Uncategorised Archives - Enemalta

Electricity Network Reinforcement Works in Triq il-Ħwawar

Lorraine Gravino — Fri, 23 Oct 2026 11:56:56 +0000

Electricity Network Reinforcement Works in Triq il-Ħwawar

23.10.2026

Enemalta has commenced electricity distribution network reinforcement works in Triq il-Ħwawar, in the vicinity of Iklin and San Ġwann, as part of its ongoing efforts to improve the reliability and efficiency of the electricity supply.

Due to these works, Triq il-Ħwawar will be temporarily closed to traffic travelling to and from Triq tal-Balal.

Residents and motorists are kindly requested to follow the temporary traffic signs and arrangements in place throughout the duration of the works.

Enemalta thanks the public for their patience, understanding and cooperation, and apologises for any inconvenience caused.

The post Electricity Network Reinforcement Works in Triq il-Ħwawar appeared first on Enemalta.

An investment of 90 million euros, to strengthen the electricity distribution system

Lorraine Gravino — Tue, 22 Feb 2022 09:36:02 +0000

An investment of 90 million euros, to strenghten the electricity distribution system

22.02.2022

Enemalta has announced an investment plan to improvement its infrastructure across Malta and Gozo.

Works have already started in a number of localities and will maintain a steady pace throughout the six-year timeline. This investment includes the construction of around 40 to 50 new substations per year, as well as the renovation to existing ones. The plan includes also replacement of lines, installation of line voltage regulators, as well as the expansion of the Tarxien, Marsaskala, and Mrieħel Distribution Centers, together with the construction of a new Distribution Center in Naxxar.

The post An investment of 90 million euros, to strengthen the electricity distribution system

appeared first on Enemalta.

The Parsons turbine was turned off for the last time seven years ago

Lorraine Gravino — Wed, 16 Feb 2022 09:04:49 +0000

The Parsons turbine was turned off for the last time seven years ago

16.02.2022

Seven years ago, on February 15, 2015, the turbine CA Parsons, which was unique in its kind for Enemalta, , was decommissioned for the last time.

This steam turbine, which was put into operation at the Marsa Power Station in 1987, was Enemalta’s largest capacity turbine at the time.

The Parsons turbine had a capacity of 60MW, which was twice that of the Marsa Power Station’s steam turbines in service at the time.

Enemalta has always made use of turbines manufactured by leading electrical engineering companies such as General Electric, Westinghouse, and Franco Tosi Meccanica. The CA Parsons turbine is named after Charles Parsons, the inventor of steam turbines, who in 1884, developed this technology and brought about a major change in electricity generation.

The post The Parsons turbine was turned off for the last time seven years ago

appeared first on Enemalta.

Privacy Notice for Entities exchanging information with Enemalta plc

Lorraine Gravino — Mon, 04 Mar 2019 08:40:19 +0000

Privacy Notice for Entities exchanging information with Enemalta plc

Enemalta plc (“Enemalta” or “We” or “Us” or “Our”) is a Maltese public limited company bearing registration number C 65836 and having its registered address at Triq Belt il-Ħażna, Marsa, MRS 1571, Malta.

This Privacy Notice applies to Enemalta’s processing of personal data relating to entities (natural persons and/or companies) (hereinafter referred to as Entity or Entities) which:
i) May prospectively enter into a contract for the provision of works and/or goods and/or property and/or services and/or lease (hereinafter collectively referred to as “deliverables”) to Enemalta;
ii) Have entered into a contract for the provision of deliverables to Enemalta;
iii) May prospectively enter into a contract for the provision of deliverables from Enemalta;
iv) Have entered into a contract for the provision of deliverables from Enemalta.
v) Have damaged Enemalta assets, and for which Enemalta is making a claim for reimbursement; and
vi) Had assets damaged by Enemalta infrastructure/services/operations and are making a claim for reimbursement.

If you are data subjects whose relation to Us is in relation to the provision of electricity service, please refer to the Privacy Notice for Electricity Customers, available at https://www.enemalta.com.mt/uncategorised/privacy-notices/.

References to “you” or “your” shall accordingly be deemed to refer to the Entities’ data subjects, including but not limited the people employed, contracted or otherwise engaged by such Entities.

We are committed to respecting your privacy. If you have questions about Our processing of your personal data, you may contact Enemalta at the address Central Administration Building, Church Wharf, Marsa, MRS 1000, or by email at customercare.em@enemalta.com.mt or by telephone on +356 8007 2224.

Enemalta’s Data Protection Officer may also be contacted at Central Administration Building, Church Wharf, Marsa MRS 1000, or by email at dpo.em@enemalta.com.mt and +356 22980583.

Please read this Privacy Notice carefully to understand Our practices with respect to your personal data.

1.Updates

We may update this Privacy Notice at Our sole discretion including as a result of a change in applicable law or processing activities. Any such changes will be communicated to you prior to the commencement of the relevant processing activity.

2. What amounts to personal data?

The term “personal data” refers to all information through which you can be personally identified or identifiable, such as name, surname, address and billing information

3.How do We collect personal data?

We typically collect your data:

From you (or your employer/person who engaged you) directly as part of the process of entering into a contract with Us such as through forms, contracts, business cards, correspondence and information submitted in tenders and request for quotation; and
Through information which arises in the course of Our working relationship with the Entity.

We might also collect your data from third parties as part of the process of entering into a commercial contractual relationship with Us or during the duration of Our contractual relationship such as through credit checks or trade references. Information from public sources might also be collected about you.

4.What personal data do We process?

The personal data that We collect and process generally but not only relates to:

Personal details such as names, surnames, date and place of birth and ID/Passport numbers;
Personal details of father and mother such as name and surname;
Contact details such as address, telephone/mobile numbers and email;
Documentation relating to your identity such as ID/Passport copies;
Photos and documents illustrating/outlining your assets such as property and vehicles that are required to investigate and process your claims for damages in connection with Our infrastructure, services and operations;
Work location;
Work times;
Car registration numbers;
Documentation relating to your experience, qualifications and skills such as CVs, warrants and educational certificates;
Financial information such as bank account details, tax details, dues on Automated Revenue Management Services Limited’s (ARMS’) accounts;
Personal data that We collect and process as a result of legal obligations imposed on Us;
Any information which is voluntarily provided to Us by you or by the Entity; and
Security information when you visit Our premises such as through CCTV, Visitor Management Systems and number plate recognition system. For more information in this respect, please refer to Our Privacy Notice for Visitors available at https://www.enemalta.com.mt/uncategorised/privacy-notices/.

5. How do We use your personal data?

Irrespective of the manner that We have collected your personal data, We will only process such data for the purposes of the relationship with the Entity or for purposes which are inherently related thereto, including the fulfilment of any legal or regulatory obligations imposed on Us.

Typically, your personal data will be processed for:

Contacting the Entity to possibly engage in a working business relationship with Us;
Evaluation of suitability of deliverables prior to entering into a commercial contract with the Entity;
Management of Our relationship with the Entity including performance of the contract therewith and steps necessary to enter into or amending such contract;
Billing, invoicing, debtor transaction processing and debt collection (including set-offs for electricity dues with ARMS as Our Processor, where applicable);
Supporting the relationship with the Entity;
General administration purposes;
Compliance and reporting;
Defending Ourselves in the event of a legal claim or dispute;
Processing of claims submitted by you in relation to damages sustained on your assets due to Enemalta’ s infrastructure, services or operations;
The purposes which you or the Entity requested when providing the data to Us;
The purpose of a legitimate interest pursued by Us or by a third party, provided such interest is not overridden by your interests, fundamental rights and freedoms; and
Any other purposes imposed or permitted by law which are inherently related to the relationship with the Entity.

