribing to the newsletter is optional; failure to provide it means only that it will not be possible to receive the communications relating to the service. With reference to the use of the e-mail address already provided when placing an order, any objection by the data subject does not in any way affect the performance of the contract or of the services already requested.

11. AMENDMENTS TO THIS INFORMATION NOTICE

The Controller reserves the right to amend or update, in whole or in part, this information notice, including as a result of changes in the applicable legislation. Users are therefore invited to consult this page periodically.

 

Santa Venera, 15/07/2026 – QS Quality Services Ltd

 

 

INFORMATIVA SOCIAL NETWORK

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

provided in relation to the links available on the website to the social networks LinkedIn and Instagram, pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)

Website www.qualityservices.mt

At the bottom of its pages, the website www.qualityservices.mt (hereinafter the “Site”) displays certain icons linking to the official profiles of QS Quality Services Ltd on the social networks LinkedIn and Instagram. This information notice, provided pursuant to Article 13 of Regulation (EU) 2016/679 (hereinafter the “GDPR” or the “Regulation”), supplements the Site’s general Privacy Notice and the Cookie Policy, and is intended to explain, clearly and comprehensively, what data are processed in relation to such links, who is responsible for them and what rights the user has.

1. DATA CONTROLLER

The Data Controller of the data collected through the Site and the official pages of QS Quality Services Ltd on social networks is QS Quality Services Ltd, with registered office at 3, Triq G. Flores, Advance Business Center, Santa Venera SVR 1950 – Malta and operational office at 493, Triq St Pawl – SPB 3416 St Pawl Il Bahar – Malta, which may be contacted at the e-mail address info@qualityservices.com.mt.

2. DATA PROTECTION OFFICER (DPO)

The Data Protection Officer (DPO) may be contacted at the following details: [insert DPO e-mail address].

3. NATURE OF THE LINKS AVAILABLE ON THE SITE

As at the date of drafting of this information notice, the LinkedIn and Instagram icons available on the Site constitute simple hyperlinks (links) which, if selected voluntarily by the user, open the official profile of QS Quality Services Ltd on the corresponding platform, in a new browser page or tab. As matters currently stand, the Site does not incorporate plugins, widgets, embedded “Like”/“Follow” buttons or other third-party components that entail the automatic loading of resources from LinkedIn or Instagram servers during the mere consultation of the Site’s pages.

Consequently, merely viewing the pages of the Site does not entail the transmission of the user’s personal data to LinkedIn or Instagram, nor the installation on the user’s device of cookies or identifiers attributable to such platforms. The transfer of data to LinkedIn or Instagram takes place solely at the moment when the user voluntarily clicks on the icon and is directed to the site or application of the social platform, the consultation of which is governed by the terms of use and the privacy notice of that platform.

Should the Site in the future incorporate social plugins or widgets that entail the automatic collection of data or the installation of third-party cookies already upon loading of the page, this information notice and the Site’s Cookie Policy will be updated in advance and the user will be asked for consent, in accordance with Directive 2002/58/EC (as amended by Directive 2009/136/EC), transposed in Malta by the Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01), as well as with the principles set out by the Court of Justice of the European Union in its judgment of 29 July 2019, Case C-40/17 (Fashion ID), concerning the joint responsibility of the site operator for social plugins.

4. ROLE OF LINKEDIN AND INSTAGRAM AS INDEPENDENT DATA CONTROLLERS

Once the user accesses the LinkedIn or Instagram profile of QS Quality Services Ltd, the processing of personal data carried out on the platform (account creation, browsing history, interactions, personalised advertising, cookies and tracking technologies of the platform itself) is carried out entirely autonomously by the relevant operator, as an independent Data Controller:

• LinkedIn the services are operated by LinkedIn Ireland Unlimited Company, subject to its own privacy notice, available at https://www.linkedin.com/legal/privacy-policy;
• Instagram the services are operated by Meta Platforms Ireland Limited, subject to its own privacy notice, available at https://privacycenter.instagram.com/policy.

QS Quality Services Ltd does not have access to the user’s credentials, does not receive from the platform the identifying data of users who merely visit the social profile, and is not in a position to control or determine the purposes and means of the processing carried out by the platform itself. Users are therefore invited to consult the privacy and cookie notices of the respective platforms before interacting with them.

5. USER INTERACTION WITH THE OFFICIAL QS PAGES (LIMITED JOINT CONTROLLERSHIP)

Should the user interact with the official pages of QS Quality Services Ltd on LinkedIn or Instagram (for example by posting comments, sending direct messages, “Liking” or following the page), such data are collected and processed in the first instance by the platform as an independent Controller, in accordance with its respective terms of use.

