+356 9901 3629



14 October 2022
Version 1.0




Charlene Camilleri Duca trading as paths (hereinafter referred to as ‘the Company’, the Data Controller, our, we, us) respects the privacy of all its clients and prospective clients and is dedicated to protect the personal data it has to process about such clients. We thus want to inform you how we use and protect your personal data. This includes informing you of your rights. 
Data Protection Legislation: Data Protection Legislation: (i) unless and until the General Data Protection Regulation is no longer directly applicable in Malta, the General Data Protection Regulation ((EU) 2016/679) and any national implementing laws, regulations and secondary legislation, as amended or updated from time to time, in Malta and then (ii) any successor legislation to the GDPR or the Data Protection Act (Ch. 586 of the Laws of Malta).


Our full details are:

Postal address: 52, Triq Ġużè Ellul, Gwardamanġa, Malta, PTA1030
Email address: info@paths.care
Telephone number: +356 9901 3629
Data Protection Lead (DPL): Amira Latif
Email address: amira.l@paths.care
Telephone number: +356 9901 3629

Data We may collect from you

We may collect personal data from you because of a legal reason or because you have consented us to do so for a specific purpose.
Information you may give us during different stages of our relationship:
  • Identity Data includes first name, last name, date of birth, gender, identity card number or passport number.
  • Contact Data includes billing address, email address and telephone number/s and emergency contacts (i.e. name, relationship and home and telephone numbers).
  • Financial Data includes payment card details.
  • Transaction Data includes details about payments to and from you and other details of services you have purchased from us.
  • Health data including the contact details of your family doctor, and any medical, physical or mental conditions and in particular your care needs
  • Lifestyle data including your likes, dislikes and preferences (including your religious beliefs or other beliefs of a similar nature, racial or ethnic origin, health and sexual orientation (so far as they relate to providing you with suitable care)
  • Feedback data including contributions to questionnaires and surveys about the service we offer as well as your complaints, compliments or concerns about the service we provide
  • Electronic images and recordings including CCTV images when you visit our offices and  audio recordings of phone calls to and from our office teams
  • Marketing and Communications Data includes your preferences in receiving marketing from us and your communication preferences.
You may give us information about you, for example:
  • By filling in a form, sending us an e-mail or over a telephone call or message
  • Requesting a quote for a service
  • During Assessment meetings
  • Receiving our service
  • Visiting our offices
If you fail to provide personal data which we need to collect by law, or under the terms of a contract we have with you, we may not be able to perform the contract we have or the contract we need to enter into with you (for example, to provide you with services). In such a case, we may have to cancel a service you have with us but we will notify you if this is the case at the time.
We may also receive information about you from third parties (including, for example, your family doctor) and may receive information about you from them as part of the service we provide you, or for legal reasons. We may also receive information about you from other third parties who you authorise us to request such information on a case-by-case basis.

How We use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
  • Where we need to perform the contract we are about to enter into or have entered into with you.
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
  • Where we need to comply with a legal or regulatory obligation.
Generally, we do not rely on consent as a legal basis for processing your personal data other than in relation to sending direct marketing communications to you via email, text message or by post. You have the right to withdraw consent to marketing at any time by either unsubscribing from our mailing list or by contacting our DPL.

Purpose for processing your personal data 

We will process your data:
  • When you request us to quote for our services and when we follow up through an Assessment meeting.
  • When we must provide services to you after you opted to receive services from us.
    • When you enter into a contract with us and we have to prepare, review and update a suitable therapy plan, describing the nature and level of therapy and support services which you have requested.
    • To communicate with you, your representatives and any other appropriate external social or health care professionals about your individual needs and personalise the service delivered to you.
    • We need to respond, should your care needs change, to meet your individual needs and ensure the safety of you and our employees.
    • Invoice you for the therapy and support services in accordance with our terms and conditions.
  • Carry out quality assurance procedures, review our service and improve our customer experience.
  • Notify you about changes to our services which are relevant to you.
  • Monitor how effective our services are and to make sure that the services we provide meet your needs.
  • You give us permission to do so.
    • Send information about our services which we believe you may be interested in. You may unsubscribe from this at any time.
  • To protecting our premises from unauthorised entries and crime.
  • To comply with the law.


