Privacy policy

Last updated: 24 October 2026

Who we are

Cloud 9 Residence (“Cloud 9 Gozo”, “we”, “us” or “our”) operates the holiday home at 9 Triq Filfla, Għajnsielem GSM 1411, Malta, and this website, cloud9gozo.com. We are the data controller for the personal data described in this policy. For any question about your personal data, please email info@cloud9gozo.com.

Information we collect

Enquiries. When you use our contact form, email us or message us on WhatsApp, we receive your name, contact details, your message and any details you choose to add, such as your travel dates, the number of guests or a phone number.

Reservations. When you book directly on this website, we collect the lead guest’s name, email address, mobile number, billing address and country, the dates of the stay, the number of adults and children, the selected rate, any additional information you provide, and the date and time you accepted our Booking Terms & Conditions. We also keep a record of the payment status and of any cancellation or refund.

Bookings made through other platforms. If you book through Booking.com or Airbnb, that platform shares the reservation details we need to host your stay, such as your name, contact details, dates and number of guests.

During your stay. We may ask for identification or other information where this is required for accommodation registration or other legal obligations in Malta, and we keep a record of the damage deposit and environmental contribution.

Website use. When you visit the website, our hosting provider’s servers automatically record technical information such as your IP address, browser type and the pages requested, to deliver the website and keep it secure. To prevent spam and misuse, the contact and booking forms briefly keep a coded (hashed) form of your IP address to limit repeated submissions.

How we use your information

To answer enquiries and manage reservations, including quotations, confirmations, arrival arrangements, communication before and during your stay, and checkout. The legal basis is the performance of our contract with you, or steps you ask us to take before entering into one. Without this information we cannot accept a reservation.

To take payments and keep financial records, including refunds, and to meet our accounting and tax obligations. The legal bases are the performance of our contract and compliance with legal obligations.

To protect our guests, our property and this website, to prevent fraud and misuse, to resolve disputes and to establish or defend legal claims. The legal basis is our legitimate interest in running a safe and secure business, or compliance with a legal obligation where one applies.

Marketing. We do not send marketing messages unless the law permits it, and where your consent is required we will ask for it first. You may withdraw your consent or object to marketing at any time.

We do not sell personal data, and we do not use it for automated decision-making or profiling.

Payments

Online payments are processed by Stripe. Card details are entered on Stripe’s secure payment page and are never sent to or stored by us. To match a payment to your reservation, we share your email address, booking reference, stay dates and the amount due with Stripe, and Stripe tells us whether the payment succeeded. Stripe processes payment information under its own privacy policy.

Who we share information with

We share personal data only where necessary to provide our services or where the law requires it. Recipients are:

• Stripe, which processes online payments;
• our website and email hosting providers, which store the website, our reservation records and our email on our behalf;
• professional advisers such as accountants or lawyers, where needed;
• public authorities, where we are legally required to disclose information.

We keep the availability calendars of this website, Booking.com and Airbnb in step so that the same dates cannot be booked twice. Only booked dates are exchanged; no guest names or contact details are shared through these calendars.

Third-party services on this website

Some features of the website rely on external services. When you use them, your browser connects to that service directly and it receives your IP address and basic technical information:

• Weather. The Explore Gozo page and the Guest Guide show current weather and sea conditions from Open-Meteo (open-meteo.com). No other personal data is sent.
• Maps. Google Maps is loaded only if you choose “Show map” or follow a link to Google Maps. Google then processes your data under its own privacy policy.
• Country flags. When you choose your country in the booking form, small flag images are loaded from flagcdn.com.
• WhatsApp. Our WhatsApp links open WhatsApp, operated by Meta. Messages you send us there are also subject to WhatsApp’s privacy policy.

The website’s fonts are hosted on our own server. We do not use analytics, advertising or social media tracking tools.

Cookies and similar technologies

This website does not place cookies on your device when you browse or book, and it does not use tracking cookies. When you continue to payment, your browser temporarily remembers your selected dates and party size, so that you can easily try again if you leave the payment page without paying. This information stays on your device and is deleted when you close the browser tab.

Stripe’s payment page, and Google Maps if you choose to display a map, may use their own cookies, which are governed by their respective policies. You can block or delete cookies at any time in your browser settings.

International transfers

Some of our service providers may process personal data outside the European Economic Area. Where this happens, we make sure the transfer is protected by an appropriate safeguard under the GDPR, such as a European Commission adequacy decision or the Commission’s standard contractual clauses.

How long we keep information

We keep personal data only for as long as we need it for the purposes described in this policy:

• reservation, payment and invoicing records are kept for the period required by Maltese tax and accounting law;
• enquiries that do not lead to a booking are deleted once they are no longer needed to answer you;
• information needed for a dispute or legal claim is kept until the matter is resolved.

When information is no longer needed, we delete it or make it anonymous.

Your rights

Under the General Data Protection Regulation (GDPR), you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. Where we rely on your consent, you may withdraw it at any time; this does not affect processing carried out before you withdrew it.

To exercise any of these rights, email info@cloud9gozo.com. We may ask you to confirm your identity, and we will reply within one month, as the GDPR requires.

Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. The website is served over an encrypted connection (HTTPS), access to our booking records is restricted, and card payments are handled entirely by Stripe.

Complaints

If you have a concern about how we handle your personal data, please contact us first and we will do our best to resolve it. You also have the right to complain to the Information and Data Protection Commissioner (IDPC) in Malta, or to the data protection authority in the country where you live.

Changes to this policy

We may update this policy from time to time, for example when our services or the law change. The current version is always published on this page, with the date it was last updated.

Contact us

Cloud 9 Residence
9 Triq Filfla, Għajnsielem GSM 1411, Malta
Email: info@cloud9gozo.com