Privacy Policy 

1. Introduction

MCCL Transport ("we," "us," or "our") provides dedicated school transport services. We are committed to protecting the privacy and personal data of students, parents, and guardians. This policy outlines how we handle personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Data Protection Act (Cap. 586 of the Laws of Malta).

2. Data Controller

MCCL Transport is the Data Controller for your information.

• Email: [email protected]

3. Information We Collect

We collect only the data necessary to provide safe and efficient transport services, including:

• Parent/Guardian Information: Name, contact number, email address, home address, and ID number (specifically for verification within government funded transport schemes).

• Student Information: Name, school attended, and designated pick-up/drop-off points.

• Sensitive Data: Relevant medical information (e.g., allergies or mobility requirements) only if explicitly provided by the parent/guardian to ensure the student's safety during transit.

• Visual/Technical Data: CCTV footage (if the vehicle is equipped with security cameras) and GPS location data for fleet management and arrival estimates.

4. Legal Basis for Processing

We process your data under the following legal grounds:

1. Performance of a Contract: To fulfill our agreement to transport the student.

2. Legal Obligation: To comply with Transport Malta regulations and health and safety requirements.

3. Vital Interests: To protect a student’s safety in the event of a medical emergency.

4. Legitimate Interests: To ensure the security of our vehicles, staff, and passengers through monitoring and logging.

5. Data Sharing

We do not sell or trade your personal data. We share information only with:

• Ministry for Education / Transport Malta: To facilitate and verify the "Free School Transport" scheme.

• Emergency Services: In the event of an accident or medical crisis.

• Authorized Service Providers: GDPR-compliant IT or software providers used for route optimization or parent communication.

6. Retention of Data

• Operational Data: Retained for the duration of the scholastic year.

• Financial Records: Retained for 10 years to comply with Maltese tax and VAT legislation.

• CCTV Footage: Typically overwritten within 7–30 days, unless required for an ongoing investigation or legal claim.

7. Your Rights

Under GDPR, you have the following rights regarding your data:

• Access: Request a copy of the data we hold.

• Rectification: Correct any inaccurate or outdated information.

• Erasure: Request the deletion of data (where no legal retention obligation exists).

• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

To exercise these rights, please contact us at [email protected].

8. Security

We implement high standard technical and organizational security measures to protect your data. Digital files are password protected and encrypted, while physical manifests are stored securely and only accessible to authorized personnel.