Privacy / KMC
Privacy notice
Last updated: October 30, 2026
1. Who we are
This website (kmgtcon.com) is run by KMC Ltd (“KMC”), a management consultancy registered in Malta under company number C100984, with its registered address at Level 3 (Suite No. 2940), Tower Business Centre, Tower Street, Swatar, Birkirkara BKR4013, Malta.
KMC is the “controller” of the personal data described in this notice, which means we decide how and why it is used. For any privacy question or request, email admin@kmgtcon.com or write to us at the address above.
2. What this notice covers
This notice explains what personal data we collect when you visit our website, contact us, or subscribe to our newsletter, Find Your Exits; why we collect it; who else handles it; how long we keep it; and your rights under the EU General Data Protection Regulation (GDPR).
If you become a client, your engagement letter will explain how we handle the information you share with us during the work itself.
3. Information we collect
When you use our contact form: your name, email address, organization (if you give one), the service you’re asking about, the places and dates you mention, your message, and how you’d like us to follow up.
When you email us or speak with us: your contact details and whatever you choose to tell us about your plans.
When you subscribe to Find Your Exits: your email address and subscription details. Substack runs the newsletter and collects these on its own pages (see section 7).
When you visit the website: our hosting provider, Netlify, records standard technical information in its server logs, such as your IP address, browser type, the pages you request and the time of each request. We use this only to keep the site running and secure.
4. Cookies and analytics
Our website sets no cookies and stores nothing on your device. It runs no analytics, advertising or tracking tools, and our fonts are served from our own site, so loading a page doesn’t send your details to anyone except our hosting provider.
Links to Substack take you to Substack’s own website, which has its own cookie policy.
If we add analytics in the future, we’ll choose a tool that doesn’t use cookies or identify you, and we’ll update this notice first. If we ever use a tool that needs cookies, we’ll ask for your consent before it runs.
5. Why we use it and our legal basis
The GDPR allows us to use personal data only where we have a legal basis. Ours are:
| What we do | Legal basis (GDPR Article 6) |
|---|---|
| Reply to your request, arrange a discovery call and prepare a proposal | Steps you ask us to take before a contract (6(1)(b)); for requests made on behalf of an organization, our legitimate interest in answering business inquiries (6(1)(f)) |
| Deliver the services you buy from us | Performance of our contract with you (6(1)(b)) |
| Keep invoices and business records | Our legal obligations under tax and accounting law (6(1)(c)) |
| Send you Find Your Exits | Your consent, given when you subscribe (6(1)(a)); you can unsubscribe at any time |
| Keep the website running and protect it from abuse | Our legitimate interest in a secure, working website (6(1)(f)) |
We never sell your data, use it for advertising, or make automated decisions about you.
We won’t add you to the newsletter because you used the contact form. If you’d like it, subscribe on Substack.
6. Sensitive information
Please don’t send us passport or ID numbers, exact routes, home addresses, health details or other sensitive information through the contact form or by ordinary email.
Some of our work does need sensitive details, such as a medical condition that affects a travel plan or the security arrangements for a family. When it does, we’ll explain why we need them, ask for your explicit consent where the law requires it (GDPR Article 9(2)(a)), and agree a secure way for you to share them. We keep such details only for as long as the work requires.
7. Who we share it with
We use a small number of service providers. Each one handles your data only to provide its service to us, under a written data processing agreement.
| Provider | What it does for us | Where |
|---|---|---|
| Netlify, Inc. | Hosts the website, receives contact form submissions and forwards them to us | United States |
| Runbox Solutions AS | Hosts our @kmgtcon.com email | Norway (European Economic Area) |
| Substack, Inc. | Runs the Find Your Exits newsletter | United States |
Substack collects your details on its own pages and also handles them under its own privacy policy, which you’ll see when you subscribe.
We may also share information with our professional advisors (such as lawyers and accountants) under a duty of confidentiality, or with public authorities when the law requires it. When you become a client, we share only what’s needed with the local partners involved in your work, and only with your agreement.
Transfers outside Europe. Netlify and Substack are based in the United States. Netlify is certified under the EU-U.S. Data Privacy Framework and, where that doesn’t apply, uses the European Commission’s Standard Contractual Clauses. Substack protects transfers with the safeguards described in its own privacy policy. You can ask us for details of these safeguards.
8. How long we keep it
| Information | How long |
|---|---|
| Contact form copies held by Netlify | Deleted within 30 days of reaching our inbox |
| Inquiries that don’t lead to work | 12 months from our last contact, then deleted |
| Client files and correspondence | For the length of the engagement and 6 years afterward |
| Invoices and accounting records | 10 years from the last entry, as Malta’s Companies Act requires |
| Newsletter subscription | Until you unsubscribe |
| Website server logs (Netlify) | For Netlify’s standard log period, then deleted by Netlify |
9. How we protect it
Our email is hosted in Norway. Only the two KMC partners can read contact requests. We share sensitive details only through channels we agree with you in advance, and we delete what we no longer need.
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- correct anything inaccurate or incomplete;
- delete your data, where we no longer have a reason to keep it;
- restrict how we use it while a question about it is resolved;
- object to our use of it where we rely on our legitimate interests;
- take it with you (data portability), where we hold it on the basis of consent or a contract;
- withdraw your consent at any time, where we rely on consent, for example by unsubscribing from the newsletter.
To use any of these rights, email admin@kmgtcon.com. We’ll reply within one month, and we don’t charge for this. We may ask you to confirm your identity first.
11. Complaints
If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You also have the right to complain to a data protection supervisory authority. Ours is the Information and Data Protection Commissioner (IDPC) in Malta, and you can also contact the authority in the EU country where you live or work.
12. Changes to this notice
We’ll update this notice when our services or providers change, and show the date of the latest version at the top. If a change affects how we use data you’ve already given us, we’ll tell you directly.
13. Contact
KMC Ltd
Level 3 (Suite No. 2940), Tower Business Centre
Tower Street, Swatar
Birkirkara BKR4013, Malta
Company number C100984
Email: admin@kmgtcon.com