Privacy Policy

Privacy Notice

Last updated: October 2026

Overview

At St George’s Mall, Malta (the “Mall” or “St George’s Mall”), and operated by the Malta-based DB Gauci Shopping Mall Limited (C-82284), we strive to provide a safe, enjoyable and convenient shopping and leisure destination. To be positioned to do this, we are required to process and store certain types of personal data. We are committed to protecting your personal data and ensuring that it is processed securely and in accordance with applicable data protection laws.

We shall, through this Privacy Notice, explain our data collection and processing procedures, as well as your rights as ‘Data Subjects’, and this in line with the European Union’s General Data Protection Regulation [EU] 2016/679 (the “GDPR”) and the Data Protection Act (Chapter 586 of the Laws of Malta), together the “Data Protection Laws”.

This Privacy Notice applies to the processing of your Personal Data in connection with your visits to the Mall, your use of its facilities and services, your access to our website (accessible at www.stgeorgesmall.com) (the “Website”), and any other interactions with us, whether in person, through our social media pages or otherwise. It is intended to provide you with information relating to the following matters:

DB Gauci Shopping Mall Limited
What Personal Data do we collect?
How do we collect your Personal Data?
How do we use your Personal Data and on what legal basis?
Disclosure of Personal Data to Third Parties
Transfer to Third Countries
Protection of Your Personal Data
Data Retention
Your Rights
Questions and Complaints

This Privacy Notice was last updated in October 2026, and we may update it from time to time. If we believe that any changes will impact you significantly, we will notify you before they are made.

Please ensure that you visit this page from time to time to stay updated about our data processing practices.

1. DB Gauci Shopping Mall Limited

In this Privacy Notice, the terms ‘we’, ‘us’ and ‘our’ refer to DB Gauci Shopping Mall Limited, and, as elaborated upon below, we collect and handle Personal Data in the course of our business operations at St George’s Mall. In our capacity as Data Controller, we determine the purpose and means of the processing of the Personal Data.

Our contact details are as follows: 

Full name of Data Controller: DB Gauci Shopping Mall Limited
Company registration number: C 82284
Company registered address: Ta’ Klara, Triq ir-Ramla, Naxxar NXR 6544, Malta
Postal address: St George’s Shopping Mall, Triq Prof Walter Ganado, Pembroke, Malta
Email address: mailto:info@stgeorgesmall.com
Telephone number: (+356 2208 2000)

2.   What Personal Data do we collect?  

In our capacity as Data Controller, and as shall be elaborated upon throughout this Privacy Notice, we may collect, use, store and transfer different kinds of Personal Data about you strictly for the purposes of:

enabling you to safely and effectively use the facilities and services available at the Mall;
providing feedback to your queries, comments or complaints;
administering promotions, competitions and events;
facilitating your use of guest Wi-Fi and the Mall’s car park facilities;
maintaining our relationship with you if you are our tenant; and
maintaining the security of the mall.

We have grouped the Personal Data that we may collect, use, store and transfer together, as follows:

Identity Data: name, surname, identity card number, date of birth, username or similar identifier, and footage of you which may be captured by the CCTV cameras installed and operating within and around the Mall, including entrances, common areas and the car park.

Please note as follows:

at the car park, your vehicular number plates may be scanned and processed automatically at the entry and exit points through automated recognition systems;
your identity card number will be processed in very limited scenarios, such as if and when claiming a prize in a competition, or a lost item as your own in terms of our Lost and Found Policy.

Contact Data: home address, billing address, email address and telephone and/or mobile number.

Technical Data: details about the device that you use to access our Website or guest Wi-Fi services. This could be information that identifies your device, its operating system, internet protocol address, browser type and version, login data, browser plug-ins, as well as your location details.

User Data: information about your use of the Mall’s facilities and services, which may include Technical Data. This may also include information collected whenever you engage with us through surveys or questionnaires or provide feedback regarding your experience at the Mall through our ‘Contact Us’ form or any feedback forms we may issue from time to time.

