Data Protection Policy

The General Data Protection Regulation (EU) 2016/679 (GDPR) and the Data Protection Act (CAP 586) regulate the processing of personal data whether held electronically or in manual form. The Valletta Cultural Agency is set to fully comply with the Data Protection Principles as set out in these Regulations.

Purposes for collecting data

The Valletta Cultural Agency is established through Subsidiary Legislation 542.05 and during the course of its operations it collects and processes information to carry out its obligations in accordance with present legislation. All data is processed in accordance with the Data Protection Legislation.

The Data Controller

The Data Controller may be contacted at :

Address: The CEO, Valletta Cultural Agency, Exchange Buildings, Republic Street Valletta, VLT 1117

Telephone : +356 2124 2018

Email: datacontroller@vca.gov.mt

Recipients of data

Employees and service providers who are assigned to carry out the functions of the Agency, access the information that is being processed. Personal data will be disclosed to the personnel of the Valletta Cultural Agency so that activities, events and initiatives organized by the entity may be promoted and implemented. Disclosure to other departments and third parties may also be made but only as authorized by law.

Your rights

You are entitled to know, free of charge, what type of information the Valletta Cultural Agency holds and processes about you and why, who had access to it, how it is held and kept up to date, its retention period and what the Agency is doing to comply with data protection legislation.

All data subjects have the right to access any personal information kept about them by the Agency, either on computer or in manual files. The GDPR establishes a formal procedure for dealing with data subject access requests. Requests for access to personal information by data subjects are to be made in writing and sent to the CEO of the Valletta Cultural Agency, who is also the Agency’s Data Controller. Your identification details such as ID number, name and surname must be submitted with the request for access. In case we encounter identification difficulties, you may be required to present an identification document.

The Information and Data Protection Commissioner

The Information and Data Protection Commissioner may be contacted at :

Address: Level 2, Airways House, High Street, Sliema SLM 1549

Telephone : +356 2328 7100

Email: idpc.info@idpc.org.mt

The Valletta Cultural Agency aims to comply as quickly as possible with requests for access to personal information and will ensure that it is provided within a reasonable time from receipt of request, unless there is a good reason for delay. When a request for access cannot be met within a reasonable time, the reason will be explained in writing to the data subject making the request. Should there be any data breaches, the data subject will be informed accordingly.

All data subjects have the right to request that their information is not used or is amended if it results to be incorrect. Data subjects may also request that their data is erased.

These rights may be restricted, if applicable, as per Data Protection Legislation.

In case you are not satisfied with the outcome of your access request, you may refer a complaint to the Information and Data Protection Commissioner, whose contact details are provided on this page.

The Data Controller

The Data Controller may be contacted at :

Address

The CEO Valletta Cultural Agency Exchange Buildings Republic Street Valletta, VLT 1117

Telephone : +356 2124 2018

Email : datacontroller@vca.gov.mt

The Information and Data Protection Commissioner

The Information and Data Protection Commissioner may be contacted at :

Address

Level 2, Airways House, High Street, Sliema SLM 1549

Telephone : +356 2328 7100

Email : idpc.info@idpc.org.mt

Retention Policy

Your personal data is collected through:

1. Consent in relation to your subscription for receiving promotional material. Opting out will be possible at any time and at no charge.

2. Selection procedure through Open Calls for Applications for persons to participate in our Programmes. In this case the legal basis to process will be based on the data subject’s performance of a contract as per Article 6 (1) (b) of the GDPR.

3. Data subjects are advised that photography may take place at public events organised by the Valletta Cultural Agency. Images captured may be disseminated in published material including social media. The Valletta Cultural Agency will ensure that safeguards are in place in the capture of such images to ensure the respect to privacy of individuals. Concerns in relation to this may be forwarded to the DPO on the email address specified in this policy.

The following schedule outlines the retention requirements for the various categories of documentation within the Valletta Cultural Agency.

Category of Document	Retention Period	Justification
Personal information of subscribers to the Valletta Cultural Agency (Name, Surname, Email address, etc.)	For the duration of subscription	Until consent is revoked by the data subject.
Personal information of project participants (Name, Surname, Email address etc.)	For the duration of the project until presentation of final outcome	This will allow for the participants to be consulted for their contribution to the presentation of the final outcome.
HR documentation	Ten years from termination of employment	This is in line with Government’s HR Corporate procedures.
Unsucessful recruitment candidates	Two years from conclusion of Recruitment Procedure	This is in line with Government’s HR Corporate procedures.
Financial information: Yearly Financial Statement	Ten years from the end of the Financial Year	This is in line with Government’s Companies Act.
Digital Photographs and Videos of Public Events	For the duration of the Agency’s operations	The VCA will apply safeguards in the capture of images during such event to respect the right to privacy of data subjects. Requests for erasure will still apply in the event that these images contain personal data.
Unsuccessful project proposals	Six months from selection of projects	This period will allow for the submission of complaints in relation to this process.

Data that needs to be destroyed after the noted timeframes will be disposed of in an efficient manner ensuring that such information is no longer available within the Valletta Cultural Agency.

The Data Protection Officer may be contacted on dataprotection.vca@vca.gov.mt
or by telephone +356 2124 2018.