Privacy policy
What we collect, why, and for how long.
Last updated: 2 November 2026
Who is responsible
Amano is a free online directory that helps people in Malta find independent service providers and contact them directly. It is run by Gandasoft, which is the controller of your personal data.
Contact and privacy requests: gandasoft@zohomail.com.
We have not appointed a data protection officer, because the law does not require one for what we do.
Whose data we process
Providers who create an account and a profile; people a provider lists as team members; visitors who browse, contact a provider, write a review, report content or send a suggestion; and people who may appear in photos that providers upload.
What we process, why, and for how long
| Why | What | Legal basis (GDPR Article 6) | How long |
|---|---|---|---|
| Create and run a provider account | First and last name, email, optional mobile number, password (stored only as a hash), sign-in dates, accepted terms version | Contract, 6(1)(b) | Until you delete the account. A sign-up that is never confirmed goes after 24 hours. |
| Publish a provider profile | Display name, phone, WhatsApp choice, contact email, photos, description, prices, areas, hours, languages | Contract, 6(1)(b) | Until you remove it or delete the account |
| Show team members on a profile | Name, role and optional photo of each person the provider lists, after the provider confirms they agreed | Legitimate interests of the provider and of Amano, 6(1)(f) | Until the provider removes them, or on that person’s request |
| Review photos before they appear | The photo and the reviewer’s decision | Legitimate interests, 6(1)(f): a safe and lawful site. Legal obligations on illegal content, 6(1)(c) | Rejected photos are deleted after 7 days |
| Show providers how their profile performs | Counts of profile views and contact clicks, with no IP address | Legitimate interests, 6(1)(f): useful statistics for providers | Linked to the profile for 13 months, then anonymised |
| Keep the site safe and limit abuse | A keyed hash of your IP address that changes every day. For bot checks, your IP address and browser and connection details, processed by our security provider | Legitimate interests, 6(1)(f): security | Rate limits: in memory for up to 2 days. Bot checks: kept by the security provider only as long as it needs to answer the check |
| Show the bank details for voluntary contributions | Nothing you type. When you press “Show Bank Details”, the bot check processes your IP address and browser and connection details, through our security provider. We keep no record that you looked, and the check’s token is used once and discarded | Legitimate interests, 6(1)(f): keeping the bank details away from automated harvesting and abuse | The daily IP hash used to limit repeated requests stays in memory for up to 2 days. Bot checks: kept by the security provider only as long as it needs to answer the check |
| Receive voluntary contributions | If you send a transfer: your name, account number (IBAN), amount, date and payment reference, as the banks pass them on. We use them only to account for the contribution and to return it if it was sent by mistake | Legal obligation, 6(1)(c): tax and accounting records. Legitimate interests, 6(1)(f): returning mistaken payments | As long as tax and accounting rules require, and no longer |
| Reviews | Stars and review text (public once approved). Private details for low ratings: what happened, date, area, service type. The daily IP hash and fraud signals. Without an invitation: your email, until the review is checked | Legitimate interests, 6(1)(f): reliable reviews customers can trust | The review, while the profile exists. Email: deleted when the review is checked. IP hash and signals: 90 days after the check. Rejected reviews: 90 days. Unconfirmed reviews: 24 hours |
| Review links | A hash of the link, its expiry, and the provider’s daily IP hash when it was made. Held in server memory only, never stored | Legitimate interests, 6(1)(f): preventing fake reviews | Valid for 24 hours, forgotten at most 7 days later or when the server restarts |
| Handle reports of illegal or harmful content | Your report, your email if you give it, the daily IP hash | Legal obligation, 6(1)(c) (Digital Services Act), and legitimate interests, 6(1)(f) | 24 months after the report is closed |
| Read suggestions | Your message, your email if you give it | Legitimate interests, 6(1)(f): improving the site | 24 months |
| Send service emails | Your email address and the message, such as confirmations, notices and moderation decisions. We send no marketing. | Contract, 6(1)(b), and legal obligation, 6(1)(c), for moderation decisions | Delivery record for 30 days. The message text is erased once sent. |
| Keep a record of administrative actions | The administrator, the action, its target and the reason given | Legitimate interests, 6(1)(f): accountability | 24 months |
| Preserve evidence of suspected crime | The material and its context, only when the law requires it | Legal obligation, 6(1)(c) | As long as the law or the authorities require |
Required and optional details
Providers must give their name, email and password to have an account, and a phone number to publish a profile, because customers need a way to reach them. The mobile number at sign-up and everything marked optional can be left out.
Visitors can browse without giving us anything. An email on a report or suggestion is only used to reply and to tell you our decision.
Your location
“Use my location” asks your browser for your position, and only after you press it. It is compared with a list of areas in your browser. Coordinates are never sent to us or stored.
Automated decisions
We make no decisions about you based only on automated processing. Every photo is held until a person on our team reviews it, and only a person can suspend an account, for example after repeated rejected photos.
You are told about every decision and its reason. You can ask us to look at it again, give your view and contest it, by writing to the address above.
Who receives your data
| Who | Role | Where |
|---|---|---|
| Everyone on the internet | Published profiles and approved reviews are public, including anything you choose to show | Worldwide |
| Our server hosting provider | Runs the site and its database, as our processor | Canada, which the European Commission recognises as giving adequate protection (Decision 2002/2/EC) |
| Our storage and security provider | Stores photos, and runs bot checks on sign-up, reviews, revealing contact details and showing the bank details for contributions, as our processor. It also uses the bot-check signals, as a controller in its own right, to improve its bot detection | Photos: European Union. Bot checks: may involve processing outside the EU |
| Our bank and yours | Carry out a contribution you choose to send, as controllers in their own right under banking law | Within the SEPA area |
| Our email provider | Sends and receives email, as our processor | May involve processing outside the EU |
| Public authorities | Only when the law requires it | Malta or the EU |
Each provider is bound by a data processing agreement with us. We do not sell personal data or use it for advertising. When you contact a provider by phone, WhatsApp or email you leave Amano, and that communication is between you and the provider, under the terms of the app you use.
You can ask us at gandasoft@zohomail.com for the name of any provider listed here.
Transfers outside the EU
Where a provider listed above processes data outside the European Economic Area, the transfer is covered by an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or by the Commission’s Standard Contractual Clauses. You can ask us for a copy of the safeguard.
Your rights
You can ask to access, correct, delete, restrict or receive a copy of your data, and object to processing based on legitimate interests, including the publication of a review you wrote. Where processing relies on consent, you can withdraw it at any time, which does not affect what happened before.
Providers can export and delete their data, and change most details, from Settings and Edit profile. For everything else, including changing the name given at sign-up, write to gandasoft@zohomail.com. We answer within one month, which can be extended by two months for complex requests, and we may need to confirm who you are.
If a provider shows your name or photo, for example as a team member or in a photo of a job, and you did not agree, write to us or use “Report image”, and we will remove it.
You can complain to Malta’s data protection authority, the Information and Data Protection Commissioner (IDPC), at idpc.org.mt, or to the authority in the EU country where you live or work.
Children
Provider accounts are for people aged 18 or over. Amano is not aimed at children.
Security
Passwords are hashed, tokens are stored only as hashes, IP addresses are never stored in clear, connections are encrypted, and administrators sign in with a second factor. If a breach is likely to put your rights at high risk, we will tell you without undue delay.
Changes
We publish any change here and update the date above. If a change matters to you, we will tell providers by email.