Marketing and Communications Data includes additional data which we may collect for marketing and communications purposes, namely information relating to your preferences in receiving marketing communications, newsletters, promotional offers and information about events from us.

Special Categories of Data

Certain types of Personal Data are considered particularly sensitive under the GDPR and are subject to additional protection. These include Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data processed for the purpose of uniquely identifying an individual, data concerning health and data concerning a person’s sex life or sexual orientation.

We do not ordinarily seek to collect or process Special Categories of Personal Data in connection with your use of the Mall or our facilities and services.

There may, however, be limited circumstances in which you voluntarily provide us with such Personal Data, or in which it becomes necessary for us to process such Personal Data for a particular purpose. This may arise, for example, where you provide us with health-related information in connection with an accident at the Mall, an accessibility request, or your participation in a particular event or activity.

Where we process Special Categories of Personal Data, we will only do so where we have a valid legal reason for doing so and in accordance with the additional safeguards and requirements that apply to this type of sensitive Personal Data under Data Protection Laws.

Personal Data concerning Minors

The Mall is a public space and is visited by persons of all ages, including children and young persons. As a result, we may process limited Personal Data relating to minors in the ordinary course of operating the Mall, including, for example, where they are captured by our CCTV systems or participate in events or activities held at the Mall.

We do not, however, knowingly seek to collect Personal Data directly from minors for marketing purposes or through services specifically requiring the provision of Personal Data, unless appropriate consent or authorisation has been obtained from their parent or legal guardian where this is required by law.

Where we process Personal Data relating to minors, we will take particular care to ensure that such Personal Data is processed fairly, lawfully and securely, having regard to the age of the individual and the nature and purpose of the processing.

CCTV

In line with our security procedures, we have installed CCTV cameras throughout the Mall, including its entrances and exits, common areas, escalators, loading bays, external areas and car park. Some of our cameras also monitor the pavement and pedestrian areas immediately surrounding the Mall. Our cameras do not record audio. These cameras are used solely for security purposes.

3.   How do we collect your Personal Data? 

We use different methods to collect your Personal Data, including:

A. Direct Interactions: The collection of your Identity Data, Contact Data, Technical Data, User Data, and Marketing and Communications Data when you engage with us directly at the Mall, by phone, email, through our Website or otherwise. This includes, in the main, Personal Data you provide us with when:

registering your marketing preferences with us;
subscribing to our newsletter or promotional communications;
participating in promotions, competitions, events or loyalty programmes organised by or on behalf of the Mall;
contacting us with any queries, demands, requests, complaints or other feedback;
participating in a survey and/or completing a questionnaire compiled by us;
using our guest Wi-Fi;
visiting the Mall, including its common areas and car park, and passing through our CCTV monitored areas; and
interacting with us through any one of our social media platforms.

B. Automated technologies and/or interactions: The collection of your Technical Data whenever you access and make use of our Website and, where applicable, our guest Wi-Fi services. We generally collect Technical Data automatically through the use of cookies and similar technologies, which are specifically covered in our Cookie Notice. Where applicable, we may also collect vehicle registration numbers automatically through number plate recognition systems installed at the car park’s entry and exit points.

C. Publicly available sources: We may also need to collect Identity Data and Contact Data from various publicly available sources, including public registers, company registers, social media platforms, court website and other lawful sources where permitted by the applicable law. We will only collect Personal Data from such sources where necessary for specific purposes, including tenant onboarding and due diligence, and for the establishment, exercise or defence of legal claims.

Personal Data belonging to Third Parties

By providing us with or allowing us to access Personal Data relating to individuals other than yourself, you confirm that you have the authority to send us that Personal Data or the authority to permit us to access those data in the manner described in this Privacy Notice.

