Ocitygate Privacy Notice

Version 1.0.0 | Effective date 01 November 2026

Intended publication address: ocitygate.com/legal/privacy-notice

Draft for legal and operational review. Complete unresolved fields and verify operational statements before publication.

Who is responsible

Matthew Zahra, established in Malta, VAT registration number MT17229420, of 44, L Casolani Street, B'Kara BKR4536, Malta, operating Ocitygate is the controller for the account, enquiry, billing and other own-purpose information described below. Contact legal@ocitygate.com or write to the address above for privacy matters; support@ocitygate.com handles support and info@ocitygate.com general enquiries. No data protection officer is identified by this notice; if one is appointed or required, their contact must be added.

Our different roles

For accounting records processed to create and send a customer’s statements, we act on that customer’s documented instructions under ocitygate.com/legal/data-processing-agreement. The customer is normally the controller, or a processor acting with the relevant controller’s authority. Contact the business named on a statement for questions about its balances, recipients or use of your information. We will assist the responsible customer with rights requests where required. For our own account administration, invoicing, security and legal compliance, we are a controller. These roles are assessed by the actual activity, not simply by this notice.

Information and sources

Depending on your interaction, information may include names and business contact details; account and authorized-user identifiers; subscription and invoice records; correspondence and support information; acceptance and consent evidence; configuration necessary to operate schedules; and operational or security metadata necessary for the documented systems. We obtain it from you, your account administrator, people acting for you, communications you send, and the Service as used. Exact log fields and payment-provider data must be confirmed before publication. We do not claim that a particular payment method, analytics tool, cookie or tracking technology is in use. Do not supply passwords or accounting files through ordinary enquiry channels.

Purposes and lawful bases

We use an individual customer’s information to take requested pre-contract steps and perform their contract, where Article 6(1)(b) GDPR applies. For representatives of organizations, business communications, access administration, support and relationship management normally rely on legitimate interests in operating and supporting that relationship, subject to an assessment and the individual’s rights. Invoicing, tax and records required by applicable law rely on legal obligation where the relevant law requires processing. Proportionate fraud prevention, account security and legal claims may rely on legitimate interests in protecting people, systems and legal rights. A legal basis must be assessed for each purpose; signing terms does not supply blanket consent. Optional marketing or non-essential tracking, if introduced, requires a separate assessment, notice and any consent required by applicable law. Withdrawal of consent does not affect earlier lawful processing.

Required information

Identity, account contact and billing information reasonably needed to establish and administer a subscription may be contractually necessary, and some invoicing information may be required by law. Without necessary information we may be unable to create the account, supply the requested Service or issue a compliant invoice. Optional information must be identified as optional at collection. We will identify any specific statutory collection requirement that applies.

Statement data and access boundaries

Customers authorize read-only Sage 50 ODBC access to COMPANY, SALES_LEDGER and AUDIT_HEADER and/or Sage Evolution SQL Server access to Entities, Client and PostAR. Only the information needed for the authorized run may be processed. Depending on the selected records, this may include customer or debtor names, contact and account details, transaction dates, references, descriptions, balances and statement recipients. These are potential data categories, not a claim that every field is retrieved. Customer instructions determine the actual fields. Sensitive information should not be included in free-text descriptions where unnecessary.

Hosting disclosures and international transfers

The cloud Service is hosted in Malta in the Ocitygate LAN datacenter. Authorized personnel may access information only for legitimate functions under confidentiality obligations. Information may be disclosed to specifically identified service providers where necessary for payment, communications, infrastructure or professional advice, and to authorities where lawfully required. The actual provider inventory and relevant locations must be completed before publication; no provider is implied by these categories. Statements are sent to recipients selected by the customer. Providers acting on our behalf require appropriate contracts and, for processor services, subprocessor authorization. Malta hosting does not prevent a transfer through foreign support, email routing or customer-selected recipients. Where we make a restricted transfer outside the EEA, we must identify the destination and lawful mechanism, such as an applicable adequacy decision or approved safeguards, and provide information about obtaining safeguards through legal@ocitygate.com. This draft does not assert that such transfers currently occur or that none occur.

Retention

Statement-run accounting payloads, generated statement copies and temporary payload artifacts under our control are deleted immediately at the end of the run, including cancellation or final failure, under the DPA. Payloads must not be copied into durable logs or backups. Copies delivered to the customer or recipients are controlled by them. Other records have separate purposes: account and configuration records are kept while needed for the active relationship and a documented closure period; invoices and tax records for the applicable statutory period; support records until resolved and for a justified documented follow-up period; security metadata for a proportionate documented detection and investigation period; and acceptance or dispute evidence for applicable claim and legal periods. Precise periods, triggering events and relevant legal requirements are [COMPLETE RETENTION SCHEDULE BEFORE PUBLICATION]. We do not keep these records indefinitely merely because no period has yet been chosen. Credentials must be revoked or deleted when no longer necessary, with their location and lifecycle documented separately.

Security

We must apply technical and organizational measures appropriate to the risks and our legal obligations. No particular certification, encryption protocol, credential storage technique or guarantee of absolute security is asserted here. The processor security schedule must describe the verified measures used. Report suspected issues to legal@ocitygate.com, avoiding secrets in the report. Security notifications follow applicable law and the DPA; this notice does not shift our legal duties to customers.

Your rights

Subject to the relevant conditions and exceptions, you may request access, correction, deletion, restriction or portability of your personal data and object to processing based on legitimate interests. You may object at any time to use for direct marketing. Where processing relies on consent, you may withdraw it at any time. Contact legal@ocitygate.com; we may request proportionate identity evidence. We will respond within the applicable GDPR period, ordinarily one month, and explain any lawful extension. Rights do not always require deletion of information that must lawfully be retained. If your request concerns a customer’s statement processing, we will refer it to that customer as appropriate rather than independently alter their accounting records.

Complaints

You may complain to the Information and Data Protection Commissioner in Malta through idpc.org.mt, or another supervisory authority competent under applicable law. You do not have to exhaust our complaint process before contacting an authority. We welcome the opportunity to investigate a concern through legal@ocitygate.com.

Cookies automated decisions and updates

A verified cookie and tracking inventory is required before publication. Add a separate cookie notice and consent controls if the actual website requires them; this text is not evidence that a banner exists or that the website uses only essential cookies. Confirm before publication whether any own-purpose processing involves solely automated decisions with legal or similarly significant effects; if so, provide the required logic, consequence and safeguard information. Producing and sending a scheduled statement does not itself establish such decision-making. Material changes to this notice will be dated and appropriately brought to affected people’s attention. Changes to a privacy notice do not retrospectively create a legal basis.