Niboo

Legal

Privacy Policy

Last updated: 17 July 2026

This Privacy Policy explains how Niboo ("Niboo", "we", "us" or "our") collects, uses, shares and protects your personal data when you visit niboo.mt (the "Site") and use our childcare directory and enquiry services (together, the "Services"). We are committed to protecting your privacy and handling your data in line with the EU General Data Protection Regulation (GDPR) and Malta's Data Protection Act.

1. Who we are

The data controller for personal data collected through the Site is Niboo, based in Malta. For any privacy-related questions or requests, contact us at [email protected].

2. What data we collect

We collect the following categories of personal data:

  • Enquiry details — when you submit a viewing request, call request, listing request or contact message, we collect your name, email address, phone number (if provided), your child's age (if provided), your preferred dates/times, and the content of your message.
  • Childcare provider details — for listed providers, we hold business contact details, addresses, and information about the setting.
  • Technical data — basic information your browser sends automatically, such as IP address, device and browser type, and pages visited, used to operate and secure the Site.
  • Cookies — a small number of strictly necessary cookies required for the Site to function (see section 8).

You may choose to provide limited information about a child (such as their age) to help a provider respond to your enquiry. Please share only what is necessary and do not include sensitive details.

3. How and why we use your data

  • To handle your enquiries — we forward your enquiry to the relevant childcare provider and send you a confirmation, so they can respond to you directly. Lawful basis: performance of a service you requested / our legitimate interest in operating the directory.
  • To operate and improve the Services — maintaining the directory, preventing abuse and spam, and improving the Site. Lawful basis: legitimate interests.
  • To communicate with you — responding to messages you send us. Lawful basis: legitimate interests / your consent.

4. Who we share your data with

  • Childcare providers — when you submit an enquiry about a specific provider, we share your enquiry details with that provider so they can contact you. Once shared, that provider processes your data as an independent controller under its own privacy practices.
  • Service providers (processors) — we use trusted third parties to run the Services, including MongoDB Atlas (database hosting), Postmark (transactional email delivery), and our cloud hosting and content-delivery providers. They process data only on our instructions.
  • Legal — we may disclose data where required by law or to protect our rights, users, or the public.

We do not sell your personal data.

5. International transfers

Some of our service providers may process data outside the European Economic Area. Where this happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses to protect your data.

6. How long we keep your data

We keep enquiry data for as long as needed to handle your request and for a reasonable period afterwards for record-keeping, dispute resolution and to prevent abuse, after which it is deleted or anonymised. Provider listings are kept for as long as the listing is active.

7. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you;
  • request correction of inaccurate data;
  • request erasure of your data;
  • restrict or object to certain processing;
  • request portability of data you provided to us;
  • withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email [email protected]. You also have the right to lodge a complaint with Malta's supervisory authority, the Office of the Information and Data Protection Commissioner (IDPC) (idpc.org.mt).

8. Cookies

We use only strictly necessary cookies required for the Site to work (for example, to maintain a secure admin session). We do not use advertising cookies. If we introduce analytics or other non-essential cookies in future, we will ask for your consent first.

9. Children's data

The Site is intended for use by parents, guardians and childcare professionals — not by children. We do not knowingly collect data directly from children. Any information about a child is provided by an adult submitting an enquiry.

10. Data security

We use reasonable technical and organisational measures — including encryption in transit and access controls — to protect your data. No method of transmission or storage is completely secure, but we work to safeguard your information.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date above shows when it was last revised. Material changes will be highlighted on the Site.

12. Contact us

Questions about this policy or your data? Email [email protected] or use our contact page.