Social Media Sites

If you choose to connect one or more of your social media accounts with Our Website (if this option is available) to enable the sharing of Personal Data via social media platforms, certain categories of Personal Data relating to you from your social media account(s) will be shared with Us. Kindly note that such social media sites may make use of cookies that process your Personal Data and which are entirely separate from our own cookies and for which we are not responsible. You may opt out from the sharing of your Personal Data through the relevant social media platform itself.

4. How do we use your Personal Data?

We will only process your Personal Data on the basis of legally permissible grounds in terms of the Data Protection Laws. We will mainly process your Personal Data for the following reasons:

Where it is necessary for our legitimate interests, and your interests and fundamental rights do not override those interests;
When you would have given consent to certain specific processing activities;
When we need to comply with a legal obligation; and, or
In order to satisfy any contractual obligations that we may have towards you.

For more detail, please read the section directly below entitled, ‘LEGAL GROUNDS FOR PROCESSING’.

LEGAL GROUNDS FOR PROCESSING

The table below describes the purposes for which we process your Personal Data, the categories of Personal Data involved and the legal bases upon which we rely. Where more than one legal basis is identified, the basis applicable will depend on the particular processing activity and the circumstances in which your Personal Data is processed.

Purpose of Processing	Personal Data Processed	Legal Grounds for Processing
Responding to enquiries, requests, and other non-contentious communications, including in particular those voluntarily submitted through our Website, social media platforms or customer service channels.	Identity Data; Contact Data.	a. Protection of our legitimate interests (responding to enquiries, maintaining customer relations, improving our services and updating our internal records).
Responding to complaints and contentious communications, including in particular those submitted through our Website, social media platforms or customer service channels, and managing actual or potential disputes and legal claims.	Identity Data; Contact Data; Marketing and Communications Data.	a. Protection of our legitimate interests (responding to and investigating complaints and disputes, protecting our legal interests, and establishing, exercising or defending legal claims).
Managing our relationship with our patrons and the customers of our tenants, as well as visitors generally, including the administration of the Mall’s Lost and Found Policy.	Identity Data; Contact Data.	a. Compliance with legal obligations, where applicable. b. Protection of our legitimate interests (administering our business generally).
To establish and investigate any suspicious behaviour in order to protect our business from any risk and fraud.	Identity Data; Contact Data; Marketing and Communications Data; User Data; Technical Data.	a. Protection of our legitimate interests (prevention and detection of fraud and crime).
Managing competitions, promotions, events and other similar activities organised by or on behalf of the Mall.	Identity Data; Contact Data; Marketing and Communications Data; User Data.	a. Consent. b. Performance of contractual obligations (steps in organising / administering the competition, to be able to identify you in the case you win a competition, to provide you with a prize if applicable). c. Compliance with legal obligations, where applicable. d. Protection of our legitimate interests (organising Mall events and promoting our business). [Note: Consent will be relied upon only for separate optional processing that genuinely requires consent, such as certain marketing communications.]
Sending promotional material, newsletters, event invitations and other marketing communications relevant to you.	Identity Data; Contact Data; Marketing and Communications Data.	a. Consent (where you have opted in to receive marketing communications).
Administering and operating St George’s Mall’s Website, guest Wi-Fi, IT systems and other digital services.	Identity Data; Contact Data; User Data; Technical Data.	a. Consent. b. Performance of contractual obligations (where the relevant digital service is provided pursuant to terms forming a contract with you). c. Protection of our legitimate interests (operating our business efficiently, ensuring network security and maintaining our IT infrastructure). [Note: Consent will be relied upon where and if specifically required, including for non-essential cookies or similar technologies.]
CCTV surveillance throughout and around the Mall and car park.	Identity Data (CCTV footage).	a. Protection of our legitimate interests (administering the Mall and car park, preventing crime, protecting persons and property, investigating incidents and enforcing our policies)
Administering and operating the car park.	Identity Data (vehicular number plates); Contact Data.	a. Protection of our legitimate interests (administering the car park, preventing crime, protecting persons and property, investigating incidents and enforcing our policies) b. Performance of contractual obligations (to ensure that customers duly pay their parking ticket after we would have allowed them to park at the car park).
When you send over a CV to apply for a job	Identity Data; Contact Data.	a. Taking steps at your request prior to entering into a contract (processing and assessing your application for employment). b. Consent. c. Compliance with legal obligations, where applicable. d. Protection of our legitimate interests (ensuring candidate/s are suitable for the position, satisfying our staffing requirements).
Maintaining our relationship with our existing tenants and onboarding new tenants	Identity Data; Contact Data. [Note: If our tenant is a corporate entity, we may need to collect the Identity Data and Contact Data of its officers / employees.]	a. Performance of contractual obligations (where the data subject is the tenant and party to the agreement). b. Protection of our legitimate interests (administering tenant relationships, leases and Mall operations, including carrying out appropriate due diligence in relation to existing and prospective tenants and their officers and representatives).

