Liaco LimitedPrivacy Notice
Last updated: 8 September 2026
Liaco Limited (“Liaco”, “we”, “us”) is a vehicle importer and dealership in Malta, established in Ħal Lija. We sell new vehicles as an authorised distributor and approved used vehicles, and we operate this website, liaco.eu, including its Used Vehicles section. This notice explains what personal data we collect about you, why we collect it, who we share it with, and the rights you have over it.
We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and the Data Protection Act, Chapter 586 of the Laws of Malta.
1. Who we are
The data controller is:
Lia Buildings, Triq il-Mosta, Ħal Lija LJA 9012, Malta
Company registration number C9805 · VAT number MT11083115
Telephone: 2141 8111 · Email: dataprotection@liaco.eu
Please address any data protection query to our data protection contact at the email address above.
2. What we collect and why
Enquiries
When you enquire about a vehicle, a price or a service — by telephone, email, WhatsApp or through a contact button on this website — we collect your name, email address and telephone number so that we can reply to you and follow up on your enquiry.
Sharing a vehicle with someone else
The Used Vehicles section lets you email a vehicle listing to another person. We use the name and email address you enter only to send that one message. We do not add either address to any marketing list.
Test drives
When you book a test drive we collect your name, contact details and preferred date. Before the vehicle is handed to you we take a copy of your driving licence, which we retain only for as long as a traffic, parking or other motoring offence arising from the drive could still be notified to us.
Service and warranty bookings
To arrange a service, VRT or warranty booking we collect your name, contact details and vehicle details including the registration and chassis numbers. If you have previously purchased or serviced a vehicle with us, our aftersales system holds your service and VRT due dates and we send you reminders on the basis of our legitimate interest in keeping your vehicle roadworthy. You can object to these reminders at any time.
Vehicle purchase
If you buy a vehicle from us we collect your full name, address, contact details, date of birth, identity document and driving licence details, payment details, details of the vehicle purchased and, where applicable, details of any vehicle you part-exchange. For a new vehicle we are contractually and legally required to pass registration, warranty and safety-recall data to the vehicle manufacturer. For any vehicle we process the data Transport Malta requires to register or transfer it into your name.
Part-exchange valuations and vehicles we buy from you
If you ask us to value your current vehicle, or offer to sell it to us, we collect its registration number, mileage, condition details and photographs, together with your name and contact details. We usually take a copy of the vehicle logbook (registration certificate), which records the registered keeper. We use this information to prepare a valuation, to check the vehicle's history and status with Transport Malta, and, if we buy the vehicle, to complete the transfer of ownership and pay you. Where we compare your vehicle against the market, we use publicly advertised prices and industry valuation sources; we do not send your personal details to those sources.
Vehicle finance
If you ask us to arrange finance, our finance partner will require additional information which may include your employment and income details, address history and proof of address. With your permission we pass this to the finance partner you select. Once a finance agreement is entered into, the finance company becomes an independent data controller and its own privacy notice applies.
Government grant applications
Where your purchase involves an electric vehicle grant or scrappage scheme, we process the identity, vehicle and eligibility data required by the responsible Maltese authority in order to submit the application on your behalf.
Visiting our premises
CCTV operates at our premises in Ħal Lija for the security of people and property. Your image and vehicle registration may be recorded. Footage is deleted after 7 days. Where a specific recording is relevant to an investigation, we may extract that recording and retain it until the investigation concludes.
Website use
Our web server records technical data including browser type and version, operating system, referring website, pages visited, date and time of access, IP address and internet service provider. We also use cookies and similar technologies, described in our Cookie Policy.
Where you have consented to advertising cookies, and you tap a WhatsApp, telephone or email button on a vehicle page, we record that action — together with the vehicle you were viewing — and pass it to Meta and Google so that we can measure whether our advertising is working. This includes a copy sent from our server to Meta, so that the same action is not counted twice. We do not send your name, telephone number or email address in these records. If you have not consented to advertising cookies, no such record is sent.
Marketing
Where you have given consent, we contact you by email, SMS, telephone, post or through social media platforms with offers and information about our products and services. If you have bought a vehicle or service from us, we may also contact you about similar products on the basis of our legitimate interest, and every such message carries an opt-out. You can withdraw consent or opt out at any time. We ask you to confirm your marketing preferences periodically so that our list stays current.
3. Our legal bases
| Purpose | Legal basis (GDPR Article 6) |
|---|---|
| Responding to enquiries, valuing or buying your vehicle, arranging test drives, selling and servicing vehicles | Performance of a contract, or steps taken at your request before entering a contract — Art. 6(1)(b) |
| Marketing communications to prospective customers | Consent — Art. 6(1)(a) |
| Marketing similar products to existing customers | Legitimate interests, with an opt-out in every message — Art. 6(1)(f) |
| Non-essential cookies, website analytics and advertising measurement | Consent — Art. 6(1)(a) |
| Service and VRT reminders, CCTV security, fraud prevention, network security | Legitimate interests — Art. 6(1)(f) |
| Safety recalls and urgent product notices | Legal obligation and vital interests — Art. 6(1)(c) and 6(1)(d) |
| Vehicle registration and transfer, tax, VAT and accounting records, grant applications | Legal obligation — Art. 6(1)(c) |
Where we rely on legitimate interests, you have the right to object. See section 9.
4. Cookies
Non-essential cookies are set only after you consent through the cookie banner. You can change or withdraw your choices at any time using the Cookie Settings link at the foot of any page. A full list is in our Cookie Policy.
5. Messaging us on WhatsApp
Many of our customers reach us on WhatsApp, and we publish a WhatsApp number for sales, used-vehicle, aftersales and parts enquiries: +356 7941 8111. Because we use it heavily, this section sets out separately what happens to your data when you message us there.