We may use your Identity Data, Contact Data, Transaction and Marketing and Communication Data details to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which services and offers may be relevant for you (we call this marketing).
You will receive marketing communications from us if you have requested information from us or receiving services from us and, in each case you consented to receive such information. You have the right to withdraw consent to marketing at any time by either unsubscribing from our mailing list or by contacting our DPL.

Change of purpose

We will only use your personal data for the purposes for which we collected it.  If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Sharing of your personal data

We may have to share your personal data with the parties set out below:
  • Third party service providers including, Google and Trust Payments (Malta) based in the EU who provide website hosting and payment solutions.
  • Professional advisers including accountants, lawyers, bankers, auditors and insurers based in the EU who provide consultancy, banking, legal, insurance and accounting services.
  • Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes (unless we have a Joint Controllers agreement with them and in that case you will also receive information on how they will process your data from them) and only permit them to process your personal data for specified purposes and in accordance with our instructions.
We do not transfer your personal data outside the European Economic Area (EEA).

Data Security 

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know and who are subject to a duty of confidentiality. We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Retention Periods

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Your Rights 

 You have the right to:


We are giving you this Privacy Notice to keep you informed.


Please contact our DPL if you wish to access the personal information we hold about you. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.


Please contact our DPL if you wish to rectify your information. We will also rectify the information you have consented us to pass on to third parties, if it is the case.


Please contact our DPL if you want us to erase all your personal data and we do not have a legal reason to continue to process and hold it.

Restrict processing

Please contact our DPL if you want us to restrict processing of your data. In this case we will restrict processing but we will still hold the data.

Data portability

Please contact our DPL if you want information on how to port your data elsewhere. This right only applies to personal data that you have provided to us as the Data Controller. The data must be held by us by consent or for the performance of a contract.


You have the right to object to us processing your data even when we do so for our legitimate interests. If you wish to object please contact our DPL.

Withdraw consent

If you have given us your consent to process your data but later changed your mind, you have the right to withdraw your consent at any time. Please contact our DPL in case you wish to withdraw consent.

Complain to a Supervisory Authority

You have the right to complain to the IDPC if you feel that we have not responded to your requests to solve a problem. The supervisory authority in Malta is the Office of the Information and Data Protection Commissioner (IDPC) which is at Floor 2, Airways House, Triq il-Kbira, Sliema and can be reached on +356 2328 7100.

Changes to Our Privacy Notice

We may change this notice from time to time in the future. Changes to our privacy policy will be notified to the data subjects through the preferred means of communication.

TherapyPacks Terms and Conditions

1. TherapyPacks come in bundles of 5 or 10 sessions. Prices of bundles:

  • 5 sessions – €270 – must be utilised within 3 months from date of purchase
  • 10 sessions – €520 – must be utilised within 6 months from date of purchase

2. Bundles are not transferable. This means they cannot be used by, or gifted to, anyone else but the person whose name is listed as the TherapyPacks bundle holder.

3. Bundles which are purchased for Couples Therapy and Family Therapy can only be used by members of the couple or family with one therapist. If members of a couple or family decide to take up individual therapy with another therapist, the bundle will only apply to sessions with the therapist originally referred and cannot be also used for the individual sessions with another therapist. Exceptions will be made if the original therapist is unable to see the client or family and the couple or family are referred to another therapist. After referral, the same conditions will apply.

4. Bundles are valid for a limited time period, as listed above. This means that the bundles will expire once the respective time period has elapsed. Any sessions not utilised within this period will be lost. This means that a refund will not be given for unused sessions. Start date commences on date of purchase of bundles.

5. Bundles are only valid for full price sessions (charged at €60) and not for sessions with trainee psychotherapists, reports or assessments.

6. Full payment needs to be made on purchase, via bank transfer, cash or credit card.

7. Management reserves the right to terminate or suspend the use of the bundles. Reasons for such are at the discretion of the clinic.

8. Refunds or extensions of time period within which bundles may be used is at the discretion of management and will only be granted in exceptional circumstances.

9. Management reserves the right to modify or replace the terms and conditions. In such circumstances, clients will be given adequate notice and time to adhere to such.

10. The clinic’s cancellation policy is applicable also to bundles. Late cancellations or no shows will result in the forfeit of a session within the bundle allocation.

11. Responsibility for ensuring timely use of session bundles remains that of the TherapyPacks bundle holder or, in the case of a minor, their carer/legal guardian.