Privacy policy

Controller for this website

Website delivery and server logs

When the website is opened, the hosting and content-delivery providers may process the IP address, requested page, date and time, referrer, browser or device information, and technical diagnostics. These data are needed to deliver and secure the website.

The legal basis is the operator’s legitimate interest in reliable, secure website delivery under Article 6(1)(f) GDPR. Technical logs are retained only for as long as needed for delivery, security and troubleshooting, or to meet a legal obligation, and are then deleted or anonymised.

First-party visit and WhatsApp booking records

This website creates a random page-visit ID and sends a same-origin record to its own hosting environment. The record can include the page path, a reduced referrer source such as the referring hostname or “direct”, the allowlisted campaign fields utm_source, utm_medium and utm_campaign, and coarse technical categories derived from the request such as mobile, tablet or desktop, browser family, operating-system family, primary language and navigation type. It also records whether Google Ads measurement was granted at that point.

The application database does not store the visitor’s IP address, raw user-agent string, full referrer URL, arbitrary query parameters, message text, name, phone number or a browser fingerprint. The page-visit ID is held only for the current page in browser memory; it is not placed in a tracking cookie or persistent browser storage.

When you select a WhatsApp booking link, this website first uses its own short handoff address. In a JavaScript-enabled browser, a short-lived, single-use first-party token verifies a same-origin booking request. A click record is started immediately, in parallel with any consented Google measurement. The website then records an opaque event ID, its page-visit ID, the date and time, page section or selected service, Google-consent and client-reported dispatch state. A completed first-party handoff adds a short server-generated reference to the record and to the prefilled WhatsApp message so a received enquiry can be matched directly.

Exact replays carrying the same event ID are counted once; separate clicks are separate attempts, not proof of unique people, that WhatsApp opened or that a message was sent. Visit, click, handoff and linked campaign records have a target retention period of 90 days. The self-hosted package includes a daily cleanup task; on the hosted Sites version, cleanup runs when a later booking token is issued, so an inactive deployment may remove records after that target. This processing is used to understand and troubleshoot the booking journey and is based on the operator’s legitimate interest in reliable enquiry handling and proportionate first-party website measurement under Article 6(1)(f) GDPR.

If JavaScript, the verification token or first-party storage is unavailable, the allowlisted handoff still opens the fixed WhatsApp number but creates no application record and adds no reference. Automated link previews and ordinary GET requests therefore do not count as verified handoff attempts.

If Google Ads measurement has been allowed, an available GCLID, GBRAID or WBRAID may also be stored as separate attribution data linked to the technical event ID with the same 90-day target retention and activity-based hosted cleanup described above. Those identifiers are sent only in the same-origin POST body, not in the handoff URL. This can support permitted Google Ads reconciliation or a later confirmed-lead import. No Google advertising click identifier is added to the WhatsApp message or stored in the application database when Google Ads measurement is not allowed.

Optional Google Ads measurement

The Google tag is blocked by default and is not requested from Google until you allow Google Ads measurement. If allowed, Google may receive your IP address, browser and device information, page address, referrer, time of access, advertising click identifiers such as a GCLID, and measurement events. Google may also set or read advertising measurement cookies, including cookies beginning with _gcl_.

These data are used to understand visits generated by advertising and to measure when you select a WhatsApp booking link. Personalised-ad signals are disabled by this website. The legal basis is your consent under Article 6(1)(a) GDPR and the applicable electronic-communications privacy rules.

Google describes its processing, international transfers and safeguards in its privacy policy. You may withdraw consent at any time through Privacy settings. Withdrawal reloads the page so that the Google tag remains blocked afterwards. It cannot undo information already transmitted to Google or remove existing cookies, which you can manage in your browser.

Consent preference and cookies

After you select a WhatsApp booking link, the handoff uses a strictly necessary, HttpOnly, SameSite=Strict first-party session cookie for about ten minutes and a single-use token that expires after about two minutes. They contain random values rather than contact details and are used only to reject cross-site, replayed or excessive handoff submissions.

A local browser-storage entry remembers your Google Ads choice for up to 180 days. This entry is used only to apply and honour your privacy choice and does not itself load Google.

After Google Ads measurement is allowed, an advertising click identifier present in the page address is treated as valid in local browser storage for 90 days so it can be attached to a later booking handoff. An expired entry is removed the next time this website reads it, so its bytes may remain until a later visit. It is removed sooner when Google Ads measurement consent is withdrawn or denied.

Google advertising measurement cookies may be used only after you allow Google Ads measurement. You can allow, reject or later change this choice through the consent notice and Privacy settings.

External links

WhatsApp, Instagram and Google Maps are external services. A connection to them is made only when you select the corresponding link. Their own privacy terms then apply. This website does not embed Instagram content or load Meta resources.

Recipients and international processing

Technical data may be handled by hosting and content-delivery providers acting for the operator, by Google after Google Ads measurement consent, and by public authorities where disclosure is legally required. Google describes its international transfers and safeguards in its privacy policy. Further information about the operator’s processors can be requested from the operator.

Your rights

Subject to the GDPR’s conditions, you may request access, rectification, erasure, restriction or portability of your personal data and object to processing based on legitimate interests. You may withdraw consent at any time without affecting processing that took place before withdrawal.

Contact info@ws-development.eu to exercise these rights. You may also complain to Malta’s Information and Data Protection Commissioner.

Automated decisions

This website does not make automated decisions that produce legal or similarly significant effects. Personalised-ad signals are disabled.