What we receive
When you message us we receive your WhatsApp phone number, your profile name and picture if you have set one, the content of your messages, and any photographs or documents you send. We also see the time of each message and its delivery and read status.
WhatsApp's own role
WhatsApp is operated by Meta. Meta processes your account details and the metadata associated with your messages under its own terms and privacy arrangements, as an independent controller, and we have no control over that processing. Meta's privacy policy is published at whatsapp.com/legal/privacy-policy. Where we use a third-party messaging platform to manage business conversations, that provider processes messages on our written instructions and only for the purposes we specify.
What we do with the conversation
Once we receive your message we are the controller for what we do with it. We use it to answer your enquiry, arrange viewings, test drives, valuations, service bookings and deliveries, and to keep a record of what was discussed and agreed. Our WhatsApp number is a shared business line, so your messages may be seen by colleagues across sales, aftersales and parts, so that whoever can help you fastest is able to reply.
Legal basis
Steps taken at your request before entering into a contract, or performance of a contract — Art. 6(1)(b). Where you are an existing customer and we are replying about your vehicle, our legitimate interests in supporting the vehicles we have supplied — Art. 6(1)(f).
How long we keep it
WhatsApp conversations are retained in line with section 8. An enquiry that does not lead to a sale is kept for 24 months from last contact. A conversation that forms part of a sale, purchase, finance or service record is kept with that record.
Points worth knowing
- Please do not send us more personal information than we have asked for. Where we need an identity document, driving licence or logbook, we will tell you exactly what is required.
- If you would rather not use WhatsApp, telephone or email us using the details in section 10. We will handle your enquiry in exactly the same way.
- Messaging us does not sign you up to marketing. We send marketing messages on WhatsApp only where you have agreed to receive them, and you can stop them at any time by replying to say so.
- Our WhatsApp number is not monitored around the clock. For anything urgent, or any matter concerning the safety of your vehicle, please telephone us.
6. Who we share your data with
We share the minimum personal data necessary, and only with the following categories of recipient:
- The vehicle manufacturer and its European distribution network — vehicle registration, warranty and safety-recall data where you have purchased a new vehicle.
- Finance and insurance providers — where you ask us to arrange finance or insurance, and only with your permission. Once an agreement is in place, that provider becomes an independent data controller and its own privacy notice applies.
- Maltese public authorities — Transport Malta for vehicle registration, transfer and licensing; the Commissioner for Revenue and Customs for taxation and import duty; grant-administering bodies; or where we are otherwise legally obliged.
- Law enforcement — where records or CCTV footage are lawfully requested. We keep a record of every such disclosure.
- Our technology and business service providers, who process data on our written instructions and only for the purposes we specify. These cover customer relationship management, accounting and business systems, email and file storage, telephone and messaging services, website hosting, website analytics and advertising platforms.
- Our professional advisers — auditors, accountants and lawyers, where necessary.
We do not sell your personal data. If you would like the specific identity of any provider we use, contact us at the address in section 10 and we will tell you.
7. Transfers outside the EEA
Most of our providers process data within the European Economic Area. Where personal data is transferred outside it, we rely on the following safeguards:
- Japan — vehicle, warranty and safety-recall data shared with the vehicle manufacturer. Japan is covered by a European Commission adequacy decision.
- United States — certain analytics, advertising and productivity providers. Where the provider is certified under the EU–US Data Privacy Framework, we rely on that certification. Otherwise we rely on the European Commission's Standard Contractual Clauses together with a transfer impact assessment.
You may request details of the safeguards applying to any particular transfer by contacting us at the address in section 10.
8. How long we keep your data
| Data | Retention period |
|---|---|
| Enquiries and valuations that do not lead to a sale or purchase | 24 months from last contact |
| Driving licence copies taken for test drives | Until the period for notifying a motoring offence has passed |
| Customer, sale, vehicle purchase, finance and aftersales records | 10 years from the end of the contract, covering statutory accounting and tax retention obligations |
| Vehicle identification, ownership and safety-recall records | For the working life of the vehicle, so that safety recalls can be carried out |
| Marketing contact details and consent records | Until you withdraw consent or opt out, plus a record of that withdrawal |
| CCTV footage | 7 days, or until an investigation concludes where a specific recording has been extracted |
9. Your rights
- Access — obtain a copy of the personal data we hold about you, including CCTV footage in which you appear, with other individuals obscured.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — ask us to delete your data, where no legal reason to keep it applies.
- Restriction — ask us to limit how we use your data while a dispute or objection is resolved.
- Data portability — receive the data you gave us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
- Object — object to processing based on our legitimate interests, and object at any time to direct marketing.
- Withdraw consent — at any time. Withdrawal does not affect processing carried out before you withdrew.
- Not be subject to solely automated decision-making producing legal or similarly significant effects.
To exercise any of these rights, contact us using the details in section 10. We may ask you to confirm your identity. We will respond within one month, extendable by two further months for complex requests, in which case we will tell you within the first month.
10. Contact us
Lia Buildings, Triq il-Mosta, Ħal Lija LJA 9012, Malta
Company registration number C9805 · VAT number MT11083115
Telephone: 2141 8111 · Email: dataprotection@liaco.eu
Please mark postal correspondence for the attention of the data protection contact.
11. Complaints
If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with Malta's supervisory authority:
Floor 2, Airways House, Triq il-Kbira, Tas-Sliema SLM 1549, Malta
Telephone: +356 2328 7100 · Email: idpc.info@idpc.org.mt · Website: idpc.org.mt
You may also seek a judicial remedy. We would ask you to raise the matter with us first so that we have the chance to put it right.
12. Changes to this notice
We review this notice periodically. Where we make a material change we will update the date at the top of this page and, where appropriate, notify you directly.