6. Legal Basis

We primarily process your personal data for the performance of our contract with the Entity, including any steps which may be necessary to enter into such contract (such as tenders).

We may also process personal data on the following legal basis:

Compliance with legal obligations imposed on Us – in particular obligations imposed on Us as a result of financial or environmental legislation and health and safety;
To protect Our or a third party’s legitimate interests – in particular interests which may arise directly or indirectly in relation to the execution of the contract with Enemalta. This can also include any claims for damages to/from third parties for damages to/by Our infrastructure/services/operations. When We process your personal data on the basis of Our legitimate interests, We ensure that the legitimate interests pursued are not overridden by your interests, rights and freedoms;
For the purposes of establishing, exercising or defending legal proceedings; and
For the purposes of public interests in providing Our electricity services which is a critical universal service.

Note that special categories of personal data include data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic, biometric or health data, sexual orientation and data related to your conviction and offences. Processing special categories of your personal data is not envisaged unless We have reason to institute proceedings or investigations with respect to theft of Our services. Should the processing of special categories of personal data become envisaged, We will ensure that We have additional grounds for such processing.

7. Recipients

We may share your personal data with third party recipients who typically are:

selected individuals within Our companies, on a need-to-know basis;
any service providers that may require access to your personal data in rendering Us with their services, including legal, accounting, billing, audit, insurance providers, consultants, and IT service providers;
Banks;
Local regulatory authorities or agencies such as Regulator for Energy and Water Services;
Authorised consultative bodies and agencies dealing with financial and accounting matters including the Court of Auditors, Financial Irregularities Panel, Internal Audit Service and Anti-Fraud Office; and
third parties, including but not limited to governmental institutions and authorities that may be of an executive, judicial or legislative nature, to whom disclosure may be required as a result of legal obligations imposed on Us.

We are a member (‘Member’) of a registered Credit Referencing Agency (‘CRA’) in Malta. The Member shall process Personal Data found herein according to applicable legislation, particularly, the Regulation [EU] 2016/679 (‘GDPR’) as well as the Data Protection Act, amongst others. If you as our client is in default of Our agreement, the Member has the right to pass on any of your personal information to the CRA as well as to any legally entitled third party.

Where such a disclosure is carried out, the relevant CRA, shall be deemed to be a Data Controller of the personal data it processes within its systems, in pursuance of its legitimate interests, such as promoting responsible lending, amongst others.

We do not share your personal data with any entity located outside of the EU or EEA unless required to do so at law.

8. Automated Decision-Making and Profiling

Your personal data will not be used for any decision solely taken on the basis of automated decision-making processes, including profiling.

9. Data Retention

We retain your personal data exclusively for the period in which We may lawfully retain your personal data. Thereafter, your personal data shall be immediately and irrevocably destroyed.

Typically, due to the contractual relationship with the Entity, We retain personal data for up to five (5) years from the end of Our contractual relationship with the Entity on the basis of Our legitimate interests to protect Ourselves from civil cases which might institute against Us in relation to such contractual relationship.

As a result of legal obligations imposed on Us, personal data related to accounting, transactions and tax records may be kept for up to ten (10) years.

We may have a legitimate interest to hold your data for longer periods such as when your data is required for exercising or defending legal claims.

10. Your Rights

For as long as We retain your personal data, you may exercise certain rights in relation to your personal data including:

Right of access – you have the right to ascertain the personal data We hold about you and to receive a copy of such personal data;
Right to Erasure – in certain circumstances you may request that We delete the personal data that We hold on you, or you withdraw your consent for Us to hold your personal data;
Right to Object – you have a right to object and request that We cease the processing of your personal data where we rely on Our, or third party’s legitimate interests for processing your personal data or a task carried out in the public interest;
Right to Portability – you may request that We provide you with certain personal data which you have provided Us in a structured, commonly used and machine-readable format. Where technically feasible, you may also request that We transmit such personal data to a third-party controller indicated by you;
Right to Rectification – you have the right to update or correct any inaccurate personal data which We hold about you;
Right to Restriction – you have the right to request that We stop using your personal data in certain circumstances including if you believe that We are unlawfully processing your personal data or the personal data that We hold about you is inaccurate; and
Right to be informed of the source – where the personal data We hold about you was not provided to Us directly by you, you may also have the right to be informed of the source from which your personal data originates.

Your rights in relation to your personal data are not absolute. You will not have to pay a fee to access your personal data (or to exercise any of the other rights specified above). However, We may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, We may refuse to comply with your request in these circumstances. We may need to request specific information from you to help Us confirm your identity and ensure the exercise of your rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up Our response.

11.Keeping your data secure

We take pride in keeping your data secure and will take appropriate technical and organisational measures to protect your data against unauthorised or unlawful processing, storage or access, including against accidental loss or destruction. Your personal data will be stored in paper files or electronically on Our technology systems or those of Our IT service providers.

12.Complaints

If you have any complaints regarding Our processing of your personal data, please note that you may contact Us or Our Data Protection Officer at the details indicated above. You also have a right to lodge a complaint with the Office of the Information and Data Protection Commissioner in Malta (www.idpc.gov.mt)

____________________________ _______________________________________

Company Name Name and Surname of Company Representative

____________________________ _______________________________________

Signature Date

Document Number: POL-042; Version: 1; Date: 17/01/2019

The post Privacy Notice for Entities exchanging information with Enemalta plc appeared first on Enemalta.

Privacy Notice for Visitors (EN)

Lorraine Gravino — Fri, 01 Mar 2019 07:29:25 +0000

Privacy Notice for Visitors (EN)

We process your personal data when you visit Our premises at Marsa and/or Delimara.

We are committed to respecting your privacy.

If you have questions about Our processing of your personal data, you may contact Enemalta at Central Administration Building, Church Wharf, Marsa, MRS 1000, Malta or by email at customercare.em@enemalta.com.mt or by telephone on 8007 2224.

Enemalta’s Data Protection Officer may be contacted at Central Administration Offices, Church Wharf, Marsa MRS 1000, dpo.em@enemalta.com.mt and +356 22980583.

Please read this Privacy Notice carefully to understand Our practices with respect to your personal data when you visit Our premises.

1. Updates

2. What amounts to personal data?

The term “personal data” refers to all information through which you can be personally identified, such as your name, surname, identification number, number plate and includes all information which may arise that render you personally identifiable.

3. How do we collect personal data?

We regularly collect personal data as part of Our legal obligations and security interests. For the purposes of visiting Our premises, We typically collect personal data through:

the pre-notification e-mail that is required to authorise your entry in Our premises which is recorded in Our internal Access Control Database;
the inputting of your personal data in our Visitor Management System (electronically in the tablet device or manually in the logbook, in which the security officer must enter your data to be allowed entry into our premises);
any injury/incident report that may be compiled in case of an injury or accident within the Enemalta premises;
Automatic Number Plate Recognition System for vehicle access control; and
CCTV footage of selected areas within Our premises.

