Privacy Policy

1. Who we are

Mihai Group Ltd provides transport, parcel, cargo and interior finishing services in Malta, including Sicily-to-Malta transport and parcel services using the DPD network.

For the purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Maltese data-protection law, the controller of personal data collected through this website and in connection with our services is:

Mihai Group Ltd
62 Jesmond Court
Triq L-Iskuna
San Pawl il-Baħar
Malta

Website: https://mihai.com.mt
General enquiries: info@mihai.com.mt
IKEA and Sicily enquiries: ikea@mihai.com.mt

In this Privacy Policy, “Mihai,” “we,” “us” and “our” refer to Mihai Group Ltd.

2. Scope of this policy

This Privacy Policy explains how we collect, use, disclose, retain and protect personal data when you:

• visit mihai.com.mt;
• use our transport calculator;
• send us an enquiry;
• request space for a shipment;
• complete a parcel collection mandate;
• communicate with us by email, telephone, WhatsApp or Nesli;
• visit our agency;
• use our transport, parcel, Cargo Taxi or interior finishing services;
• otherwise interact with Mihai Group Ltd.

Our Cookie Policy provides additional information about cookies, local storage and similar technologies used on the website.

3. Personal data we may collect

Depending on how you interact with us, we may process the following categories of personal data.

3.1 Identity and contact information

This may include:

• your name;
• email address;
• telephone or WhatsApp number;
• collection, delivery, billing or service address;
• company name and role, where relevant;
• identification information where required for a mandate, collection, delivery, legal obligation or fraud-prevention check.

3.2 Enquiry and communication information

This may include:

• the subject and content of your enquiry;
• messages exchanged with our staff or Nesli;
• attachments, photographs and documents you choose to send;
• records of telephone, email or WhatsApp communications;
• your preferred contact method;
• service requirements and instructions.

Please do not send passwords, one-time verification codes, payment-card security codes, wallet recovery phrases or unrelated sensitive personal information.

3.3 Transport, parcel and service information

This may include:

• collection and delivery details;
• sender and recipient information;
• parcel or cargo descriptions;
• IKEA article codes, product links, order details, wishlists or PDFs that you provide;
• dimensions, weight, volume and quantity;
• packing information;
• stairs, lift, parking, loading and access details;
• requested dates or routes;
• estimates, quotations and service confirmations;
• parcel mandates and related authorisations;
• tracking, collection, delivery and exception information;
• photographs used to assess a load, access point, item or project;
• signatures and confirmation records where required.

The calculator provides an estimate only. A request for space, submitted mandate or calculated price does not create a confirmed booking. Availability and operational details remain subject to human confirmation.

3.4 Transaction and accounting information

Where you purchase a service, we may process:

• quotation and invoice information;
• amounts paid or payable;
• payment status;
• transaction references;
• VAT and accounting records;
• refunds, adjustments or disputes.

We do not ask customers to submit full payment-card details through a general contact form.

Payments may be processed by a separate financial-services provider. That provider processes payment information under its own privacy terms and security requirements.

3.5 Website and technical information

When you use our website, our servers and security systems may process:

• IP address;
• browser and device type;
• operating system;
• requested pages and files;
• date and time of access;
• referring page;
• general diagnostic and error information;
• cookie-consent preferences;
• security events and indicators of malicious or automated activity.

We use this information to operate, secure, diagnose and improve the website.

3.6 Agency and direct-contact information

If you visit our agency or communicate with us outside the website, we may keep information needed to:

• identify your enquiry or shipment;
• provide the requested service;
• arrange collection or handover;
• record instructions;
• resolve a complaint or dispute;
• comply with postal, transport, tax, accounting or other legal obligations.

4. How we collect personal data

We may collect personal data:

• directly from you;
• from a sender, recipient, authorised representative or person arranging a service for you;
• through our website forms and calculator;
• through a parcel collection mandate;
• through email, telephone, WhatsApp or Nesli;
• when you visit our agency;
• from suppliers, carriers or service partners involved in completing your requested service;
• from technical, security and consent-management systems used to operate the website;
• from public sources where this is necessary and lawful.

If you provide personal data about another person, such as a recipient, sender, employee, customer or authorised representative, you must ensure that you are entitled to provide it and that the person has been informed about the relevant processing.

5. Why we process personal data

We process personal data for the following purposes.

