Privacy Policy

Last updated: January 2026. BCRS Malta Ltd (“BCRS”, “we”, “us”) is the data controller for personal data processed through this website and in connection with the Beverage Container Refund Scheme.

1. What data we collect

Depending on how you interact with us, we may collect:

• Contact and enquiry data — name, email address, phone number and message content when you contact us or subscribe to updates.
• Registration data — business name, contact and product details provided by producers, importers, distributors, retailers and establishments participating in the Scheme.
• Technical data — limited information collected automatically, such as essential cookie data needed for the site to function (see our Cookie Policy).

2. Why we use your data & lawful basis

We process personal data to: respond to enquiries; administer Scheme registration and participation; operate deposit and refund processes; send updates you have requested; and meet our legal and regulatory obligations. Our lawful bases are, as applicable, your consent, performance of a contract, compliance with a legal obligation, and our legitimate interests in operating the Scheme.

3. Sharing your data

We do not sell your personal data. We may share it with trusted service providers who help us run the website, member portal and secure payment processing, and with public authorities where required by law. Any such providers act under appropriate data-protection safeguards.

4. Data retention

We keep personal data only for as long as necessary for the purposes described above, or as required to meet legal, accounting or regulatory requirements. When data is no longer needed, it is securely deleted or anonymised.

5. Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or misuse. Payment information is handled by our PCI-compliant payment provider and is not stored on this website.

6. Your rights

Under the GDPR you have the right to access your data; to have inaccurate data corrected; to request erasure or restriction; to object to certain processing; to data portability; and to withdraw consent at any time. You also have the right to lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC) in Malta.

7. Data Protection Officer

To exercise your rights or ask any data-protection question, contact our Data Protection Officer at info@bcrsmalta.mt, or by post at: The Data Protection Officer, BCRS Malta Ltd, Clearing Centre, HHF 406, Ħal Far Industrial Estate, Birżebbuġa, Malta. See our DPO contact page for more.

8. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always published on this page.

9. Governing law

This policy is governed by the laws of Malta and applicable EU data-protection law.