Generally, you would have provided your personal data to Us.

Third parties such as the company/ies for whom you are rendering the service within Our facility, your employer or colleagues may also have provided your personal data to Us, typically in the pre-notification email required to authorise access to Our premises.

4. What personal data do We process?

The personal data of the visitors that We typically collect and process includes your:

Name
Surname
ID card/passport number
Company
Passport size photo (if we issue temporary cards)
Nationality
Number plate
Times of entering/exiting the premises
Footage / images from CCTV
Monitoring of temperature upon entry (and refusal of entry if such temperature is higher than 37 degrees Celsius (no records are retained)

5. How do We use your personal data?

Irrespective of the manner that We have collected your personal data, We will only process such data for controlling access to Our premises for security purposes including crime prevention and health and safety purposes.

6. Lawfulness of Processing

We process your personal data on the basis of the following bases:

Area	Legal basis	Further information
Access Control	Legitimate interest for security and safety purposes and legal obligation	It is Enemalta’s legitimate interest to control entry and exit within its premises for security and safety purposes. Undertaking this processing are also legal obligations imposed on Enemalta in terms of the S.L. 499.35 (Ports Security Regulations) and S.L. 460.24 (Critical Infrastructures and European Critical Infrastructures (Identification, Designation and Protection) Order).
CCTV	Legitimate interest for security and safety purposes and legal obligation	It is Enemalta’s legitimate interest to ensure that its assets are under surveillance for security purposes and to ensure that there is a safe environment for anyone accessing its premises. Undertaking this processing are also legal obligations imposed on Enemalta in terms of the S.L. 499.35 (Ports Security Regulations) and S.L. 460.24 (Critical Infrastructures and European Critical Infrastructures (Identification, Designation and Protection) Order).
Visitor Register	Legitimate interest for security and safety purposes and legal obligation	It is Enemalta’s legitimate interest to control entry and exit within its premises for security and safety purposes. Undertaking this processing is also a legal obligation imposed on Enemalta in terms of the S.L. 499.35 (Ports Security Regulations), S.L. 424.19 (Control of Major Accident Hazards Regulations), S.L. 234.49 (Merchant Shipping Accident and Incident Safety Investigation), S.L. 435.49 (Integrated Pollution Prevention and Control Regulations) and S.L. 460.24 (Critical Infrastructures and European Critical Infrastructures (Identification, Designation and Protection) Order).
Accidents and incidents reporting	Legal Obligation	Undertaking this processing is a legal obligation imposed on Enemalta in terms of the S.L. 424.19 (Control of Major Accident Hazards Regulations) and S.L. 435.49 (Integrated Pollution Prevention and Control Regulations).
Monitoring of temperature upon entry and refusal of entry if it is higher than 37 degrees Celsius	Legitimate Interest to prevent the spread of coronavirus and safeguarding our operations and the health and safety of our employees	Undertaking this processing is based on recommendations from the public health authorities to prevent the spread of coronavirus and to safeguard Enemalta’s operations, which are an essential service, as well as to safeguard the health and safety of our employees.

On the bases of Our legitimate interests or compliance with legal obligations, as applicable, We may also process your personal data for the purposes of establishing, exercising or defending legal proceedings.

We will ensure that We have additional grounds for processing your personal data if processing of special categories becomes envisaged. Note that special categories of personal data include data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic, biometric or health data, sexual orientation and data related to your conviction and offences. Processing special categories of your personal data is not envisaged unless We have reason to institute proceedings or investigations with respect to damages of Our property or assets, or criminal activity within Our premises.

7. Recipients

The recipients of your personal data are:

selected individuals within Our company, on a need-to-know basis;
third parties to whom disclosure may be required as a result of legal obligations imposed on Us;
if you are entering Delimara Power Station:
- third parties who are operating within the same facility at Delimara Power Station, and who require access to such data as a result of legal obligations imposed on them;
- third parties who are offering Us security services at Delimara Power Station; and
law enforcement authorities if necessary.

We do not share your personal data with any entity located outside of the EU or EEA.

8. Automated Decision-Making and Profiling

Your personal data collected when you visit Our premises will not be used for any decision solely taken on the basis of automated decision-making processes, including profiling.

9. Data Retention

We retain your personal data exclusively for the period in which We may lawfully retain your personal data. Thereafter, your personal data shall be immediately and irrevocably destroyed.

We may have a legitimate interest to hold your data for longer periods such as when your data is required for exercising or defending legal claims.

10. Your Rights

For as long as We retain your personal data, you have certain rights in relation to your personal data including:

Right of access – you have the right to ascertain the personal data We hold about you and to receive a copy of such personal data;
Right to Erasure – in certain circumstances you may request that We delete the personal data that We hold on you;
Right to Object – you have a right to object and request that We cease the processing of your personal data where We rely on Our, or a third party’s, legitimate interests for processing your personal data or a task carried out in the public interest;
Right to Rectification – you have the right to update or correct any inaccurate personal data which We hold about you;
Right to Restriction – you have the right to request that We stop using your personal data in certain circumstances including if you believe that We are unlawfully processing your personal data or the personal data that We hold about you is inaccurate; and
Right to be informed of the source – where the personal data We hold about you was not provided to Us directly by you, you may also have the right to be informed of the source from which your personal data originates.

Your rights in relation to your personal data are not absolute.

If you intend to exercise one or more of your rights, you should approach Enemalta plc.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights specified above). However, We may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, We may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help Us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up Our response.

11. Keeping your data secure

We take pride in keeping your data secure and will take appropriate technical and organisational measures to protect your data against unauthorised or unlawful processing, including against accidental loss, destruction, storage or access. Your personal data will be stored electronically on Our technology systems or on technology systems of Our IT providers.

12. Complaints

Document Number: POL-043; Version: 3.1; Date: 25/02/2021

The post Privacy Notice for Visitors (EN) appeared first on Enemalta.

Privacy Notice – Electricity Consumers

Lorraine Gravino — Wed, 27 Feb 2019 11:43:53 +0000

Privacy Notice for Electricity Consumers

We are committed to respecting your privacy.

If you have questions about our processing of your personal data, you may contact Enemalta at the address Central Administration Building, Church Wharf, Marsa, MRS 1000, or by email at customercare.em@enemalta.com.mt or by telephone on 8007 2224.

The Data Protection Officer may be contacted at Central Administration Offices, Church Wharf, Marsa MRS 1000, or by email at dpo.em@enemalta.com.mt or by telephone on +356 2298 0583.

Note that we have appointed Automated Revenue Management Services Limited (“ARMS”), a company registered under the laws of Malta, bearing company registration number C 46054 and having its registered address at Gattard House, National Road, Blata l-Bajda, HMR 9010 as our processor of your personal data for the purposes of performing on our behalf meter-reading, account keeping and bill collection services and other functions ancillary to such services.

As our processor, ARMS exclusively processes your personal data on our behalf and on the basis of our instructions.

ARMS may be contacted at the address indicated above, or by email at customercare@arms.com.mt or by telephone on 8007 2222. ARMS’ Data Protection Officer may be contacted at ARMS offices, Qormi Road, Luqa, dpo.arms@arms.com.mt and +356 2245 2725.

