Your privacy on this site
Last updated: 14 September 2026. Written to be read rather than to be survived, so if a line of it is unclear, say so and it gets rewritten.
The short version. There is no account to make, no form to fill in and no advertising anywhere. Nothing measures you unless you accept the analytics banner, and if you never accept it, nothing ever does. The only personal information that reaches us is whatever you put in an email.
Who the controller is
Popeye Village Malta (popeyevillagemalta.com) decides why and how any personal data described here is handled, which makes it the controller under the EU General Data Protection Regulation. Anything in this policy, including a request to exercise one of the rights further down, goes to admin@whattodoinmalta.com.
What is actually collected
- Nothing measured about you, until you say yes. No advertising tag, no tracking pixel, no embedded video, no social button, no chat widget and no comment system appears on any page. Google Analytics is the only measurement tool this site makes any provision for, it is loaded only where somebody has actively accepted it, and refusing or ignoring the banner means no request is made to Google from this site at all. The mechanics are set out step by step in the cookie policy.
- Partner product photographs, which load before any click. A booking panel shows each partner's own picture of the thing being sold, served from that partner's image host rather than copied onto ours. That request goes out as the panel comes into view, whatever you answered on the banner, and it tells the partner your IP address, what your browser says it is, and which page you are on. The partner may also set a cookie of its own on its own domain while answering. We receive none of it and can see none of it. The cookie policy names the hosts involved and explains why the pictures are not copied here.
- Two values kept on your own device. The places you tap the heart on, and your answer to the analytics banner. Both are held in your browser's local storage, both are readable only by this site's pages in your own browser, and neither is transmitted to us or to anyone else. We cannot see either of them.
- Email, if you send one. That gives us your address and whatever you wrote. It is used to answer you and for nothing else, no list exists to be added to, and correspondence is deleted once the matter it concerns is finished.
- Technical request records at the hosting layer. Serving a web page requires the server to see the requesting address, and our host keeps ordinary short lived request records, including IP addresses, to deliver pages and to defend the site against abuse. They are not used to build a picture of any individual reader, and we do not interrogate them.
The lawful basis for each of those
Measurement runs on your consent and on nothing else, which is why it is off until it is given and why withdrawing it takes one click in the footer of any page. Replying to a message you chose to send rests on the legitimate interest in answering correspondence. The host's request records rest on the legitimate interest, theirs and ours, in running a service that stays up and is not abused.
Who else is involved
- Google receives measurement data, and only once you have accepted. The tag is configured to shorten your IP address before it is recorded, and it is never granted the advertising permissions, because nothing here advertises. Google is a United States company, and transfers out of the EU rely principally on the EU-US Data Privacy Framework, with standard contractual clauses behind it where that does not reach. Decline, and it receives nothing whatsoever.
- Travelpayouts is the network our booking links are routed through. A marked link takes your click to them first so that it can be recorded and credited to this site, and they immediately pass you on to the partner. That is a redirect you pass through, not a tracker sitting inside our pages.
- The four booking partners, if you follow a marked link as far as one of them: Tiqets, Klook, KKday and WeGoTrip. Once you land there you are on their site under their privacy policy, and what they place on your device is their decision. Apart from the product photographs above, none of that happens unless you click, and nothing about you comes back to us afterwards. See the affiliate disclosure.
- Our hosting provider and our email provider process what is necessary to serve these pages and to carry messages you send. Ask and we will tell you who they currently are.
Nothing is sold, rented, or handed to anyone for marketing purposes. There is no advertising business here to sell it to.
How long anything is kept
Emails last as long as the thread they belong to is live, and are then removed. Request records at the hosting layer are kept and expired on the host's own schedule, which is theirs to set rather than ours to put a figure on here. The two values in your browser stay until you clear your browsing data, and they are yours to delete at any moment without asking us.
The rights you hold
Under the GDPR you may ask us to:
- tell you whether we hold personal data about you, and give you a copy of it;
- correct anything about you that is wrong;
- erase it;
- pause or stop a particular use of it;
- hand it over in a form you can take elsewhere.
Write to admin@whattodoinmalta.com and you will have an answer inside a month. In practice the honest reply to most such requests is that we hold nothing about you beyond an email thread, because that is genuinely all there is. If our answer does not satisfy you, you are free to put it to the supervisory authority for the country you live in, which for Malta is the Information and Data Protection Commissioner.
Younger readers
The site is aimed at adults arranging a trip, even though a good deal of what it describes is arranged for the benefit of children. We do not knowingly gather information about anybody under age, and there is nothing on the site designed to collect it.
Taking your consent back
Cookie settings sits in the footer of every page and reopens the same box you were shown the first time, whichever way you answered it. Choosing to decline is recorded straight away, handed to the measurement tag immediately so that anything already running stops collecting, and keeps the tag from being loaded again. Wiping your browser data has the same effect on the stored answer, with the side effect that your saved places go too and the question comes back.
If this policy changes
The date at the top moves whenever it does, and anything that materially changes what happens to your data will be said plainly on the front page rather than slipped in here.