5.1 Responding to enquiries

We use the information submitted through our contact forms, email, telephone, WhatsApp or Nesli to:

• understand your request;
• identify the relevant service;
• prepare an estimate or quotation;
• request missing information;
• answer questions;
• provide instructions;
• follow up on your enquiry.

The legal basis is normally taking steps at your request before entering into a contract. We may also rely on our legitimate interest in managing customer enquiries and maintaining business communications.

5.2 Providing and administering services

We process personal data to:

• calculate an estimate;
• assess shipment size, weight and access;
• request and confirm transport space;
• arrange collections and deliveries;
• provide parcel, cargo, transport or interior finishing services;
• communicate operational updates;
• coordinate with relevant suppliers, carriers and service providers;
• issue invoices and maintain service records;
• handle complaints, claims and disputes.

The legal basis is performance of a contract or taking steps at your request before entering into a contract.

5.3 Parcel mandates and authorisations

Where a mandate is required, we process the details contained in the mandate to:

• verify the authority being granted;
• arrange the declared collection or forwarding service;
• maintain evidence of instructions and authorisation;
• comply with postal, transport, fraud-prevention and legal requirements;
• manage complaints, claims or disputes.

The legal basis may be performance of a contract, compliance with a legal obligation and our legitimate interest in verifying instructions and preventing unauthorised collections.

5.4 Accounting and legal compliance

We process transaction, invoice and service information to:

• maintain accounting and tax records;
• meet postal, transport, company and other regulatory obligations;
• respond to lawful requests from authorities;
• establish, exercise or defend legal claims.

The legal basis is compliance with legal obligations and, where applicable, our legitimate interest in protecting our legal and commercial position.

5.5 Security, abuse and fraud prevention

We may process technical and communication information to:

• protect our website, forms, calculator and communication systems;
• detect spam, bots, abuse, fraud and malicious activity;
• investigate security incidents;
• prevent unauthorised use;
• protect customers, staff and business systems;
• maintain evidence relating to suspected fraud or unlawful activity.

The legal basis is our legitimate interest in operating secure and reliable services and, where applicable, compliance with legal obligations.

5.6 Website improvement and statistics

Where permitted, we use aggregated or anonymous website statistics to understand:

• which pages are used;
• general website traffic;
• technical performance;
• navigation problems;
• whether website content is useful.

The legal basis depends on the technology used. Strictly necessary technical processing may be based on our legitimate interest in operating the website. Where consent is required for a statistics technology, it will only be used after consent has been obtained through the cookie-consent controls.

6. Contact forms

When you submit a contact form, we may collect:

• your name;
• email address;
• selected service or subject;
• message;
• information and files that you voluntarily provide;
• technical information needed for validation, spam prevention and security.

We use this information to respond, route the enquiry to the appropriate Mihai service and maintain a record of the communication.

Our forms may use validation, honeypot fields, rate limiting, security logging and automated spam detection. These measures are used to protect the website and our communication systems. They are not used to make decisions that produce legal or similarly significant effects about you.

Contact-form information may be transmitted through our website, hosting, email and internal enquiry-management systems. Access is limited to people and service providers who need it for the relevant purpose.

Do not include unnecessary identity documents, financial credentials, passwords, verification codes or special-category information in a general enquiry form.

If additional information is required for a confirmed service, we will tell you how it should be provided.

7. Calculator and request-space process

The calculator may process information such as:

• IKEA article codes;
• product links;
• wishlist or PDF information;
• product quantities;
• shipment dimensions, volume and weight;
• destination and access details;
• information required to prepare an estimate.

This information is used to calculate an estimated transport charge and help you prepare a request for space.

The calculation is not a confirmed booking and does not guarantee transport capacity, collection or delivery. A member of the Mihai team must confirm availability and the applicable service arrangements.

We do not use calculator information to make a solely automated decision that produces legal or similarly significant effects.

8. Analytics and cookies

We use Complianz to manage cookie choices and record consent preferences.

The website currently uses Burst Statistics for anonymous or aggregated website statistics. We use these statistics to understand general website use and improve content and performance.

We do not use anonymous website statistics to identify individual customers or make decisions about their eligibility for a service.

Cookies and similar technologies are divided into categories such as:

• strictly necessary or functional;
• preferences;
• statistics;
• marketing, if any such technology is introduced and valid consent is obtained.

Where a cookie or similar technology is not strictly necessary, it will only be used where the required consent has been obtained. You can use the cookie settings available on the website to accept, refuse or withdraw consent.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

The current list of cookies, services, purposes and expiry periods is maintained in our Cookie Policy and cookie-consent controls. The Cookie Policy should be read together with this Privacy Policy.