Please read this Privacy Notice carefully to understand our practices with respect to your personal data.

1. Updates

We may update this Privacy Notice at our sole discretion including as a result of a change in applicable law or processing activities. Amendments as a result of changes in applicable law or processing activities changes will be communicated to you prior to the commencement of the relevant processing activity.

2. What amounts to personal data?

The term “personal data” refers to all information through which you can be personally identified, such as your name, surname, address and billing information and includes all information which may arise.

3. How do we collect personal data?

As utility service provider, we regularly collect personal data as part of our services and legal obligations. We typically collect personal data:

Through application forms filled and submitted to us or ARMS;
Through our website and that of ARMS;
Through various social media platforms of the two entities, which are used by the individual to communicate with the respective entity;
Through calls/emails/visits received at our Customer Care Department and the Customer Care Department operated by ARMS.

Generally, you would have provided your personal data to us, directly, through the account holder who provides your information, or through our processor ARMS. You are also kindly requested to inform us whenever your personal data changes.

4. What personal data do we process?

The personal data of the customers we typically collect and process includes:

Name,
Surname,
ID card/passport number and associated document number (such document is processed for identity verification: (i) either in person at Our offices when the original is requested upon submission of an application or request for information; or (ii) by email/post, a copy is requested along with a submission of an application or request for information, and such copy will be deleted once the necessary verification has been conducted),
Address,
Contact number,
Contact email,
Meter reading data,
Meter point location data,
Billing information,
Electric vehicle details included within the Transport Malta certificate, including car registration number and country of issue, where applicable,
Account and meter number.

More data could be collected for specific situations.

Personal data is also collected in relation to persons residing within the premises, persons who will provide access to the premises and persons inspecting and/or certifying the electricity installation.

5. How do we use your personal data?

Irrespective of the manner that we have collected your personal data, we will only process such data for the purposes of the provision electricity services to you and purposes which are inherently related thereto, including the fulfilment of any legal obligation imposed on us.

Typically, in providing you with the service, your personal data will be processed for:

Fault investigation and repairs,
Routine inspections,
Upgrades/updates to the service being provided,
Billing,
Temporary service requests,
Interruption notifications,
Claims investigation,
Theft and fraud investigation.

6. Lawfulness of processing

We process your personal data on the following bases:

Entering into and performing a contract – in particular to provide you with the services you have requested from us. The consequence for not doing such processing would be that we would be unable to perform our contract,
Our legitimate interests in terms of security and safety purposes, safeguarding of our rights through arbitration/legal proceedings and any other legitimate interests which we may have in relation to the services provided. When we process your personal data on the basis of legitimate interests, we ensure that the legitimate interests pursued are not overridden by your interests, rights and freedoms,
Compliance with legal obligations imposed on us – in particular obligations imposed on us as a result of the provision of electricity services to you,
Consent when you have provided your explicit consent to specific processing of your personal data,
Given that we process your personal data for the purposes of providing national electricity in Malta, there may be instances where we may also rely on a public interest in processing your data.

On the basis of our legitimate interests or compliance with legal obligations, as applicable, we may also process your personal data for the purposes of establishing, exercising or defending legal proceedings.

We will ensure that we have additional grounds for processing your personal data if processing of special categories becomes envisaged. Note that special categories of personal data include data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic, biometric or health data, sexual orientation and data related to your conviction and offences. Processing special categories of your personal data is not envisaged unless we have reason to institute proceedings or investigations with respect to theft of our services.

7. Recipients

The recipients of your personal data are:

selected individuals within our companies, on a need to know basis,
any service providers that may have access to your personal data in rendering us with their support services, including IT service providers,
third parties to whom disclosure may be required as a result of our relationship with you as our client,
third parties, including but not limited to governmental institutions and authorities that may be of an executive, judicial or legislative nature, to whom disclosure may be required as a result of legal obligations imposed on us,
governmental institutions, ministries and other public authorities and public entities, who request specific personal data about you and/or the persons residing in your premises which we, as the Data Controllers, control. Such personal data will only be shared for the specific and agreed purposes, including for your benefit, and will be delineated in a Data Sharing Agreement between the parties. The receiving party is contractually bound to inform you of such data sharing from us,
third parties to whom disclosure may be required as a result of legal obligations imposed on us.

We do not share your personal data with any entity located outside of the EU or EEA unless required to do so at law.

8. Automated Decision-Making and Profiling

Your personal data will not be used for any decision solely taken on the basis of automated decision-making processes, including profiling.

In the interest of transparency, note that we use systems which could profile you. Such systems are used by us to monitor your electricity consumption and ensure that you receive a quality service. These systems could also be used to identify abnormal electricity consumption and irregular activities. No automated-decision will result from our use of such systems.

9. Data Retention

We retain your personal data exclusively for the period in which we may lawfully retain your personal data. Thereafter, your personal data shall be immediately and irrevocably destroyed.

As a result of legal obligations imposed on us, we normally retain your personal data for up to ten (10) years from the closure of your file and you cease to be our client.

We may have a legitimate interest to hold your data for longer periods such as when your data is required for exercising or defending legal claims.

10. Your Rights

For as long as we retain your personal data, you have certain rights in relation to your personal data including:

Right of access – you have the right to ascertain the personal data we hold about you and to receive a copy of such personal data,
Right to Erasure – in certain circumstances you may request that we delete the personal data that we hold on you,
Right to Object – you have a right to object and request that we cease the processing of your personal data where we rely on our, or a third party’s, legitimate interests for processing your personal data or a task carried out in the public interest,
Right to Portability – you may request that we provide you with certain personal data which you have provided to us in a structured, commonly used and machine-readable format. Where technically feasible, you may also request that we transmit such personal data to a third-party controller indicated by you,
Right to Rectification – you have the right to update or correct any inaccurate personal data which we hold about you,
Right to Restriction – you have the right to request that we stop using your personal data in certain circumstances including if you believe that we are unlawfully processing your personal data or the personal data that we hold about you is inaccurate,
Right to withdraw your consent – where our processing is based on your consent, you have the right to withdraw your consent. Withdrawal of your consent shall not affect the lawfulness of the processing based on your consent prior to the withdrawal of your consent,
Right to be informed of the source – where the personal data we hold about you was not provided to us directly by you, you may also have the right to be informed of the source from which your personal data originates.

Your rights in relation to your personal data are not absolute.

If you intend to exercise one or more of your rights, you should approach Enemalta at the contact details indicated above. You may also contact ARMS who will be redirecting your request on your behalf to Enemalta.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights specified above). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

11. Keeping your data secure

We take pride in keeping your data secure and will take appropriate technical and organisational measures to protect your data against unauthorised or unlawful processing, including against accidental loss, destruction, storage or access. Your personal data will be stored in paper files or electronically on our technology systems or on technology systems of our IT providers.

12. Complaints

If you have any complaints regarding our processing of your personal data, please note that you may contact us or our Data Protection Officer at the details indicated above. You also have a right to lodge a complaint with the Office of the Information and Data Protection Commissioner in Malta (www.idpc.gov.mt).

Last updated on the 17 February 2021

The post Privacy Notice – Electricity Consumers appeared first on Enemalta.

