Privacy Policy

Last updated: 22 April 2026

This policy explains what personal data WebDev&M (Malta) collects when you visit our website or book a call with us, why we collect it, who we share it with, and what rights you have over it. We've written it to be readable, if anything is unclear, email us.

1. Who we are

WebDev&M is a web design and development agency based in Malta, operated by its two founders Sean Kristoffersen and Andreas Falsig. For the purpose of the EU General Data Protection Regulation (GDPR), we are the data controller for any personal data processed through webdevm.com.

2. What we collect

When you book a call

We use Calendly to schedule discovery calls. When you book, Calendly collects the name, email address, timezone, and any message you provide, and shares that with us. Calendly also creates a Google Meet link and adds the event to our Google Calendar.

When you browse the site

We use PostHog (EU-hosted) for product analytics. It records:

• Pages you visit and sections you scroll to
• Clicks on buttons, CTAs, and outbound links
• General device information (browser, screen size, country)
• A pseudonymous session identifier stored locally in your browser

PostHog does not record keystrokes or form field contents. IP addresses are processed only to derive approximate country/city and are not retained in identifiable form. Data is stored in the European Union.

Server logs

Our hosting provider keeps standard access logs (IP address, user agent, timestamp, requested URL) for a short period for security and troubleshooting purposes. These are not used for marketing.

3. Why we process this data

• To deliver the service you asked for, e.g. setting up your discovery call. Legal basis: performance of a contract or pre-contractual steps at your request.
• To improve the site, understanding which pages work, where people drop off. Legal basis: legitimate interest in running and improving our own business website.
• To keep the site secure, detecting abuse and debugging errors. Legal basis: legitimate interest.

We do not sell your data. We do not use it for behavioural advertising. We do not enrich it with third-party data brokers.

4. Who we share it with

We only share the minimum necessary data with the services that make this site and our business run:

• Calendly, booking scheduling (your name, email, booking details).
• Google Workspace, calendar and email (your booking becomes a calendar event and email thread).
• PostHog (EU Cloud), anonymous analytics.
• Our hosting provider, serves the website.

Each of these is a data processor acting on our instructions under a Data Processing Agreement. None of them are authorised to use your data for their own purposes.

5. How long we keep it

• Booking data: retained for as long as the business relationship is active, plus 6 years for Maltese accounting/tax purposes if you become a paying client.
• Analytics data: aggregated data kept indefinitely; raw event-level data for 12 months.
• Email correspondence: retained while relevant, typically deleted within 2 years of last contact.

6. Your rights

Under GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data (the "right to be forgotten")
• Object to processing based on legitimate interest
• Restrict processing in certain circumstances
• Port your data to another provider
• Lodge a complaint with a supervisory authority, in Malta, the Office of the Information and Data Protection Commissioner

To exercise any of these rights, email us at hello@webdevm.com. We'll respond within 30 days.

7. Cookies and local storage

PostHog stores a pseudonymous identifier in your browser's local storage (not a traditional cookie) so it can recognise return visits without identifying you personally. Calendly sets its own cookies when you interact with its embedded widget, you can review Calendly's privacy policy for details.

Our own site does not set advertising cookies, tracking pixels, or third-party marketing tags.

8. International transfers

Most of your data stays in the EU (PostHog EU Cloud, our hosting). Google Workspace and Calendly are US-headquartered; transfers of personal data to them rely on the EU-US Data Privacy Framework and Standard Contractual Clauses.

9. Changes to this policy

If we update this policy materially, we'll note the revised date at the top and, for active clients, send an email. The current version always lives at webdevm.com/privacy.