With reference solely to the statistical data and aggregate “insights” that the platform makes available to QS Quality Services Ltd in its capacity as page operator (for example the number and aggregate demographic profile of visitors), QS Quality Services Ltd and the platform may qualify as joint controllers, limited to such statistical data, in application of the principles set out by the Court of Justice of the European Union in its judgment of 5 June 2018, Case C-210/16 (Wirtschaftsakademie Schleswig-Holstein). In such cases, the respective responsibilities are allocated in accordance with the agreements and policies made available by the platform to page operators (for example the “Controller-to-Controller Data Protection Terms” or a similar document), which QS Quality Services Ltd accepts in its capacity as page administrator.

QS Quality Services Ltd does not process or extract from the messages, comments or interactions received on its official pages any data beyond those made visible by the platform, and does not carry out any independent profiling of users who interact with such pages.

6. PURPOSES AND LEGAL BASES OF THE PROCESSING CARRIED OUT BY QS THROUGH THE SOCIAL PAGES

• management and updating of the official pages for the purposes of institutional communication and promotion of the services offered — legal basis: legitimate interest of the Controller (Article 6(1)(f) GDPR);
• management of messages and requests received through the official pages — legal basis: pre-contractual steps taken at the request of the data subject or performance of a contract (Article 6(1)(b) GDPR);
• aggregate statistical analysis of interactions with the official pages, for the purposes of improving communication — legal basis: legitimate interest of the Controller (Article 6(1)(f) GDPR).

7. DATA PROCESSED

Within the scope described in point 5, QS Quality Services Ltd may become aware only of the data that the user voluntarily decides to communicate through public comments, direct messages or reviews on the official pages (for example username, content of the message and any contact details voluntarily provided), as well as of aggregate and anonymous statistical data relating to the population of visitors to the pages, provided by the platform.

8. RECIPIENTS AND TRANSFERS OF DATA OUTSIDE THE EU

The data processed directly by QS Quality Services Ltd within the scope described in point 6 may be communicated to parties acting as Processors within the meaning of Article 28 GDPR (for example collaborators responsible for the management of social communication), as well as to public bodies to which communication is mandatory by law.

Please note that LinkedIn Ireland Unlimited Company and Meta Platforms Ireland Limited, as independent Data Controllers for the data collected on their respective platforms, may transfer users’ personal data to countries outside the European Economic Area, including the United States of America, on the basis of the safeguards provided for in Chapter V of the GDPR (in particular standard contractual clauses). For further information on such transfers, reference is made to the privacy notices of the respective platforms, referred to in point 4.

9. RETENTION PERIOD

The data relating to messages, comments or requests received by QS Quality Services Ltd through the official pages are retained for the time necessary to handle the interaction or the request and, subsequently, for the period provided for by the applicable legal obligations, in compliance with the principle of storage limitation (Article 5(1)(e) GDPR). For the retention periods of the data processed autonomously by LinkedIn and Instagram, reference is made to their respective privacy notices.

10. DATA SUBJECT’S RIGHTS

As a data subject, pursuant to Articles 15 to 22 of the GDPR, you have the right to access your personal data and obtain a copy thereof, to request their rectification, updating or erasure in the cases provided for, to obtain restriction of processing or to object to the processing in the cases provided for, to receive the data in a structured format where applicable and to lodge a complaint with the competent supervisory authority, identified in Malta as the Office of the Information and Data Protection Commissioner (IDPC), Level 2, Airways House, High Street, Sliema SLM 1549, Malta.

For the data processed directly by QS Quality Services Ltd (points 6 and 7), such rights may be exercised by contacting the Controller at the contact details indicated in point 1. For the data processed autonomously by LinkedIn or Instagram as independent Controllers (point 4), such rights must instead be exercised directly vis-à-vis the respective platform, in accordance with the procedures set out in their respective privacy notices; QS Quality Services Ltd is in fact not in a position to access, modify or delete data that are held exclusively by the platform.

11. AMENDMENTS TO THIS INFORMATION NOTICE

The Controller reserves the right to amend or update, in whole or in part, this information notice, including as a result of changes in the applicable legislation or of the possible introduction on the Site of social plugins or widgets. Users are therefore invited to consult this page periodically.

 

Santa Venera, 15/07/2026 – QS Quality Services Ltd