Privacy Notice – Electricity

Lorraine Gravino — Tue, 26 Feb 2019 09:31:24 +0000

Last updated on the 25th September 2018.

We, namely Enemalta plc (“Enemalta”), a Maltese public limited company bearing registration number C 65836 and having its registered address at Triq Belt il-Hażna, Marsa, MRS 1571, Malta process your personal data for the purposes of providing you with electricity service.

We are committed to respecting your privacy.

If you have questions about our processing of your personal data, you may contact Enemalta at the address indicated above, or by email at customercare.em@enemalta.com.mt or by telephone on
8007 2224.
The Data Protection Officer is Inġ. Sylvana Scicluna who may be contacted at Central Administration
Offices, Church Wharf, Marsa MRS 1000, dpo.em@enemalta.com.mt and +356 2298 0583.
Note that we have appointed Automated Revenue Management Services Limited (“ARMS Ltd”), a
company registered under the laws of Malta, bearing company registration number C 46054 and
having its registered address at Gattard House, National Road, Blata l-Bajda, ĦMR 9010 as our
processor of your personal data for the purposes of performing on our behalf meter-reading,
account keeping and bill collection services and other functions ancillary to such services.
As our processor, ARMS Ltd exclusively processes your personal data on our behalf and on the basis
of our instructions.
ARMS Ltd may be contacted at the address indicated above, or by email at
customercare@arms.com.mt or by telephone on 8007 2222. ARMS Ltd’s Data Protection Officer
may be contacted at ARMS Ltd offices, North Block, Luqa Road, Qormi, dpo.arms@arms.com.mt and
+356 2245 2767.
Please read this Privacy Notice carefully to understand our practices with respect to your personal
data.
1. Updates
We may update this Privacy Notice at our sole discretion including as a result of a change in applicable
law or processing activities. Any such changes will be communicated to you prior to the
commencement of the relevant processing activity.
2. What amounts to personal data?
The term “personal data” refers to all information through which can render you personally
identifiable, such as your name, surname, address and billing information and includes all
information which may arise.
3. How do we collect personal data?
As utility service provider, we regularly collect personal data as part of our services and legal
obligations. We typically collect personal data:
• Through application forms filled and submitted to us or ARMS Ltd;
• Through our website and that of ARMS Ltd;
• Through calls received at our Customer Care Department and the Customer Care Department
operated by ARMS Ltd.
Generally, you would have provided your personal data to us, directly or through our processor
ARMS Ltd.
Third parties including but not limited to Local Councils may also have provided your personal data
to us.
4. What personal data do we process?
The personal data of the customers we typically collect and process includes:
• Name
• Surname
• ID card/passport number
• Address
• Contact number
• Contact email
• Meter readings
• Billing information
• Account and meter number
More data could be collected for specific situations.
Personal data is also collected in relation to persons residing within the premises, persons who will
provide access to the premises, persons inspecting and/or certifying the electricity installations and
persons providing plannng certification.
5. How do we use your personal data?
Irrespective of the manner that we have collected your personal data, we will only process such data
for the purposes of the provision electricity service to you and purposes which are inherently related
thereto, including the fulfilment of any legal obligation imposed on us.
Typically, in providing you with the service, your personal data will be processed for:
• Fault investigation and repairs
• Routine inspections
• Upgrades/updates to the service being provided
• Billing
• Temporary service requests
• Interruption notifications
• Claims investigation
• Theft and fraud investigation
6. Legal Basis
We process your personal data on the basis of the following legal basis:
• Entering into and performing a contract – in particular to provide you with the services you
have requested from us. The consequence for not doing such processing would be that we
would be unable to perform our contract;
• Our legitimate interests – in particular legitimate interests which may arise directly or
indirectly in relation to the services provided. When we process your personal data on the
basis of our or a third party’s legitimate interests, we ensure that the legitimate interests
pursued are not overridden by your interests, rights and freedoms; and
• Compliance with legal obligations imposed on us – in particular obligations imposed on us as
a result of the provision of electricity services to you.
On the basis of our legitimate interests or compliance with legal obligations, as applicable, we may
also process your personal data for the purposes of establishing, exercising or defending legal
proceedings.
Given that we process your personal data for the purposes of providing electricity in Malta, there may
be instances where we may also rely on a public interest in processing your data.
We will ensure that we have additional grounds for processing your personal data if processing of
special categories becomes envisaged. Note that special categories of personal data include data
revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union
membership, genetic, biometric or health data, sexual orientation and data related to your conviction
and offences. Processing special categories of your personal data is not envisaged unless we have
reason to institute proceedings or investigations with respect to theft of our services.
7. Recipients
The recipients of your personal data are:
• selected individuals within our companies, on a need to know basis;
• any service providers that may have access to your personal data in rendering us with their
support services, including IT service providers; and
• third parties to whom disclosure may be required as a result of our relationship with you as our
client; and
• third parties to whom disclosure may be required as a result of legal obligations imposed on Us.
We do not share your personal data with any entity located outside of the EU or EEA.
8. Automated Decision-Making and Profiling
Your personal data will not be used for any decision solely taken on the basis of automated decisionmaking processes, including profiling.
In the interest of transparency, note that we use systems which could profile you. Such systems are
used by us to monitor your electricity consumption and ensure that you receive a quality service.
These systems could also be used to identify abnormal electricity consumption and irregular activities.
No automated-decision will result from our use of such systems.
9. Data Retention
We retain your personal data exclusively for the period in which we may lawfully retain your personal
data. Thereafter, your personal data shall be immediately and irrevocably destroyed.
As a result of legal obligations imposed on us, we typically retain your personal data for up to ten (10)
years from the closure of your file and you cease to be our client.
We may have a legitimate interest to hold your data for longer periods such as when your data is
required for exercising or defending legal claims.
10. Your Rights
For as long as We retain your personal data, you have certain rights in relation to your personal data
including:
• Right of access – you have the right to ascertain the personal data We hold about you and to
receive a copy of such personal data;
• Right to Erasure – in certain circumstances you may request that We delete the personal data
that we hold on you;
• Right to Object – you have a right to object and request that we cease the processing of your
personal data where we rely on our, or a third party’s, legitimate interests for processing your
personal data or a task carried out in the public interest;
• Right to Portability – you may request that We provide you with certain personal data which
you have provided to Us in a structured, commonly used and machine-readable format.
Where technically feasible, you may also request that we transmit such personal data to a
third party controller indicated by you;
• Right to Rectification – you have the right to update or correct any inaccurate personal data
which we hold about you;
• Right to Restriction – you have the right to request that we stop using your personal data in
certain circumstances including if you believe that we are unlawfully processing your personal
data or the personal data that We hold about you is inaccurate;
• Right to withdraw your consent – where Our processing is based on your consent, you have
the right to withdraw your consent. Withdrawal of your consent shall not affect the lawfulness
of the processing based on your consent prior to the withdrawal of your consent; and
• Right to be informed of the source – where the personal data we hold about you was not
provided to us directly by you, you may also have the right to be informed of the source from
which your personal data originates.
Your rights in relation to your personal data are not absolute.
If you intend to exercise one or more of your rights, you should approach Enemalta at the contact
details indicated above. You may also contact ARMS Ltd who will be redirecting your request on your
behalf to Enemalta.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights
specified above). However, we may charge a reasonable fee if your request is clearly unfounded,
repetitive or excessive. Alternatively, we may refuse to comply with your request in these
circumstances.
We may need to request specific information from you to help us confirm your identity and ensure
your right to access your personal data (or to exercise any of your other rights). This is a security
measure to ensure that personal data is not disclosed to any person who has no right to receive it. We
may also contact you to ask you for further information in relation to your request to speed up our
response.
11. Keeping your data secure
We take pride in keeping your data secure and will take appropriate technical and organisational
measures to protect your data against unauthorised or unlawful processing, including against
accidental loss, destruction, storage or access. Your personal data will be stored in paper files or
electronically on our technology systems or on technology systems of our IT providers.
12. Complaints
If you have any complaints regarding our processing of your personal data, please note that you may
contact us or our Data Protection Officer at the details indicated above. You also have a right to lodge
a complaint with the Office of the Information and data Protection Commissioner in Malta
(www.idpc.gov.mt).