In some cases, your Personal Data may also be processed by our entrusted third-party processors in accordance with the Data Protection Laws. These third-party processors will assist us in operating the Mall and delivering our facilities and services. For further information, please refer to Section 5 of this Privacy Notice.

MARKETING AND COMMUNICATIONS

We will only send you marketing communications where you have expressly opted in to receive such communications from us.

Where you have provided your consent, we may use your Personal Data to send you promotional material, newsletters, information about events, promotions and activities at the Mall, and other marketing communications which may be relevant to you.

You may withdraw your consent and request that we stop sending you marketing communications at any time by following the unsubscribe or opt-out instructions contained in any marketing communication, updating your marketing preferences where available, or by contacting us directly via email, telephone or through our other channels of communication.

Withdrawal of your consent will not affect the lawfulness of any processing carried out on the basis of your consent before it was withdrawn.

HYPERLINKS

Our Website may contain hyperlinks to third-party websites, including those operated by our tenants, business partners or other organisations. These websites have their own privacy notices over which we have no control. We encourage you to read their privacy notices before providing them with your Personal Data. We accept no responsibility or liability for the privacy practices or content of such third-party websites.

COOKIES

Cookies are text files placed on your computer or portable device when using our Website. They collect standard internet log information and information regarding visitor activity on our Website. Cookies help us analyse website traffic, improve the performance and functionality of our Website, remember your preferences and enhance your browsing experience.

You may configure your browser to refuse all or some cookies or to alert you when cookies are being used. However, if you disable or refuse certain cookies, some parts of our Website may not function properly and your experience may be affected.

Further information regarding the cookies we use, including their purpose and retention periods, can be found in our Cookie Notice.

5. Disclosures of Personal Data to Third Parties

We may have to share your Personal Data with third parties for the purposes set out in the table in Section 4 directly above (i.e. to the extent necessary to fulfil the purposes for which your data was collected). In certain instances, such third parties may act as data processors on our behalf and process your Personal Data in accordance with our instructions. Such third-party entities comprise:

Related companies, including other entities within the DB and/or PG Group of companies, with which we may share your Personal Data where necessary for the management and operation of the Mall and the provision of our facilities and services.
Car park management and technology service providers, including third parties engaged to assist in the operation and administration of the car park, which may involve the collection and processing of vehicle number plates through automated recognition systems.
IT security, software support and cloud service providers, including service providers who assist us in ensuring that your Personal Data remains secure, our systems remain operational and our digital infrastructure is properly maintained.
IT backup and business continuity providers, including service providers who assist us in securely storing your Personal Data and maintaining appropriate disaster recovery and business continuity arrangements.
CCTV security systems, access control, alarm monitoring and maintenance providers, including service providers who assist us in ensuring the security of the Mall, our visitors, tenants, employees and property, and in maintaining our security systems.
Guest Wi-Fi and telecommunications providers, including service providers responsible for the operation, maintenance and security of the Mall’s guest Wi-Fi network and related communications infrastructure.
Administrative software providers and administrative support services, including service providers who enable us to organise and manage our internal administrative processes more efficiently.
Third-party consultants and professional advisors, including legal advisers, auditors, accountants, tax advisors, insurers, insurance brokers and other professional consultants who assist us in complying without legal, regulatory and business obligations.
Insurance service providers and insurers, who shall assist us in ensuring that the Mall and related operations are adequately covered through the necessary insurance.
Marketing, communications, advertising and media partners, including service providers who assist us in organising promotions, competitions, events, social media activities, newsletters and other marketing campaigns.
Event organisers and service providers, including third parties engaged to organise, facilitate or manage events, exhibitions, promotions and their activities held at or in conjunction with the Mall.

