Your data. Your story.

We are folkfox, a boutique marketing consultancy operating globally and rooted in Malta. Under the GDPR we are the data controller for the personal data you provide.

We are not required to appoint a statutory Data Protection Officer, but privacy requests go straight to the founder.

• Email: [email protected]
• Base of operations: Malta (EU)

We collect minimal, relevant data:

• Identity and contact data: name, email, and optionally company and industry, usually via our contact page.
• Communication data: the content of messages you send us, such as your goals and challenges.
• Technical and usage data: anonymous analytics such as approximate location, browser type and how you use the site.
• Marketing preferences: if you opt in to updates.

We do not collect special categories of data (such as health, race or political opinion) unless you volunteer it as part of a consultation.

We process data only where the law allows. The main purposes and legal bases are:

We use vetted processors to run the studio. We never sell your data. Current processors include:

• Web3Forms: securely routes contact-form messages to our inbox.
• Google Analytics: anonymised usage measurement.
• Calendly: optional discovery-call booking.
• Cloudflare and our web host: secure delivery of the site.

Each processor is bound by a data-processing agreement. Cookies from these tools are covered in our Cookie Policy.

Some processors operate outside the European Economic Area. Where data is transferred beyond the EEA, we rely on an adequacy decision or on Standard Contractual Clauses approved by the European Commission, together with additional safeguards where needed, so your data keeps EU-grade protection wherever it travels.

We keep data only as long as necessary:

You have eight rights over your personal data: access, rectification, erasure, restriction, portability, objection, protection from solely automated decision-making, and withdrawal of consent. The rights explorer at the top of this page drafts any request for you.

We respond within one month and never charge for a reasonable request. To exercise a right, email [email protected].

We apply appropriate technical and organisational measures: encryption in transit (TLS), access control on a need-to-know basis, data minimisation, reputable hosting, and regular review. No system is perfectly secure, but we take protecting your information seriously and review our safeguards regularly.

folkfox provides business-to-business services and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Any analytics we run is aggregated and anonymised and is not used to profile individuals.

If a personal data breach is likely to result in a risk to your rights, we will notify the Malta IDPC without undue delay and, where required, within 72 hours, and we will inform affected individuals where the risk is high.

We would always prefer to resolve a concern directly, so please contact us first. You also have the right to lodge a complaint with a supervisory authority:

• Malta: Information and Data Protection Commissioner (IDPC)
• Elsewhere in the EU: your national data protection authority, listed by the European Data Protection Board
• UK visitors: the Information Commissioner's Office (ICO)

We may update this Privacy Policy to reflect changes in how we work or in the law. The date at the top shows the latest revision, and we will flag material changes clearly. Questions? Email [email protected].