The post Privacy Notice – Electricity appeared first on Enemalta.

Privacy Notice – Electricity and Water Consumers

Lorraine Gravino — Tue, 26 Feb 2019 09:03:04 +0000

Privacy Notice – Electricity and Water Consumers

We, namely Enemalta plc (“Enemalta”), a Maltese public limited company bearing registration number C 65836 and having its registered address at Triq Belt il-Hażna, Marsa, MRS 1571, Malta and the Water Services Corporation (“WSC”), established in virtue of Chapter 355 of the laws of Malta and having its registered address at Qormi Road, Luqa, LQA 9043, jointly process your personal data for the purposes of providing you with electricity and water services.

We are committed to respecting your privacy.

If you have questions about our processing of your personal data, you may contact:

Enemalta plc at the address Central Administration Building, Church Wharf, Marsa, MRS 1000, or by email at customercare.em@enemalta.com.mt or by telephone on 8007 2224; and
WSC at the address indicated above, or by email at customercare@wsc.com.mt or by telephone on 8007 6400.

Enemalta’s and WSC’s Data Protection Officers may also be contacted.

Enemalta’s Data Protection Officer may be contacted at Central Administration Offices, Church Wharf, Marsa MRS 1000, dpo.em@enemalta.com.mt and +356 2298 0583.

WSC’s Data Protection Officer may be contacted at Water Services Corporation, Qormi Road Luqa, LQA 9043, dpo@wsc.com.mt and +356 2244 3240.

As our processor, ARMS exclusively processes your personal data on our behalf and on the basis of our instructions.

ARMS may be contacted at the address indicated above, or by email at customercare@arms.com.mt or by telephone on 8007 2222. ARMS’ Data Protection Officer may be contacted at ARMS, Qormi Road, Luqa, dpo.arms@arms.com.mt and +356 2245 2725.

Please read this Privacy Notice carefully to understand our practices with respect to your personal data.

1. Updates

2. What amounts to personal data?

3. How do we collect personal data?

As utility service providers, we regularly collect personal data as part of our services and legal obligations. We typically collect personal data:

Through application forms filled and submitted to any of the three entities;
Through the websites of the three entities;
Through various social media platforms of the three entities, which are used by the individual to communicate with the respective entity;
Through calls/emails/visits received at the Customer Care Department of the three entities.

4. What personal data do we process?

The personal data of the customers we typically jointly collect and process includes:

Name,
Surname,
ID card/passport number and associated document number (such document is processed for identity verification: (i) either in person at Our offices when the original is requested upon submission of an application or request for information; or (ii) by email/post, a copy is requested along with a submission of an application or request for information, and such copy will be deleted once the necessary verification has been conducted),
Address,
Contact number,
Contact email,
Meter reading data,
Meter point location data,
Billing information,
Account and meter number.

More data could be collected for specific situations.

5. How do we use your personal data?

Irrespective of the manner that we have collected your personal data, we will only process such data for the purposes of the provision electricity and water services to you and purposes which are inherently related thereto, including the fulfilment of any legal obligation imposed on us.

Typically, in providing you with the service, your personal data will be processed for:

Fault investigation and repairs,
Routine inspections,
Upgrades/updates to the service being provided,
Billing,
Temporary service requests,
Interruption notifications,
Claims investigation,
Theft and fraud investigation.

6. Lawfulness of processing

We process your personal data on the following bases:

Entering into and performing a contract – in particular to provide you with the services you have requested from us. The consequence for not doing such processing would be that we would be unable to perform our contract,
Our legitimate interests in terms of security and safety purposes, safeguarding of our rights through arbitration/legal proceedings and any other legitimate interests which we may have in relation to the services provided. When we process your personal data on the basis of legitimate interests, we ensure that the legitimate interests pursued are not overridden by your interests, rights and freedoms,
Compliance with legal obligations imposed on us – in particular obligations imposed on us as a result of the provision of water and electricity services to you,
Consent when you have provided your explicit consent to specific processing of your personal data,
Given that we process your personal data for the purposes of providing national water and electricity in Malta, there may be instances where we may also rely on a public interest in processing your data.

Given that we process your personal data for the purposes of providing national water and electricity in Malta, there may be instances where we may also rely on a public interest in processing your data.

7. Recipients

The recipients of your personal data are:

selected individuals within our companies, on a need to know basis,
any service providers that may have access to your personal data in rendering us with their support services, including IT service providers,
third parties to whom disclosure may be required as a result of our relationship with you as our client,
third parties, including but not limited to governmental institutions and authorities that may be of an executive, judicial or legislative nature, to whom disclosure may be required as a result of legal obligations imposed on us,
governmental institutions, ministries and other public authorities and public entities, who request specific personal data about you and/or the persons residing in your premises which we, as the Data Controllers, control. Such personal data will only be shared for the specific and agreed purposes, including for your benefit, and will be delineated in a Data Sharing Agreement between the parties. The receiving party is contractually bound to inform you of such data sharing from us,
third parties to whom disclosure may be required as a result of legal obligations imposed on us.

We do not share your personal data with any entity located outside of the EU or EEA unless required to do so at law.

8. Automated Decision-Making and Profiling

Your personal data will not be used for any decision solely taken on the basis of automated decision-making processes, including profiling.

In the interest of transparency, note that we use systems which could profile you. Such systems are used by us to monitor your water and electricity consumption and ensure that you receive a quality service. These systems could also be used to identify abnormal water or electricity consumption and irregular activities. No automated-decision will result from our use of such systems.

9. Data Retention

We retain your personal data exclusively for the period in which we may lawfully retain your personal data. Thereafter, your personal data shall be immediately and irrevocably destroyed.

As a result of legal obligations imposed on us, we normally retain your personal data for up to ten (10) years from the closure of your file and you cease to be our client.

We may have a legitimate interest to hold your data for longer periods such as when your data is required for exercising or defending legal claims.

