Privacy notice

Who is responsible for your data?

Chado Limited is the data controller for personal data described in this notice.

Personal data we collect

• Enquiries and bookings: your name, work email, company, message, enquiry context, selected appointment and related communications.
• Newsletter requests: your email address, consent choice and consent timestamp.
• Campaign context: landing page, referrer, UTM campaign values and advertising click identifiers where available and permitted.
• Communications: information in emails, calls or WhatsApp messages you choose to send us.
• Technical information: standard security information such as IP address, requested page, timestamp, browser or device information.

We do not intentionally collect special-category data through this website. Please do not include sensitive personal information in free-text fields unless it is genuinely necessary.

How and why we use personal data

• To respond to enquiries and take steps requested before entering a contract, under Article 6(1)(b) GDPR.
• To operate, secure and improve the website, and prevent misuse, under our legitimate interests in Article 6(1)(f) GDPR.
• To send newsletter communications where you have consented, under Article 6(1)(a) GDPR. You can withdraw consent at any time.
• To comply with legal, tax, regulatory or dispute-resolution obligations, under Article 6(1)(c) GDPR or our legitimate interests where appropriate.

We do not use website submissions for solely automated decisions or profiling that produce legal or similarly significant effects.

Service providers, links and international transfers

Cloudflare hosts and protects the website, including its forms and security checks. GoHighLevel processes contact, opportunity, calendar and workflow information so Chado can respond and arrange meetings. Subject to your choices, Google Tag Manager, Google Analytics, Google Ads, Meta and LinkedIn may process website and campaign measurement data. Fonts are requested from Google Fonts. External services such as WhatsApp and social networks process visits under their own notices.

Some providers may process data outside the European Economic Area. Where GDPR requires it, transfers should rely on an adequacy decision, standard contractual clauses or another lawful safeguard. Contact us if you want information about safeguards relevant to your data.

How long we keep information

We keep personal data only for as long as necessary for the purpose collected and any legal obligations. As a working schedule, unsuccessful enquiries are normally reviewed for deletion within 24 months of the last meaningful contact; client and transaction records may be retained longer where accounting, contractual or legal requirements apply. Newsletter details are kept until you unsubscribe or we stop the service. Security logs follow the retention schedule of the relevant hosting provider.

Your data-protection rights

Subject to the GDPR and applicable limitations, you may request access, correction, deletion, restriction, portability or object to processing. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.

Email hello@thechado.com to exercise a right. We may need enough information to verify your identity. You may also complain to Malta’s Information and Data Protection Commissioner.

Changes and questions

We may update this notice when our services, providers or legal obligations change. The review date above identifies the current version. Questions can be sent to hello@thechado.com.