Privacy Policy

A Data Controller

The data controller is:

Privacy contact: admin@blmt-ltd.com.

B Data Collected

B.1 Contact form

Through the contact form on the website Blue Lagoon Maritime Trading Ltd may receive:

• name;
• company (optional);
• email address;
• enquiry type;
• the contents of the message, including any data voluntarily provided by the sender.

Users are invited not to enter sensitive personal data — or other categories of particular data — in the free text fields of the form.

B.2 Updates subscription

Through the subscription form, the data controller processes:

• email address;
• proof of consent recorded through the form (consent checkbox).

B.3 Technical data

Only technical and security data strictly necessary for the operation of the website are processed, including IP addresses and log information that may be handled by the hosting service and other technical providers for security and abuse prevention.

C Purposes and Legal Bases

C.1 Contact requests

Personal data submitted through the contact form are processed in order to:

• respond to requests received;
• provide information on the services of Blue Lagoon Maritime Trading Ltd;
• take pre-contractual measures requested by the data subject.

Main legal basis: the necessity to take steps at the data subject’s request prior to entering into a contract.

C.2 Security and abuse prevention

Technical and security data are processed on the basis of the legitimate interest of the data controller in keeping the website secure, preventing spam and protecting the systems used.

C.3 Service updates

Where the data subject subscribes to the updates, communications on company and service activities are sent on the basis of consent, which can be withdrawn at any time without prejudice to the lawfulness of processing carried out before withdrawal.

D Required and Optional Data

Sending a request via the contact form requires certain fields (name, email, enquiry type, message) so that the request can be understood and answered. The company field is optional. Where required data are not provided, the request may not be handled.

For the updates subscription, only the email address is required, together with the consent checkbox.

E Retention

Contact requests are kept for a maximum of 12 months from the last communication, except where legal obligations, the need to defend a right, or the establishment of a contractual relationship require different timeframes.

Updates subscriptions are kept until consent is withdrawn or the service is discontinued.

Technical data are kept for the period strictly necessary for security and according to the timescales applied by the technical providers.

F Recipients

Personal data may be communicated to:

• authorised personnel of the company;
• hosting and website management providers, on behalf of the data controller;
• Netlify, as a technical provider that may process data on behalf of the data controller for the delivery of the website and the handling of forms;
• email service providers used to receive notifications from the forms;
• professional advisors or public authorities where required by law.

G International Transfers

Some technical providers may process data outside the European Economic Area. Where this occurs, the data controller relies on the instruments recognised by the applicable regulation, such as adequacy decisions or, where required, standard contractual clauses. Where a provider does not publish a verified certification, this notice does not claim any.

H Rights

Data subjects have the right to:

• access their personal data;
• request rectification of inaccurate data;
• request erasure of data;
• request restriction of processing;
• object to processing, including on the basis of legitimate interest;
• request data portability where applicable;
• withdraw consent at any time, without prejudice to the lawfulness of processing carried out before withdrawal;
• lodge a complaint with a supervisory authority.

The lead supervisory authority for Blue Lagoon Maritime Trading Ltd is the Office of the Information and Data Protection Commissioner, Malta. Data subjects who are in the European Economic Area may also contact the competent authority of their place of residence or work, where applicable.

I Automated Decisions

The website does not adopt decisions based solely on automated processing, nor does it carry out profiling of the data subject.

J Third-Party Services

The website uses:

• hosting and form-capture through Netlify;
• an email service for the delivery of form notifications;
• Google Maps, which is loaded only after a voluntary user action ("Load map"). Until the user clicks the control, no third-party connection to Google is started.

The Google Maps iframe, once loaded, may cause Google to receive technical data (such as the IP address and information about the browser) and to set cookies or use equivalent technologies under its own terms.

K Changes

This Privacy Policy may be updated. The version date is reported at the top of the page. Material changes will be highlighted on this page; where required by applicable law, additional notice may be given.