10. Your Rights

For as long as we retain your personal data, you have certain rights in relation to your personal data including:

Right of access – you have the right to ascertain the personal data we hold about you and to receive a copy of such personal data,
Right to Erasure – in certain circumstances you may request that we delete the personal data that we hold on you,
Right to Object – you have a right to object and request that we cease the processing of your personal data where we rely on our, or a third party’s, legitimate interests for processing your personal data or a task carried out in the public interest,
Right to Portability – you may request that we provide you with certain personal data which you have provided to us in a structured, commonly used and machine-readable format. Where technically feasible, you may also request that we transmit such personal data to a third-party controller indicated by you,
Right to Rectification – you have the right to update or correct any inaccurate personal data which we hold about you,
Right to Restriction – you have the right to request that we stop using your personal data in certain circumstances including if you believe that we are unlawfully processing your personal data or the personal data that we hold about you is inaccurate,
Right to withdraw your consent – where our processing is based on your consent, you have the right to withdraw your consent. Withdrawal of your consent shall not affect the lawfulness of the processing based on your consent prior to the withdrawal of your consent,
Right to be informed of the source – where the personal data we hold about you was not provided to us directly by you, you may also have the right to be informed of the source from which your personal data originates.

Your rights in relation to your personal data are not absolute.

If you intend to exercise one or more of your rights, you should approach Enemalta or WSC depending on whether the matter relates to water or electricity services. You should approach both entities if the matter relates to both water and electricity services. You may also contact ARMS who will be redirecting your request on your behalf to Enemalta or WSC as applicable.

Note that given that we are joint controllers of your data, you may exercise your rights in respect of and against each of Enemalta and WSC jointly or ARMS as processor. In the latter case, ARMS will, without undue delay inform Enemalta and/or WSC, as the case may be.

11. Keeping your data secure

We take pride in keeping your data secure and will take appropriate technical and organisational measures to protect your data against unauthorised or unlawful processing, including against accidental loss, destruction, storage or access. Your personal data will be stored in paper files or electronically on our technology systems or on technology systems of our IT providers.

12. Complaints

If you have any complaints regarding our processing of your personal data, please note that you may contact us or our Data Protection Officers at the details indicated above. You also have a right to lodge a complaint with the Office of the Information and Data Protection Commissioner in Malta (www.idpc.gov.mt).

Last updated on the 17 February 2021

The post Privacy Notice – Electricity and Water Consumers appeared first on Enemalta.

Privacy Notice for Entities exchanging information with Enemalta plc

Lorraine Gravino — Tue, 26 Feb 2019 06:43:46 +0000

Privacy Notice for Entities exchanging information with Enemalta plc

This Privacy Notice applies to Enemalta’s processing of personal data relating to entities (natural persons and/or companies) (hereinafter referred to as Entity or Entities) which:

i) May prospectively enter into a contract for the provision of works and/or goods and/or property and/or services and/or lease (hereinafter collectively referred to as ”) to Enemalta;
ii) Have entered into a contract for the provision of deliverables to Enemalta;
iii) May prospectively enter into a contract for the provision of deliverables from Enemalta;
iv) Have entered into a contract for the provision of deliverables from Enemalta;
v) Have damaged Enemalta assets, and for which Enemalta is making a claim for reimbursement; and
vi) Had assets damaged by Enemalta infrastructure/services/operations and are making a claim for reimbursement.

If you are data subjects whose relation to Us is in relation to the provision of electricity service, please refer to the Privacy Notice for Electricity Customers, available at https://www.enemalta.com.mt/uncategorised/privacy-notices/.

We are committed to respecting your privacy. If you have questions about Our processing of your personal data, you may contact Enemalta at the address Central Administration Building, Church Wharf, Marsa, MRS 1000, or by email at customercare.em@enemalta.com.mt or by telephone on +356 8007 2224.

Enemalta’s Data Protection Officer may also be contacted at Central Administration Building, Church Wharf, Marsa MRS 1000, or by email at dpo.em@enemalta.com.mt and +356 22980583.

Please read this Privacy Notice carefully to understand Our practices with respect to your personal data.

1. Updates
We may update this Privacy Notice at Our sole discretion including as a result of a change in applicable law or processing activities. Any such changes will be communicated to you prior to the commencement of the relevant processing activity.

2. What amounts to personal data?
The term “personal data” refers to all information through which you can be personally identified or identifiable, such as name, surname, address and billing information.

3. How do We collect personal data?
We typically collect your data:

• From you (or your employer/person who engaged you) directly as part of the process of entering into a contract with Us such as through forms, contracts, business cards, correspondence and information submitted in tenders and request for quotation; and
• Through information which arises in the course of Our working relationship with the Entity.

4. What personal data do We process?
The personal data that We collect and process generally but not only relates to:

• Personal details such as names, surnames, date and place of birth and ID/Passport numbers;
• Personal details of father and mother such as name and surname;
• Contact details such as address, telephone/mobile numbers and email;
• Documentation relating to your identity such as ID/Passport copies;
• Photos and documents illustrating/outlining your assets such as property and vehicles that are required to investigate and process your claims for damages in connection with Our infrastructure, services and operations;
• Work location;
• Work times;
• Car registration numbers;
• Documentation relating to your experience, qualifications and skills such as CVs, warrants and educational certificates;
• Financial information such as bank account details, tax details, dues on Automated Revenue Management Services Limited’s (ARMS’) accounts;
• Personal data that We collect and process as a result of legal obligations imposed on Us;
• Any information which is voluntarily provided to Us by you or by the Entity; and
• Security information when you visit Our premises such as through CCTV, Visitor

Management Systems and number plate recognition system. For more information in this respect, please refer to Our Privacy Notice for Visitors available at https://www.enemalta.com.mt/uncategorised/privacy-notices/.

5. How do We use your personal data?
Irrespective of the manner that We have collected your personal data, We will only process such data for the purposes of the relationship with the Entity or for purposes which are inherently related thereto, including the fulfilment of any legal or regulatory obligations imposed on Us.

Typically, your personal data will be processed for:

• Contacting the Entity to possibly engage in a working business relationship with Us;
• Evaluation of suitability of deliverables prior to entering into a commercial contract with the Entity;
• Management of Our relationship with the Entity including performance of the contract therewith and steps necessary to enter into or amending such contract;
• Billing, invoicing, debtor transaction processing and debt collection (including set-offs for electricity dues with ARMS as Our Processor, where applicable);
• Supporting the relationship with the Entity;
• General administration purposes;
• Compliance and reporting;
• Defending Ourselves in the event of a legal claim or dispute;
• Processing of claims submitted by you in relation to damages sustained on your assets due to Enemalta’ s infrastructure, services or operations;
• The purposes which you or the Entity requested when providing the data to Us;
• The purpose of a legitimate interest pursued by Us or by a third party, provided such interest is not overridden by your interests, fundamental rights and freedoms; and
• Any other purposes imposed or permitted by law which are inherently related to the relationship with the Entity.

6. Legal Basis

We primarily process your personal data for the performance of our contract with the Entity, including any steps which may be necessary to enter into such contract (such as tenders).

We may also process personal data on the following legal basis:
• Compliance with legal obligations imposed on Us – in particular obligations imposed on Us as a result of financial or environmental legislation and health and safety;
• To protect Our or a third party’s legitimate interests – in particular interests which may arise directly or indirectly in relation to the execution of the contract with Enemalta. This can also include any claims for damages to/from third parties for damages to/by Our infrastructure/services/operations. When We process your personal data on the basis of Our legitimate interests, We ensure that the legitimate interests pursued are not overridden by your interests, rights and freedoms;
• For the purposes of establishing, exercising or defending legal proceedings; and
• For the purposes of public interests in providing Our electricity services which is a critical universal service.

