Privacy statement
Last updated 3 October 2026
The short version: we collect as little as possible, use it only for the show and the game, keep it safe, never sell it, and you stay in control.
Who we are
Malta Wake Show is organised by [Legal entity name], trading as Santa Maria Watersports (“we”, “us”), a company registered in Malta under number [Company registration number, e.g. C 12345], with its registered office at [Registered office address], Malta. We are the controller of the personal data described in this statement.
For anything about your privacy or your rights, email [privacy@example.com]. We have not appointed a data protection officer, as the law does not require one for an organisation of our size and activity; your request goes straight to the people responsible.
What this statement covers
This website, the Wake Run browser game, our newsletter, rider registrations and Malta Wake Show 2026 at Dock No.1, Cospicua. For each activity below we explain what we collect, why, on which legal basis under the EU General Data Protection Regulation (GDPR) and how long we keep it. We only collect what we need, and we never sell your personal data.
Contact form
- What: your name, email address, the topic you pick and your message. Depending on the topic, also your company (sponsors), your Instagram handle or riding clip (riders) or your outlet (press).
- Why: to answer you and, where you ask for it, to discuss a sponsorship, press accreditation or a rider spot.
- Legal basis: steps you ask us to take before entering into a contract (Art. 6(1)(b)), or our legitimate interest in answering questions about the event (Art. 6(1)(f)).
- Kept: up to 12 months after our last exchange. If it leads to an agreement, we keep the related correspondence for as long as Maltese tax and company law require (generally up to 10 years).
Newsletter
- What: your email address and the date you signed up.
- Why: to send you news about Malta Wake Show, such as line-up announcements, ticket sales and the date.
- Legal basis: your consent (Art. 6(1)(a) and the Processing of Personal Data (Electronic Communications Sector) Regulations, S.L. 586.01). Every email has an unsubscribe link, and withdrawing consent never affects emails we sent before.
- Kept: until you unsubscribe. We then keep only your address on a suppression list, so we don't email you again by mistake.
Wake Run, the game
Playing as a guest. When you start a run we create a random guest ID, stored in a cookie on your device. With it we record each run: your score, coins, tricks, crashes, the shirt you chose, timestamps and the inputs you made during the run. We need these to run the game you asked for and to check that scores are genuine (Art. 6(1)(b) and our legitimate interest in fair play, Art. 6(1)(f)). Guest play does not ask for your name or email. With each run we also store the country you play from, worked out by our hosting provider from your IP address (country only: no city, and not the IP address itself). We use it only for anonymous statistics about where the game is played (our legitimate interest, Art. 6(1)(f)).
Saving your score. If you enter your email, we send you a one-time sign-in link and code and link your runs to that address. You then choose a nickname, and we add a random four-digit tag (for example “Rider#0427”). We use your email only to sign you in, to contact you if you win a prize and for important messages about the game, never for marketing unless you also join the newsletter (Art. 6(1)(b)).
Public leaderboard. Your nickname, tag, best score, shirt and the time of your run only appear on the public leaderboard if you switch on public ranking. This is based on your consent (Art. 6(1)(a)), and you can switch it off at any time; you then disappear from the board straight away.
Challenge links. If you create a challenge, anyone with the link can see your nickname, tag and score, and the nicknames and scores of friends who join. Links stay open until the competition ends.
Prizes. If you tick that you'll be at Malta Wake Show, we store that choice and show a mark next to your name on the public leaderboard. If you win, we ask for your full name and the details we need to hand over or deliver the prize, and may ask for proof of age to confirm you are eligible (Art. 6(1)(b)). We keep winner records for as long as accounting law requires.
Kept: the 2026 competition closes on 27 October 2026 at 23:59 Malta time. We delete or fully anonymise game accounts, runs and challenges within 12 months after it ends, unless you ask us to delete them sooner.
Riders at the event
- What: your name, date of birth, contact details, riding level, emergency contact, the signed waiver and, for riders under 18, the consent and contact details of a parent or guardian. We also ask for health information relevant to riding safely.
- Why: to organise your participation, keep you safe on the water and help you in an emergency.
- Legal basis: our agreement with you (Art. 6(1)(b)) and our legal obligations on safety (Art. 6(1)(c)). Health information is special category data, which we process only with your explicit consent (Art. 9(2)(a)) or, in an emergency, to protect your vital interests (Art. 9(2)(c)).
- Kept: health information is deleted within 30 days after the event. Registration forms and waivers are kept for two years after the event, the period in which most claims for damages can be brought under Maltese law, or longer if a claim is ongoing.
Photos & filming
We and our accredited photographers film and photograph the event, and use the footage on this website, on social media, in press material and to promote future editions. You may appear in it, mostly as part of the crowd. Signs at the entrance tell you that filming takes place.
We rely on our legitimate interest in documenting and promoting the event (Art. 6(1)(f)). You can object at any time: tell a crew member on the day, or email us with the image or video and we will remove or blur you in material we control. Close-up portraits used in advertising need your consent, which we ask for on the spot. Footage is kept for as long as it is useful for promoting Malta Wake Show.