9. Nesli, WhatsApp and other communications

If you communicate through Nesli, WhatsApp or another external communication service, the information you provide may also be processed by the relevant platform provider under its own terms and privacy policy.

Do not send confidential credentials or unnecessary sensitive information through chat or WhatsApp.

Nesli may help route questions and provide general information, but important service arrangements, prices, availability and bookings remain subject to confirmation by the Mihai team.

You may choose to contact us through the website form or the published Mihai email addresses instead.

10. Embedded and external services

Our website may contain links to or embedded content from third-party services, including:

• Adobe Acrobat Sign for mandates or electronic signatures;
• WhatsApp for communications;
• ikea.it for IKEA orders and collection instructions;
• DPD tracking or parcel information;
• mapping, document or other operational services where required.

When you choose to open or use an external service, that provider may receive technical and personal information directly from you. Its processing is governed by its own privacy policy and terms.

Where practical, we use click-to-load controls or consent controls before loading non-essential external content.

We are not responsible for the privacy practices of third-party websites that operate independently from Mihai Group Ltd.

11. Who we share personal data with

We may share personal data only where necessary and lawful with:

• Mihai personnel and authorised contractors;
• website-hosting and technical-support providers;
• email, communication and enquiry-management providers;
• transport operators, carriers and parcel-network providers involved in the requested service;
• suppliers or collection points involved in fulfilling your instructions;
• electronic-signature and document-processing providers;
• accounting, legal, insurance and professional advisers;
• payment-service providers;
• IT-security, backup, anti-spam and fraud-prevention providers;
• public authorities, courts, regulators or law-enforcement bodies where disclosure is legally required;
• a buyer, successor or adviser in connection with a genuine restructuring, acquisition or transfer of the business, subject to appropriate confidentiality and legal safeguards.

We do not sell personal data.

We require processors acting on our behalf to process personal data only on documented instructions, protect it appropriately and comply with applicable data-protection law.

A recipient, sender, carrier or other independent organisation involved in a service may process personal data as a separate controller where it determines its own legal purposes and obligations.

12. International transfers

Some technology, communication, document or service providers may process information outside Malta or the European Economic Area.

Where GDPR rules on international transfers apply, we use an applicable transfer mechanism, such as:

• an adequacy decision;
• European Commission standard contractual clauses;
• another legally permitted safeguard or derogation.

You may contact us for further information about the safeguards applicable to a particular transfer.

13. How long we retain personal data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected and for applicable legal, accounting, tax, postal, transport, insurance and dispute-resolution requirements.

We apply the following retention criteria:

• Unsuccessful or general enquiries: normally retained for up to 24 months after the last meaningful communication, unless a longer period is required for a complaint, dispute, security matter or legal obligation.
• Customer, shipment and service records: retained for the duration of the service relationship and afterwards for the period required by applicable accounting, tax, postal, transport and limitation rules.
• Invoices and financial records: retained for the period required by Maltese tax and accounting law.
• Mandates, authorisations and delivery records: retained for as long as necessary to administer the service, demonstrate authority, deal with claims and meet applicable legal or regulatory requirements.
• Security and anti-spam records: retained only for the period reasonably necessary to investigate, prevent and document security incidents or abuse.
• Consent records: retained for as long as necessary to demonstrate the consent or preference recorded and for an appropriate period afterwards.
• Website statistics: retained according to the periods stated in the Cookie Policy or analytics configuration and, where possible, in aggregated or anonymous form.

At the end of the applicable period, information is deleted, anonymised or securely archived where continued retention is legally required.

14. Security

We use appropriate technical and organisational measures intended to protect personal data against:

• accidental or unlawful destruction;
• loss or alteration;
• unauthorised disclosure;
• unauthorised access;
• misuse;
• malicious or automated attacks.

Depending on the system and risk, these measures may include:

• encrypted website connections;
• access controls and authentication;
• least-privilege access;
• software and security updates;
• firewall and malicious-traffic controls;
• spam protection and rate limiting;
• secure backups;
• logging and monitoring;
• restricted administrative access;
• processor agreements and confidentiality requirements;
• staff instructions and incident-response procedures.

No internet transmission or storage system can be guaranteed to be completely secure. Customers should also protect their accounts and devices and should verify unexpected payment or information requests through a known Mihai contact.

