1. Who we are
M.A.L.S. SERVICES LIMITED (“MALS”, “we”, “us”) is a company registered in the Republic of Cyprus, with its address at 18 Thoukydidou, Limassol 3060, Cyprus. MALS is the controller of the personal data described in this policy within the meaning of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) and the Cyprus Law 125(I)/2018 on the protection of natural persons with regard to the processing of personal data.
You can contact us about anything in this policy at support [at] mals-sl.com.
2. What this policy covers
This policy applies to:
- the website at mals-sl.com (the “Website”);
- mobile applications that MALS publishes on the Apple App Store and Google Play (each an “App”);
- communications with us, including support requests and business enquiries.
An App may show additional, App-specific privacy information on its store page and inside the App. That information complements this policy.
3. Data we collect
3.1 When you visit the Website
The Website is a simple information site. It does not use analytics, advertising or tracking tools, and we do not set cookies. When you visit it, our web server automatically records technical information in its logs: your IP address, the date and time of the request, the page requested, the referring page and your browser’s user-agent string. We use this information only to deliver the Website and to keep it secure.
3.2 When you contact us
If you email us, we receive your email address, your name if you provide it, the content of your message and any attachments, and the technical information contained in email headers.
3.3 When you use our Apps
The data an App processes depends on its features. Across our Apps, it may include:
- Device and app information — device model, operating system and version, app version, language, region and time zone settings.
- Identifiers — an app-specific user or installation identifier; on iOS, the advertising identifier (IDFA) only if you allow tracking through Apple’s App Tracking Transparency prompt; on Android, the advertising ID, which you can reset or delete in your device settings.
- Purchase information — which subscription or item you bought, its status, renewal dates and transaction identifiers. Payments are processed by Apple or Google; we never receive your full payment card number.
- Usage and diagnostic data — features used, performance measurements and crash reports, which help us find and fix problems.
- Account information — if an App offers an account, the email address or sign-in identifier you use and your account settings.
- Support information — the details you share when you ask for help from inside an App.
We do not ask for special categories of personal data (such as health, biometric or political data) unless an App’s specific function requires it and you choose to provide it. In that case the App explains this and asks for your explicit consent first.
3.4 Business contacts
If you or your organisation work with us as a client, partner or supplier, we process business contact details (name, role, work email and phone number) and the correspondence and records needed to manage that relationship, including invoicing.
4. How and why we use data
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Providing the Website, the Apps and their features | Performance of a contract (b); our legitimate interest in operating our services (f) |
| Processing and managing purchases and subscriptions | Performance of a contract (b) |
| Answering your messages and providing support | Performance of a contract (b) or legitimate interests (f) |
| Keeping our services secure and preventing fraud and abuse | Legitimate interests (f) |
| Understanding how the Apps are used and fixing errors | Legitimate interests (f), or consent (a) where the law requires it |
| Measuring which advertising campaigns led to an App install (attribution) | Consent (a) where required, including Apple’s App Tracking Transparency on iOS |
| Complying with legal, tax and accounting obligations | Legal obligation (c) |
Where we rely on legitimate interests, we have balanced them against your rights, and you can object at any time (see section 8). Where we rely on consent, you can withdraw it at any time; this does not affect processing carried out before the withdrawal. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
5. Who we share data with
We do not sell personal data. We share it only with the following categories of recipients, and only as far as necessary:
- Hosting and infrastructure providers. The Website is hosted by Hetzner Online GmbH in Germany; Cloudflare, Inc. provides DNS and content delivery services. The back-end services of an App may use other hosting providers that are bound by data processing agreements.
- Apple and Google, which distribute the Apps and process payments for purchases and subscriptions under their own privacy policies.
- Analytics, crash-reporting and attribution providers used by an App. Each App lists them in its store privacy information.
- Professional advisers such as accountants, auditors and lawyers, under duties of confidentiality.
- Authorities, courts or other parties where the law requires it or where it is necessary to protect rights and safety.
- A buyer or successor, if MALS is involved in a merger, acquisition or sale of assets, in which case this policy continues to apply to your data.
Our service providers act as processors on our instructions under written agreements, except where they act as independent controllers — for example, Apple and Google for purchases made through their stores.
6. International transfers
Some recipients are located outside the European Economic Area (EEA). When we transfer personal data outside the EEA, we rely on an adequacy decision of the European Commission (for example, the EU–U.S. Data Privacy Framework for certified U.S. companies) or on the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for more information about these safeguards.
7. How long we keep data
- Website server logs — up to 14 days, after which they are deleted automatically.
- Emails and support requests — for as long as needed to resolve your request, and then for up to 24 months, unless a longer period is needed to establish, exercise or defend legal claims.
- App data — for as long as you use the App. Account data is deleted or anonymised within a reasonable time after you delete your account or ask us to delete it, unless the law requires us to keep it longer.
- Purchase and accounting records — for the period required by applicable tax and accounting laws.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy of it;
- have inaccurate data corrected and incomplete data completed;
- have your data erased in the cases provided by law;
- restrict the processing of your data;
- receive data you provided to us in a structured, machine-readable format and have it transmitted to another controller (data portability);
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw your consent at any time where processing is based on consent.
To exercise these rights, email us at support [at] mals-sl.com. We may ask you to confirm your identity. We reply within one month; for complex requests this period may be extended by two further months, and we will tell you if that happens.
Data about purchases made through Apple or Google is also held by those companies. Some requests — for example, a refund or the full history of a store subscription — have to be made to them directly.
You also have the right to lodge a complaint with a supervisory authority: in Cyprus, the Office of the Commissioner for Personal Data Protection (www.dataprotection.gov.cy), or the authority in the EU country where you live or work. We would appreciate the chance to address your concerns first.
9. Children
The Website and our Apps are not directed at children under 16, and we do not knowingly collect personal data from them. If an App is intended for a younger audience, its store listing and in-app information say so and describe any parental consent that is required. If you believe that a child has provided us with personal data, please contact us and we will delete it.
10. Security
We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), restricted key-based administrative access to our servers, and limiting access to personal data to the people who need it. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to any incident, including by notifying you and the supervisory authority where the law requires it.
11. Cookies and similar technologies
The Website does not set cookies and does not use analytics or advertising trackers. Our content delivery provider may set a strictly necessary security cookie if it needs to distinguish legitimate visitors from automated traffic.
Our Apps may use similar technologies, such as software development kits (SDKs) for analytics, crash reporting or attribution, as described in section 3.3 and in each App’s store privacy information. Where consent is required, the App asks for it before such technologies are used.
12. Changes to this policy
We may update this policy from time to time. We will publish the new version on this page with a new effective date and, where the changes are significant, give additional notice — for example, inside the App.
13. Contact us
M.A.L.S. SERVICES LIMITED
18 Thoukydidou, Limassol 3060, Cyprus
Email: support [at] mals-sl.com