We require all third parties with whom we share Personal Data to respect the security and confidentiality of such Personal Data and to process it in accordance with applicable Data Protection Laws. We do not permit our third-party processors to use your Personal Data for their own purposes and only permit them to process your Personal Data for specified purposes and in accordance with our documented instructions.

Please note that retailers, restaurants and other businesses operating at the Mall are independent data controllers in respect of the Personal Data they collect from you. Where you provide Personal Data directly to a tenant or other independent business operating within the Mall, the processing of that Personal Data will be governed by that business’s own privacy notice and not by this Privacy Notice.

We may also at times need to report information or provide Personal Data to regulatory, governmental, and legal authorities, including public authorities, law enforcement agencies, the executive police, the courts and regulatory bodies that may require disclosure of Personal Data where such is required or permitted by law.

6. Transfers to Third Countries

As a rule, we do not transfer your Personal Data to persons or entities outside the European Union (“EU”) / European Economic Area (“EEA”). However, should this become necessary:

for the performance of contractual obligations between us;
for adherence with our legal and/or regulatory obligations;
for the establishment, exercise or defence of legal claims; or
for any other reason where such transfer would be permitted in terms of the applicable law,

we shall transfer your Personal Data to countries in the EU / EEA or to third countries outside the EU / EEA which ensure an adequate standard of protection for such Data in terms of the GDPR.

Where it is necessary to transfer your Personal Data to a country outside the EU / EEA which is not subject to an adequacy decision by the European Commission, we shall ensure that appropriate safeguards are implemented to protect your Personal Data, including, where appropriate, the use of the European Commission’s Standard Contractual Clauses, binding corporate rules, or any other transfer mechanism recognised under the GDPR.

7.   Protection of your Personal Data

We have implemented appropriate technical and organisational security measures to prevent your Personal Data from being accidentally or unlawfully lost, accessed, altered, disclosed or otherwise processed in an unauthorised manner. Such measures are designed having regard to the nature of the Personal Data we process, the risks involved and the requirements of the applicable Data Protection Laws.

In addition, we limit access to your Personal Data to those employees, agents, contractors and other third-party processors who have a legitimate business need to know such information in order to perform their duties. They will only process your Personal Data on our documented instructions and are subject to appropriate obligations of confidentiality.

When we engage third-party service providers to process Personal Data on our behalf, we require them to implement appropriate technical and organisational security measures and to process your Personal Data only in accordance with applicable Data Protection Laws and our instructions.

We have established procedures to identify, investigate and respond to any actual or suspected Personal Data breach. Where we are legally required to do so, we will notify the relevant supervisory authority and, where applicable, affected individuals of any Personal Data breach in accordance with the requirements of the Data Protection Laws.

8. Data Retention

We retain your Personal Data only as long as we have a valid reason to do so, including where necessary to satisfy legal, regulatory, accounting, taxation or reporting requirements, to resolve disputes, enforce our legal rights and obligations, or otherwise fulfil those purposes for which your Personal Data was collected.  

In determining the appropriate retention period for your Personal Data, we take into account the nature, volume and sensitivity of the Personal Data, the potential risk of harm resulting from unauthorised use or disclosure, the purposes for which we process your Personal Data, whether those purposes can reasonably be achieved through other means, and the applicable legal, contractual and regulatory requirements.

