In short
- We never sell your personal data, and we do not rent or trade it.
- Without your consent we only count visits anonymously. Nothing is stored on your device and we do not keep your IP address.
- Analytics and advertising cookies are used only if you say yes, and you can change your mind at any time.
- If you sign up for the eBike launch offer, we use your email to send you your 15% discount and launch news, nothing else.
Who we are
This website is run by Gozo Activities, based on Gozo, Malta. We are the data controller for the personal data described here, which means we decide how and why it is used.
For anything about your data, email hello@gozoactivities.com. We answer within one month, as the law requires.
What we collect, and why
1. Anonymous visit statistics (every visitor)
When you load a page, our server counts it. For each visit we record: the page, the website or campaign that sent you (for example “Google” or a campaign name in the link), your approximate location (country, region and city, worked out by our hosting provider from your IP address), your device type, browser and operating system, your browser’s language and time zone, and how long each page was on screen.
These are stored only as totals, such as “12 visits from Italy today”. We do not store your IP address. To count unique visitors we combine the IP address and browser details with a random value that changes every day, and keep only a one-way hash of the result. Once the day is over the hashes are replaced by a single count and the random value is deleted, so no one, including us, can connect a visit to a device. No cookie or other storage on your device is used for this.
Why: to understand which pages are useful and where our visitors come from, so we can improve the site and decide where to advertise. Legal basis: our legitimate interest in running and improving our website (GDPR Article 6(1)(f)), which we have balanced against your privacy by keeping only anonymous totals.
2. Analytics cookies (only with your consent)
If you accept analytics, we also set our own gza_vid cookie so we can tell new visitors from returning ones, remember the source of your visit until you close the tab, and load Google Analytics, which uses its own cookies to produce similar statistics. Legal basis: your consent (GDPR Article 6(1)(a)).
3. Marketing cookies (only with your consent)
If you accept marketing, we load the Google Ads tag and the Meta pixel (Facebook and Instagram). These tell us whether our ads led to visits and eBike sign-ups, and allow Google and Meta to show our ads to people who have visited this site. With this consent Google Analytics may also use Google signals, which gives us age range, gender and interest reports in aggregate form, based on information Google holds about signed-in account holders. We never see these details for any individual. Legal basis: your consent (GDPR Article 6(1)(a)).
For the Meta pixel, Meta Platforms Ireland Ltd and we are joint controllers for collecting and sending the data; Meta is responsible for what it does with it afterwards, described in Meta’s privacy policy. Google’s use is described in how Google uses information from sites that use its services.
4. eBike launch offer sign-ups
When you sign up for the eBike launch offer, we collect your email address, the language you were browsing in, which form you used, the time, and the IP address and browser details the request was sent from. We use them to send you your 15% discount and news about the eBike launch, and to prevent spam and abuse of the offer. We will not send you anything unrelated, and every email lets you stop further emails.
Legal basis: your consent, given when you sign up (GDPR Article 6(1)(a)), which you can withdraw at any time from any of our emails or by contacting us; and our legitimate interest in preventing abuse (Article 6(1)(f)) for the IP address and browser details.
5. Dashboard login security
This applies only to our staff. Attempts to sign in to our site dashboard are rate-limited using a keyed, one-way hash of the IP address that expires after an hour and is deleted within a day, and a log of recent attempts records the approximate location and browser.
We do not sell your data
We do not sell, rent or trade personal data, and we do not give it to anyone for their own marketing. The only organisations that receive it are the service providers listed below, to run the site for us, and, only if you accepted marketing cookies, Google and Meta as described in section 3.
Who else handles the data
- Netlify, our hosting provider, which serves the website, supplies the approximate location of each request, and stores our anonymous visit totals.
- Google: Google Sheets stores eBike launch sign-ups; Google Analytics and Google Ads run only with your consent; YouTube (in its privacy-enhanced mode) plays the video on our homepage.
- Resend, if used, delivers our notification emails about new sign-ups.
- Meta, only with your marketing consent.
- Unsplash, which serves some photographs on the site and receives your IP address when they load, like any image host.
Some of these providers are based in, or may process data in, the United States. Where they do, the transfer is covered by the EU-US Data Privacy Framework or by the European Commission’s standard contractual clauses.
How long we keep it
- Anonymous visit totals: kept for as long as they are useful. They contain no personal data.
- List of recent visits: the last 150 visits (page, source, city, device; no IP or identifier), then overwritten.
- Daily counting value: deleted after two days. Each day’s one-way visitor hashes are replaced by a single number once the day is over.
- Our visitor cookie and Google Analytics cookies: 13 months, or until you clear them or withdraw consent.
- Google Analytics data: 14 months.
- eBike launch sign-ups: until bookings open and for up to two years after, unless you unsubscribe or ask us to delete them sooner.
- Dashboard login data: up to seven days.
Your rights
You can ask us for a copy of the personal data we hold about you, ask us to correct it or delete it, ask us to restrict or stop using it, object to our use of it based on legitimate interests, or ask for it in a portable format. Where we rely on consent you can withdraw it at any time, which does not affect what we did before. Contact us using the details under “Who we are”.
If you are unhappy with how we handle your data, you can complain to the Maltese supervisory authority, the Information and Data Protection Commissioner, or to the authority in the EU country where you live. We would appreciate the chance to put it right first.
Cookies and similar technologies
Strictly necessary cookies are always on because the site cannot remember basic choices without them. Everything else waits for your permission. Closing the banner without choosing does not count as consent.
| Name | Type | Purpose | Lasts | Set by |
|---|---|---|---|---|
gza_consent | Strictly necessary | Remembers your cookie choice so we do not ask on every page. | 12 months | Us |
lang | Strictly necessary | Remembers the language you picked. | 12 months | Us |
ga_ebike_popup_seen, ga_ebike_signed_up | Strictly necessary | Browser storage that stops the eBike offer pop-up reappearing after you close it or sign up. | Until cleared | Us |
gza_admin, gza_adm_dev | Strictly necessary | Only set for our own staff signing in to the site dashboard. Keep the login secure and limit wrong PIN attempts. | 12 hours / 12 months | Us |
gza_vid | Analytics | A random ID that tells us whether you have visited before. It contains nothing about you. | 13 months | Us |
gza_attr | Analytics | Browser session storage that remembers which site or campaign brought you here, until you close the tab. | Browser session | Us |
_ga, _ga_* | Analytics | Google Analytics: counts visitors and how they use the site. | 13 months | |
_gcl_* | Marketing | Google Ads: tells us whether a visit came from one of our ads and led to a sign-up. | 90 days | |
_fbp, _fbc | Marketing | Meta pixel: measures our Facebook and Instagram ads and lets us show ads to people who visited. | 90 days | Meta |
To change your choice, use the button below or the “Cookie settings” link at the bottom of every page. Withdrawing consent deletes our analytics and advertising cookies from your browser and stops the tags loading.
Children
This website is not aimed at children under 16, and we do not knowingly collect their data.
Changes to this policy
If we change how we use data, we will update this page and the date at the top. If a change needs your consent, we will ask again. You can always find the current version at gozoactivities.com/privacy.