7. Recipients

We may share your personal data with third party recipients who typically are:

• selected individuals within Our companies, on a need-to-know basis;
• any service providers that may require access to your personal data in rendering Us with their services, including legal, accounting, billing, audit, insurance providers, consultants, and IT service providers;
• Banks;
• Local regulatory authorities or agencies such as Regulator for Energy and Water Services;
• Authorised consultative bodies and agencies dealing with financial and accounting matters including the Court of Auditors, Financial Irregularities Panel, Internal Audit Service and AntiFraud Office; and
• third parties, including but not limited to governmental institutions and authorities that may be of an executive, judicial or legislative nature, to whom disclosure may be required as a result of legal obligations imposed on Us.

We do not share your personal data with any entity located outside of the EU or EEA unless required to do so at law.

8. Automated Decision-Making and Profiling

Your personal data will not be used for any decision solely taken on the basis of automated decision making processes, including profiling.

9. Data Retention

We retain your personal data exclusively for the period in which We may lawfully retain your personal data. Thereafter, your personal data shall be immediately and irrevocably destroyed. Typically, due to the contractual relationship with the Entity, We retain personal data for up to five (5) years from the end of Our contractual relationship with the Entity on the basis of Our legitimate interests to protect Ourselves from civil cases which might institute against Us in relation to such contractual relationship.

As a result of legal obligations imposed on Us, personal data related to accounting, transactions and tax records may be kept for up to ten (10) years.

We may have a legitimate interest to hold your data for longer periods such as when your data is required for exercising or defending legal claims.

10. Your Rights

For as long as We retain your personal data, you may exercise certain rights in relation to your personal data including:

– Right of access – you have the right to ascertain the personal data We hold about you and to receive a copy of such personal data;
– Right to Erasure – in certain circumstances you may request that We delete the personal data that We hold on you, or you withdraw your consent for Us to hold your personal data;
– Right to Object – you have a right to object and request that We cease the processing of your personal data where we rely on Our, or third party’s legitimate interests for processing your personal data or a task carried out in the public interest;
– Right to Portability – you may request that We provide you with certain personal data which you have provided Us in a structured, commonly used and machine-readable format. Where technically feasible, you may also request that We transmit such personal data to a thirdparty controller indicated by you;
– Right to Rectification – you have the right to update or correct any inaccurate personal data which We hold about you;
– Right to Restriction – you have the right to request that We stop using your personal data in certain circumstances including if you believe that We are unlawfully processing your personal data or the personal data that We hold about you is inaccurate; and
– Right to be informed of the source – where the personal data We hold about you was not provided to Us directly by you, you may also have the right to be informed of the source from which your personal data originates.

11. Keeping your data secure

12. Complaints
If you have any complaints regarding Our processing of your personal data, please note that you may contact Us or Our Data Protection Officer at the details indicated above. You also have a right to lodge a complaint with the Office of the Information and Data Protection Commissioner in Malta (www.idpc.gov.mt).

____________________________ _______________________________________
Company Name Name and Surname of Company Representative

____________________________ ____________________________
Signature Date

The post Privacy Notice for Entities exchanging information with Enemalta plc appeared first on Enemalta.

Data Protection Contract Relationships

Lorraine Gravino — Mon, 25 Feb 2019 08:14:56 +0000

Data Protection Contract Relationships

References to “Data Controller”, “Data Subject”, “Personal Data”, “Process”, “Processed”, “Processing”, “Data Protection Officer” and “Data Processor” in the Special Conditions of Contract clauses have the meanings set out in, and will be interpreted in accordance with the Applicable Laws. “Applicable Laws” shall mean the relevant data protection and privacy laws, including but not limited to, the General Data Protection Regulation (EU) 2016/679, and the Data Protection Act, Chapter 586 of the Laws of Malta and subsidiary legislation thereto, as may be amended from time to time.

1 Determining the Relationship between the Parties

Where Personal Data of Data subjects will be processed within the operations/services that will be offered as part of the contract, the Parties undertake to determine whether by entering into their contract, their relationship shall be deemed as that of a:

i) Data Controller to Data Controller
ii) Data Controller to Data Processor
iii) Joint Data Controllers

1.1 Controller to controller relationship

A data controller exercises control over the processing and carries data protection responsibility for that processing. According to Applicable Laws, “data controller” means a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be processed. This means that the data controller exercises overall control over the ‘why’ and the ‘how’ of a data processing activity.

Activities such as interpretation, the exercise of professional judgement or significant decision-making in relation to personal data must be carried out by a data controller.

To determine whether the parties are independent data controllers, they need to each identify whether they take their own decisions in relation to the following:

• to collect the personal data in the first place and the legal basis for doing so;
• which items of personal data to collect, i.e. the content of the data;
• the purpose or purposes the data are to be used for;
• which individuals to collect data about;
• whether to disclose the data, and if so, to who;
• whether subject access and other individuals’ rights apply i.e. the application of exemptions; and
• how long to retain the data or whether to make non-routine amendments to the data.

The above is not an exhaustive list but indicates decisions that can only be taken by the data controller as part of its overall control of the data processing operation.

1.2 Controller to processor relationship

According to Applicable Law a “data processor”, in relation to personal data, means any person (other than an employee of the data controller) who processes the data on behalf of the data controller.

The definition of ‘processing’ suggests that a data processor’s activities must be limited to the more ‘technical’ aspects of an operation, such as data storage, retrieval or erasure. The provision of a service by a processor to the data controller would involve the data controller transferring to the processor or providing the processor with access to personal data of its data subjects. This can also take the form of outsourcing of services involving personal data disclosures e.g. payroll services, IT administration etc.

Within the terms of the agreement with the data controller, and its contract, a data processor may decide:

• what IT systems or other methods to use to collect personal data;
• how to store the personal data;
• the detail of the security surrounding the personal data;
• the means used to transfer the personal data from one organisation to another;
• the means used to retrieve personal data about certain individuals;
• the method for ensuring a retention schedule is adhered to; and
• the means used to delete or dispose of the data.

The above list is not exhaustive but illustrates the key roles of a processor.

1.3 Joint controller relationship

Two entities can determine jointly the purposes for which and the manner in which the personal data is processed. There may be various situations when data controllers are acting together.

Some situations are discussed when the actors simultaneously perform business operations on personal data that are complementary in nature to providing services to consumers. This would involve joint participation in a business activity that requires processing the same personal data (not just sharing the same pool of personal data for different and distinct purposes).

The parties should determine if and to what extent relevant decisions are taken together by the parties and how the processes themselves are intertwined.

Two entities can determine jointly the purposes for which and the manner in which the personal data is processed. There may be various situations when data controllers are acting together.

2 Regulating the relationship between the Parties

Once the key roles are determined, the Parties shall regulate their relationship as stipulated in the Specifications/Terms of Reference by signing one of the following agreements:

i) Data Sharing Agreement in a Data Controller to Data Controller relationship, where applicable;
ii) Data Processing Agreement in a Data Controller to Data Processor relationship;
iii) Joint Controller Agreement in a Joint Data Controller relationship.

Last updated 05/02/2019

The post Data Protection Contract Relationships appeared first on Enemalta.