In general, we will retain your Personal Data for as long as you remain subscribed to our marketing communications, participate in our events or promotions, or otherwise maintain a relationship with us for any specific purpose requiring ongoing communication, and for such period thereafter as may be required or permitted by law.

Certain categories of Personal Data, including CCTV footage, guest Wi-Fi records and marketing preferences, may be retained for different periods depending on the purpose for which they were collected and the applicable legal requirements.

In some circumstances we may anonymise your Personal Data so that it can no longer be associated with you. Where this is the case, we may use such anonymised information for statistical, analytical, business improvement or research purposes indefinitely without further notice to you.

9. Your Rights

As a data subject, the Data Protection Laws grant you certain rights in relation to your Personal Data. These rights are being listed and explained in the table below:

Your rights under the GDPR	What does this mean?
ACCESS	You have the right to request access to the Personal Data that we hold about you and to receive a copy of such Personal Data, together with certain information regarding how we process it.
RECTIFICATION	You have the right to request that we rectify or update any inaccurate or incomplete Personal Data that we may hold about you.
ERASURE	You have the right to request the deletion of your Personal Data where there is no lawful reason for us to continue processing it. Please note, however, that we may not always be able to comply with your request where we are required or permitted by law to retain your Personal Data. Where this is the case, we will inform you accordingly. Please also note that, in certain circumstances, we may be unable to provide you with some of our facilities or services if we are required to delete your Personal Data.
RESTRICTION OF PROCESSING	You have the right to request that we restrict the processing of your Personal Data in certain circumstances, including where: (a) you contest the accuracy of your Personal Data; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
DATA PORTABILITY	Where applicable, you have the right to receive your Personal Data in a structured, commonly used and machine-readable format and to request that it be transmitted directly to another controller where this is technically feasible.
OBJECTION TO PROCESSING	You may object to the processing of your data where we are relying on legitimate interests (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms. Where your Personal Data is processed for direct marketing purposes, you have the right to object at any time and we will cease processing your Personal Data for those purposes.
WITHDRAWAL OF CONSENT	If you have provided consent for the processing of your data you have the right (in certain circumstances) to withdraw that consent at any time which will not affect the lawfulness of the processing before your consent was withdrawn.

[NOTE: depending on the nature of your request, we may be unable to provide you with certain facilities or services, or continue communicating with you, if you choose to exercise your right to restrict processing, object to processing or withdraw your consent where such processing is necessary for the relevant purpose.]

If you wish to exercise any of the rights set out above, please contact us. We will try to respond to all legitimate requests within one (1) month and may require that you send over specific information to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights as outlined directly above). This is a security measure designed to protect your Personal Data from unauthorised access or disclosure.

You will not have to pay to access your Personal Data (or to exercise any of the other rights mentioned above). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may, in such circumstances, refrain from complying with your request.

QUESTIONS AND COMPLAINTS

If you have any questions, concerns or requests relating to this Privacy Notice or the manner in which we process your Personal Data, please do not hesitate to contact us using the details below:

Postal address: St George’s Shopping Mall, Triq Prof. Walter Ganado, Pembroke, Malta

Email address: mailto:info@stgeorgesmall.com
Telephone number: +356 2208 2000

If you believe that our processing of your Personal Data infringes the Data Protection Laws, you have the right to lodge a complaint with the competent data protection supervisory authority. In Malta this would be the Office for the Information and Data Protection Commissioner, the contact details of which are as follows:

OFFICE OF THE INFORMATION AND DATA PROTECTION COMMISSIONER [MALTA]

Address: Level 2, Airways House, High Street, Sliema SLM 1549, Malta

Email: commissioner.dataprotection@gov.mt
Phone: +356 2328 7100

You also have the right to lodge a complaint with the supervisory authority in the Member State of the European Union where you habitually reside, work or where the alleged infringement has occurred, where applicable.

We are committed to protecting your privacy and take any concerns regarding the processing of your Personal Data seriously. While you have the right to contact the competent supervisory authority at any time, we would welcome the opportunity to address your concerns directly in the first instance.