Legal

Privacy Policy.

Last updated: 6 August 2026

This policy explains how Tulkas Technologies Limited handles personal data submitted through this website. We keep it short and specific, because there is not much to say: we collect little, we keep it briefly, and we do not sell or trade it.

01 // Who we are

The data controller is:

Tulkas Technologies Limited
Company registration number C 116672
Block C8, Skyway Offices, 179 Triq Marina, Tal-Pietà PTA 9042, Malta

For any question about this policy or about your personal data, contact us at privacy@tulkas.mt.

We have not appointed a Data Protection Officer. Our processing is small in scale and does not involve large-scale monitoring or large-scale processing of special categories of data, so this is not required under Article 37 GDPR.

02 // What we collect

Only what you send us through the contact form:

Your name and email address.
The subject you select, and the content of your message.
If you are sending a speculative application, the CV file you choose to attach.

We do not use tracking cookies, advertising cookies, or third-party analytics that profile you. Our hosting provider records standard server logs, including IP addresses, for security and to keep the site running.

Please do not send sensitive details

A CV does not need to contain your photograph, date of birth, marital status, health information, religion, political views, or similar. Please leave these out. If you include them, we will not use them in our assessment.

03 // Why we process it, and on what basis

To answer your enquiry. Legal basis: our legitimate interest in responding to people who contact us (Article 6(1)(f)).
To review a speculative application. Legal basis: steps taken at your request prior to a possible employment relationship (Article 6(1)(b)). We ask you to confirm you have read this notice before sending a CV; that confirmation records that we gave you this information, and is not itself the basis for the processing.
To keep the site secure. Legal basis: our legitimate interest in protecting our systems (Article 6(1)(f)).

Where we do rely on your consent — for keeping your details on file or passing them on, as described in section 04 — you can withdraw it at any time. Withdrawing it does not affect processing that already took place.

04 // Speculative applications and CVs

This is the part worth reading carefully, because our approach is deliberately restrictive.

We do not build a CV database. When you send us a CV, we hold it only for as long as it takes to review it. After the review there are two outcomes:

We would like to take it further. We will ask you, separately and explicitly, for your consent before we keep your details on file or pass them on. Nothing is forwarded or stored beyond the review without you agreeing to it first.

We will not be taking it further. We tell you, and we delete your CV and the details you sent.

If you give consent for us to take things further, your details may be passed to a recruitment partner acting on our behalf, or entered into the applicant tracking system used within our group, so that a formal recruitment process can begin. We will tell you which applies at the time, and that organisation's own retention terms will then also apply.

05 // Who else sees your data

We keep this list short:

Our hosting and IT providers, who process data on our instructions in order to run the website and our internal systems.
Companies within our group, established in the EU/EEA, and recruitment partners acting on our behalf — but for applications, only after you have given the separate consent described in section 04.
Authorities, where we are legally required to disclose information.

We do not sell your personal data, and we do not use it for advertising.

Your data is processed within the European Union and the European Economic Area. Where a provider processes data outside the EEA, we rely on an adequacy decision or on Standard Contractual Clauses approved by the European Commission.

06 // How long we keep it

Speculative applications and CVs: only for the duration of our review, and no longer than 30 days after we tell you our decision — unless you have given separate consent for us to keep them.
Partner and general enquiries: for as long as needed to deal with the enquiry, and afterwards only where we have a legal or business reason to retain the correspondence.
Server logs: for a short period, for security purposes.

07 // How we protect it

We apply appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, and we limit access to those who need it for the purposes described above. Security is treated as part of how we build and operate our systems.

08 // Your rights

Under the GDPR and the Maltese Data Protection Act (Cap. 586), you have the right to:

Ask what personal data we hold about you, and get a copy of it.
Have inaccurate data corrected.
Have your data deleted.
Ask us to restrict how we use it, or object to our use of it.
Receive the data you gave us in a portable format.
Withdraw consent at any time.

Write to privacy@tulkas.mt and we will respond within one month. There is no charge for making a request.

We do not make automated decisions about you, and we do not profile you.

09 // Complaints

If you believe we have handled your data improperly, please tell us first so we can put it right. You also have the right to lodge a complaint with the Maltese supervisory authority:

Office of the Information and Data Protection Commissioner (IDPC)
Floor 2, Airways House, High Street, Sliema SLM 1549, Malta
idpc.org.mt

10 // Changes to this policy

If we change how we handle personal data, we will update this page and change the date at the top. Where the change is significant and we hold your contact details, we will tell you directly.

This policy describes our current practice. It is written in plain language rather than legal boilerplate, on purpose. If anything here is unclear, ask us and we will explain it.