Website security & logs
When you visit the site, our hosting provider automatically processes technical data such as your IP address, browser type and the pages you request, to deliver the site and protect it against abuse. To stop spam and brute force attempts on the game, we also store a one-way hashed (SHA-256) version of your IP address with the time of your request, which cannot be turned back into the address itself. Both rely on our legitimate interest in keeping the site secure (Art. 6(1)(f)). Logs and rate-limit records are kept for no longer than 30 days.
Cookies & storage on your device
Under S.L. 586.01, we may only store information on your device without asking when it is strictly necessary for a service you request. Everything below is strictly necessary or remembers something you did yourself:
- mws-cookie-consent (local storage, until you clear it): remembers your choice in the cookie banner.
- sb-…-auth-token (cookies, up to 400 days): keeps you signed in to Wake Run, as a guest or with your email.
- mws-wakerun-best (local storage): your personal best score on this device.
- mws-wakerun-mine (local storage): the IDs of your recent runs, so they can be added to your account when you save your score.
- mws-wakerun-run (session storage, cleared when you close the tab): lets a run survive a page reload.
We currently use no analytics, advertising or social media tracking cookies. If we add analytics, it will only run after you choose “Accept all” (Art. 6(1)(a)), and we will list it here first. To change your choice, clear this site's cookies and storage in your browser; the banner will then appear again.
Who we share it with
We share personal data only with service providers that process it on our behalf, under a data processing agreement and only on our instructions (Art. 28):
- Vercel Inc., which hosts this website.
- Supabase Inc., which runs the game database and sign-in.
- Our email delivery and newsletter providers, which send sign-in links and newsletters.
- Accredited photographers and video crews working for us at the event.
We do not share your personal data with sponsors for their own marketing. We may disclose data to the police, courts or other authorities when Maltese or EU law requires it, to medical services in an emergency, and to our professional advisers or insurers when needed to establish or defend a legal claim.
Transfers outside the EU
Some of our providers are based in the United States or may access data from there. We only allow this when the transfer is protected: either the provider is certified under the EU–US Data Privacy Framework, or we have signed the European Commission's Standard Contractual Clauses with it (Arts. 45 and 46). You can ask us for a copy of these safeguards.
How we protect it
All traffic to this site is encrypted (HTTPS). The game database is locked so that it can only be reached through our own server, never directly from a browser, and only the people who need access to run the event have it. Sign-in works with one-time links, so we never store a password for you. If a breach ever puts your rights at risk, we will notify the Information and Data Protection Commissioner within 72 hours and inform you without undue delay (Arts. 33 and 34).
Children
In Malta the age of digital consent is 13. If you are under 13, please ask a parent or guardian before saving your score with an email or joining the newsletter: guest play is fine without one. If we learn that we hold an email address of a child under 13 without that consent, we delete it. Riders under 18 need written consent from a parent or guardian, as set out in our terms.
Automated decisions
To keep the leaderboard fair, our server replays every submitted run to verify the score. A run that does not match its replay is rejected automatically and does not count. We make no other automated decisions about you, and no profiling. If you think a run was rejected wrongly, email us and a person will review it (Art. 22).
Your rights
Under the GDPR you have the right to:
- Get a copy of the personal data we hold about you (Art. 15).
- Have incorrect data corrected (Art. 16).
- Have your data deleted, for example your game account and scores (Art. 17).
- Restrict how we use your data while a question or complaint is being resolved (Art. 18).
- Receive data you gave us in a portable format, or have it sent to another organisation (Art. 20).
- Object to processing based on our legitimate interests, such as event photos (Art. 21), and to direct marketing at any time, with no reason needed.
- Withdraw your consent at any time, for the newsletter or the public leaderboard (Art. 7(3)).
Email [privacy@example.com] to use any of these rights. It is free. We reply within one month; for complex requests we may extend that by two more months and will tell you why. We may ask you to confirm your identity first, for example by replying from the email address linked to your game account.
Complaints
We would like to hear from you first, so we can try to put things right. You also have the right to lodge a complaint with the Maltese supervisory authority: the Information and Data Protection Commissioner (IDPC), Floor 2, Airways House, Triq il-Kbira, Tas-Sliema SLM 1549, Malta, idpc.info@idpc.org.mt, +356 2328 7100, idpc.org.mt. If you live in another EU country, you can also complain to the authority there.
Changes to this statement
We update this statement when our activities change, for example when ticket sales open or if we add analytics. The date at the top shows the latest version. If a change affects how we use data you already gave us, we will tell you by email or on this site before it takes effect.
Legal references
- Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR).
- Data Protection Act, Chapter 586 of the Laws of Malta.
- Processing of Personal Data (Electronic Communications Sector) Regulations, S.L. 586.01 (cookies and marketing emails).
- Directive 2002/58/EC on privacy and electronic communications (ePrivacy Directive).