Privacy Policy
Last updated: 26 October 2026
This policy explains how MGF Ltd collects and uses your personal data when you visit mgf.com.mt, send us an enquiry, reply to one of our Facebook or Instagram adverts, or buy a property from us. It follows the EU General Data Protection Regulation (GDPR) and Malta's Data Protection Act (Cap. 586).
1. Who we are
MGF Ltd is the data controller for your personal data. This means we decide how and why it is used.
- Company: MGF Ltd, registered in Malta, company number C 75837
- Registered address: Factory A25F, Industrial Estate, Marsa MRS 3000, Malta
- Email: [email protected]
- Phone: +356 9924 3455
- WhatsApp: +356 9924 3455
We have not appointed a Data Protection Officer. For any privacy question, email us at [email protected].
2. What data we collect
Depending on how you deal with us, we may collect:
- Contact details: your name, email address and phone number.
- Enquiry details: your message, the property you are interested in and, for ORA Residences, the unit you ask about.
- Lead form answers: the residence you are interested in, your buying timeline and whether you are buying to live in or to invest.
- Messages: what you send us by WhatsApp or email.
- Viewing appointments: the dates, times and notes of any viewings we arrange.
- Marketing preferences: whether you have agreed to hear about new MGF projects.
- Website technical data: your IP address, browser details and cookie choices. See section 10.
- Buyer due diligence data: if a sale goes ahead and the law requires it, your identity document, proof of address and source of funds.
3. Where we get your data
- From you directly: when you call, email, meet us or attend a viewing.
- Website forms: the enquiry forms on our contact page and on the Mike's Court, ORA Residences and Żurrieq property pages.
- Meta (Facebook and Instagram lead forms): when you submit a lead form in one of our adverts, Meta passes us the details you entered in that form.
- WhatsApp: when you message us.
- Estate agents or referrers: when someone introduces you to us as a possible buyer.
When we receive your data from someone else, such as an estate agent, we tell you what we hold and where it came from. We do this when we first contact you, and in any case within one month.
4. Why we use it and our lawful basis
We only use your data when the law allows it. The table below sets out each purpose and the lawful basis we rely on.
| Purpose | Lawful basis |
|---|---|
| Reply to your enquiry, send brochures and arrange viewings | Steps you ask us to take before entering a contract, Art. 6(1)(b) GDPR |
| Follow up on your enquiry | Legitimate interests, Art. 6(1)(f) GDPR. Our interest is responding to buyers who have shown interest in our properties. |
| Send marketing emails and news about new MGF projects | Consent, Art. 6(1)(a) GDPR |
| Prepare and carry out sale contracts, the promise of sale (konvenju) and invoicing | Contract, Art. 6(1)(b) GDPR |
| Keep anti-money laundering, tax and accounting records | Legal obligation, Art. 6(1)(c) GDPR |
| Measure our advertising through the Google Ads tag | Consent, Art. 6(1)(a) GDPR |
Our website forms include an optional, unticked box to receive news about new MGF projects. We only send you marketing if you tick it or otherwise give us your consent. You can withdraw consent at any time.
If you do not give us the data we need to handle your enquiry or complete a sale, we cannot proceed.
Data from Facebook and Instagram lead forms
When you submit a lead form in one of our Facebook or Instagram adverts, we use your details only to:
- contact you about the property you asked about;
- send you the information you requested; and
- arrange a viewing if you want one.
We do not use lead form data for any unrelated purpose. We only send you marketing about other projects if you have given your consent. Meta's own use of your data is covered by Meta's privacy policy.
6. International transfers
Some of our providers, such as Meta, Google, Microsoft, FormSubmit and GoDaddy, may process your data in the United States or elsewhere outside the European Economic Area. When this happens, we rely on the EU-US Data Privacy Framework or on Standard Contractual Clauses approved by the European Commission. You can ask us for details at [email protected].
7. How long we keep it
| Data | How long |
|---|---|
| Enquiries and leads | 24 months after our last contact with you |
| Marketing data | Until you withdraw your consent |
| Contract and accounting records | 10 years |
| Anti-money laundering records | 5 years after the business relationship ends |
After these periods, we delete your data or make it anonymous.
8. Your rights
You have the right to:
- Access the personal data we hold about you.
- Rectification: ask us to correct data that is wrong or incomplete.
- Erasure: ask us to delete your data.
- Restriction: ask us to limit how we use your data.
- Portability: receive your data in a common format, or have it sent to someone else.
- Objection: object to our use of your data based on legitimate interests. You can always object to direct marketing, and we will stop.
- Withdraw consent at any time. This does not affect what we did before you withdrew it.
- Not be subject to decisions based solely on automated processing. We do not make any such decisions.
How to use your rights
Email us at [email protected]. We reply within one month. If your request is complex, we may extend this by up to two more months, and we will tell you if we do. We may ask you to prove your identity. We normally do not charge a fee.
9. Complaints
If you have a concern, please contact us first at [email protected]. We will try to put it right.
You also have the right to complain to the Information and Data Protection Commissioner (IDPC) in Malta:
- Website: idpc.org.mt
- Address: Floor 2, Airways House, Triq Il-Kbira, Tas-Sliema SLM 1549, Malta
- Phone: +356 2328 7100
11. Security
We protect your data with:
- access controls on our systems and files;
- encrypted transfer (HTTPS) on our website;
- access limited to staff who need it; and
- business accounts with multi-factor authentication where available.
12. Children
Our website and services are not aimed at anyone under 16. We do not knowingly collect their data. If you think we hold data about a child, please contact us and we will delete it.
13. Changes to this policy
We may update this policy. When we do, we post the new version here and change the "Last updated" date. If we make significant changes, we will tell you directly where appropriate.
Last updated: 26 October 2026.