Privacy Policy

1. Who we are

ServX is a pre-launch service-discovery project and marketing website operated in Malta under the DevTrix/ServX trading identity. Until a company is formally incorporated and assumes operation, the data controller is Darren Grech, of AG Holdings / Jasmin 043 Triq ta Zwejt San Gwann SGN3025 (“ServX”, “we”, “us” or “our”). Privacy enquiries may be sent to info@servx.mt or support@servx.mt.

The current website is primarily informational and promotional. It does not currently provide a live marketplace, user account, service booking, payment-processing, provider-payout or in-platform messaging service. Descriptions of such functionality on the website refer to intended or proposed future features unless a page expressly states that a feature is live.

2. Personal data we collect now

We collect only the personal data reasonably required for the pre-launch website and the interactions you choose to have with us. Depending on how you use the site, this may include:

• Contact enquiries: first name, last name (if provided), email address, phone number (if provided), area of interest and the contents of your message.
• Provider or waiting-list submissions: name, surname, phone number, email address, services of interest and any information you choose to provide in connection with an expression of interest.
• Newsletter data: email address and a record of your marketing consent, withdrawal or unsubscribe request.
• ServX Assistant data: the messages you choose to send, a session identifier used to keep a conversation together, and technical information reasonably necessary to operate and protect the assistant.
• Website and security data: IP address, browser/device information, request timestamps, pages requested, error/security logs and similar technical data generated when the site is accessed.
• Cookie and consent data: your cookie preference and, only where you consent, analytics data from Google Analytics and marketing/advertising measurement data from the Meta Pixel and Google Ads.

We do not currently collect payment-card details, provider payout details or live booking transaction data through the marketing website. If those functions are launched, this policy and the applicable product terms will be updated before or at the point the relevant processing begins.

3. Information you should not send us

Please do not submit passwords, payment-card details, identity documents, medical information, criminal-record information, other special-category personal data, or confidential information through the ServX Assistant or general contact forms unless we have specifically requested it through an appropriate secure process. If unsolicited sensitive information is received, we may delete or restrict it where reasonably possible and lawful.

4. Why we use personal data and our legal bases

• To answer enquiries, manage waiting-list/provider interest and take requested pre-contract steps — legitimate interests and, where applicable, steps taken at your request before entering a contract.
• To send newsletters or promotional communications — consent. You may withdraw consent at any time without affecting prior lawful processing.
• To operate, secure, troubleshoot and defend the website, prevent abuse and maintain service integrity — our legitimate interests in operating a secure and reliable website.
• To operate the ServX Assistant and answer a message you voluntarily submit — our legitimate interests in providing responsive support and, where appropriate, steps taken at your request.
• To measure site usage through Google Analytics and advertising performance through the Meta Pixel and Google Ads — consent, obtained through the cookie controls before the relevant optional technology is activated.
• To comply with legal, regulatory, tax, accounting, law-enforcement or dispute-related obligations — legal obligation or our legitimate interests in establishing, exercising or defending legal claims, as applicable.

5. ServX Assistant and AI processing

The ServX Assistant is automated; it is not a human adviser. When you send a message, the message and a session identifier are transmitted through ServX systems to OpenAI, which generates the response as a service provider/processor acting on our instructions for this integration. Your browser does not need to contact OpenAI directly for the chat response.

Do not rely on the Assistant for legal, medical, financial, safety-critical or emergency advice, and do not put personal account credentials, payment information or sensitive personal data into the chat. Assistant outputs may be incomplete or inaccurate and should be independently checked where the information matters.

ServX retains conversation messages for up to 90 days for support, troubleshooting, security and misuse investigation, unless a shorter or longer period is required in a particular case by law or for the establishment, exercise or defence of legal claims.

6. Who we share data with

We do not sell personal data. We may disclose only the data reasonably necessary to trusted service providers that host, secure, support or analyse the website; email and communications providers; professional advisers; competent authorities where legally required; and a successor or prospective successor in connection with a genuine corporate reorganisation, financing, acquisition or transfer, subject to appropriate confidentiality and legal safeguards.

Where you consent to optional analytics, Google Ireland Limited may receive relevant usage information through Google Analytics. Where you separately consent to marketing cookies, Meta Platforms Ireland Limited may receive relevant browser/event information through the Meta Pixel, and Google Ireland Limited may receive advertising conversion information through Google Ads. OpenAI may process messages submitted to the ServX Assistant as described above.

7. International transfers

Some service providers may process personal data outside Malta or the European Economic Area. Where the GDPR requires a transfer mechanism, we use an applicable lawful safeguard such as an adequacy decision, Standard Contractual Clauses, or another mechanism permitted by data-protection law, together with supplementary measures where required.

8. How long we keep data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including applicable legal, accounting, security and dispute-resolution needs. In particular: ServX Assistant conversations are normally deleted after 90 days; newsletter information is kept until you unsubscribe or consent is otherwise withdrawn, subject to retaining a minimal suppression record where necessary to honour that choice; enquiry and waiting-list information is periodically reviewed and deleted or anonymised when it is no longer needed for the relevant pre-launch relationship. Security logs may be kept for a limited period proportionate to fraud-prevention, troubleshooting and legal needs.

9. Your GDPR rights

Subject to the conditions and exceptions in applicable law, you may request access to, correction of, deletion of, or restriction of your personal data; object to processing based on legitimate interests; receive eligible data in a portable format; and withdraw consent at any time where processing is based on consent. You also have the right to lodge a complaint with a competent supervisory authority, including the Information and Data Protection Commissioner (IDPC) in Malta.

We may need to verify your identity before actioning a rights request. Rights are not absolute, and we may lawfully retain or continue processing information where an exemption or overriding legal ground applies. We will respond within the period required by applicable law.

10. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. No internet service or transmission method is completely secure, however, and we cannot guarantee absolute security. You are responsible for taking reasonable precautions when choosing what information to submit online.

11. Children

The pre-launch ServX website is not intended to collect personal data from children. Provider registration, paid subscription and marketplace contracting functions, when launched, are intended for persons legally able to enter binding agreements. If we learn that personal data from a child has been submitted without an appropriate lawful basis or authorisation, we may delete it.

12. Future platform features

If ServX later launches user accounts, provider profiles, enquiries visible to other users, paid subscriptions, booking, payments, reviews, messaging or other marketplace functions, additional personal data may become necessary. Before materially different processing begins, we will update the relevant privacy information and, where required, obtain a new consent or provide additional contractual notices.

13. Changes to this policy

We may update this policy to reflect changes in the website, legal requirements or our processing practices. The “Last updated” date will identify the current version. Material changes will be brought to users’ attention in an appropriate manner before they take effect where required by law.

14. Contact

Privacy or data-protection requests: info@servx.mt. General support: support@servx.mt. Current supervisory authority: Information and Data Protection Commissioner (IDPC), Malta.