WEBSITE PRIVACY STATEMENT
Effective Date 25/11/2025
1. Controller and Point of Contact
The International Institute for Justice and the Rule of Law (“IIJ”, “the Institute”) is the controller of personal data processed via the website https://www.theiij.org and any associated sub-domains.
- Postal address: Old Campus University, Valletta, Malta
- Single point of contact: info@theiij.org
2. Purposes of Processing
Personal data are processed solely to:
a) ensure the technical delivery and security of the website;
b) respond to communications submitted through contact forms or by e-mail;
c) administer event registrations and related logistics;
d) circulate newsletters to recipients who have provided prior consent; and
e) comply with legal or regulatory duties.
3. Categories of Data, Source, Legal Basis and Retention
Context: Server access
- Personal data processed: IP address, timestamp, requested URL, user-agent string
- GDPR legal basis: Legitimate interest (Art. 6(1)(f)) – operation & security of website
- Retention period: 12 months
Context: Contact enquiries
- Personal data processed: Name, e-mail address, organisation, message content
- GDPR legal basis: Consent (Art. 6(1)(a)) or steps prior to contract (Art. 6(1)(b))
- Retention period: 24 months after last correspondence
Data are anonymised or securely erased upon expiry.
4. Cookies and Similar Technologies
4.1 Strictly necessary (“essential”) cookies
The Institute deploys only one strictly necessary session cookie. Strictly necessary cookies are those without which the website cannot function properly (e.g., maintaining a secure session between pages). Pursuant to Directive 2002/58/EC and Article 5 of S.L. 586.01 (Maltese e-Privacy Regulations), such cookies do not require user consent, provided users are informed of their presence and purpose.
4.2 Informative Banner
On the first visit, visitors are shown the following notice:
“The IIJ website sets one essential cookie so the site can operate securely. No analytics or marketing cookies are used. See the Website Privacy Statement for details.”
5. International Transfers
Where service providers engaged by the Institute are established outside the European Economic Area, transfers occur only based on an adequacy decision or Standard Contractual Clauses in accordance with Chapter V GDPR.
6. Recipients of Data
Personal data are disclosed exclusively to:
- authorised Institute staff bound by confidentiality;
- service providers acting as processors under Article 28 GDPR (e.g., secure hosting company, event-management platform, bulk-email provider);
- competent authorities where disclosure is mandated by law.
Processors are contractually obliged to implement appropriate technical and organisational measures and may not process data for their own purposes.
7. Rights of Data Subjects
Data subjects may exercise the following rights at no cost: access, rectification, erasure, restriction, portability, and objection to processing. Where personal data is processed on the basis of consent, the data subject may withdraw such consent at any time. The withdrawal of consent shall not affect the lawfulness of processing before consent was withdrawn.
Requests shall be submitted to info@theiij.org. The Institute will respond within one month, extendable by two months where legally permissible. Complaints may be lodged with the Office of the Information and Data Protection Commissioner (IDPC), Malta.
8. Security Measures
The Institute applies through the Acronis package. Any personal data breach likely to result in risk to individuals will be notified to the IDPC within 72 hours and, where relevant, to affected data subjects without undue delay, in accordance with Articles 33–34 GDPR.
9. Updates
This Privacy Statement is reviewed annually and whenever material changes in processing activities or legal obligations arise. The “Effective Date” above will be amended accordingly.