Mihai will not ask you for passwords, one-time verification codes, payment-card security codes or wallet recovery phrases through a general website enquiry.

15. Personal data breaches

A personal data breach is a security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

Where we become aware of a suspected personal data breach, we will:

• investigate and contain the incident;
• assess the nature, scope and likely consequences;
• take reasonable steps to reduce harm;
• document the incident and remedial action;
• notify relevant processors, controllers, insurers, advisers or authorities where appropriate;
• notify the Information and Data Protection Commissioner where required by law;
• inform affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

Where GDPR Article 33 applies, notification to the competent supervisory authority will be made without undue delay and, where feasible, within 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms.

If you believe that personal data provided to Mihai has been lost, disclosed improperly, accessed without permission or otherwise compromised, contact us promptly at info@mihai.com.mt. Do not include passwords or other sensitive credentials in the report.

16. Legal bases for processing

Depending on the situation, we rely on one or more of the following GDPR legal bases:

• Contract: processing is necessary to perform a contract with you or take steps at your request before entering into one.
• Legal obligation: processing is necessary to comply with a legal obligation.
• Legitimate interests: processing is necessary for our legitimate business interests or those of another party, provided those interests are not overridden by your rights and freedoms.
• Consent: you have given consent for a specific purpose, such as a non-essential cookie or optional communication.
• Legal claims or substantial public-interest grounds: where applicable under GDPR and Maltese law.

Where we rely on legitimate interests, these may include:

• responding to enquiries;
• managing customer and supplier relationships;
• securing our website and systems;
• preventing fraud, spam and abuse;
• maintaining appropriate business records;
• improving service quality;
• establishing, exercising or defending legal claims.

17. When information is required

Some information is required to:

• prepare an accurate estimate;
• identify the requested service;
• arrange collection or delivery;
• comply with postal, transport or accounting requirements;
• verify a mandate or authorisation;
• enter into or perform a contract.

If required information is not provided, we may be unable to prepare an estimate, confirm space, arrange a service or comply with your instructions.

Optional information will be identified where practical.

18. Automated decision-making

We do not use personal data to make solely automated decisions that produce legal or similarly significant effects.

The calculator may automatically apply published volume and weight rules to produce an estimate. That estimate is informational and remains subject to a request for space and human confirmation.

Spam and security tools may automatically flag or restrict suspicious activity. Where appropriate, a person may review the result.

19. Your data-protection rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• obtain confirmation of whether we process your personal data;
• request access to your personal data;
• request correction of inaccurate or incomplete information;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive personal data you provided in a structured, commonly used and machine-readable format where the right to data portability applies;
• withdraw consent at any time where processing is based on consent;
• object to direct marketing;
• lodge a complaint with a supervisory authority;
• request information about applicable international-transfer safeguards.

Withdrawing consent does not affect processing lawfully carried out before withdrawal.

These rights are not absolute. We may need to retain or continue processing certain information to comply with legal obligations, complete a contract, protect another person’s rights or establish, exercise or defend legal claims.

20. Exercising your rights

To exercise a data-protection right or ask a privacy question, contact:

Mihai Group Ltd
62 Jesmond Court
Triq L-Iskuna
San Pawl il-Baħar
Malta

Email: info@mihai.com.mt

Please write “Data protection request” in the subject line.

We may ask for information reasonably necessary to verify your identity and locate the relevant records. We will not ask for more identification information than necessary.

We aim to respond within the period required by GDPR. If a request is complex or numerous requests are received, the response period may be extended where the law permits. We will explain any permitted extension.

21. Complaints

If you believe that we have not handled your personal data correctly, please contact us so that we can investigate.

You also have the right to lodge a complaint with Malta’s supervisory authority:

Office of the Information and Data Protection Commissioner
Website: https://idpc.org.mt

You may also complain to another competent European data-protection authority where applicable.

22. Children’s information

Our services and website are not directed to children acting independently.

Where information about a minor is necessary for a service, it should be supplied by or with the authority of a parent, legal guardian or other person legally entitled to provide it.

If you believe that a child has provided personal data without appropriate authority, contact us so that we can investigate and take appropriate action.

23. Changes to this Privacy Policy

We may update this Privacy Policy to reflect:

• changes to our services;
• changes to website technology;
• new legal or regulatory requirements;
• changes to the providers involved in processing;
• improvements to our privacy and security practices.

The current version will be published on this page with its effective or last-updated date.

Material changes will be communicated through an appropriate method where required by law.