Legal
Privacy policy
This page says what this site asks you for, why, and what happens to it. It covers the enquiry form, the email signup and the analytics behind them, and nothing else, because there is nothing else.
Last updated 31 August 2026
Who is asking
The Mediterranean Cannabis Summit is organised by the company named below, which is the data controller for everything described on this page.
The controller
[TBC:legal-entity]
Level 2, Bilom Buildings, 3, Triq Mro. Frank Galea, Żebbuġ ZBG 2870, Malta
VAT and company number [TBC:legal-vat]
Write to hello@mcs.com.mt about anything on this page, including a request to see, correct or delete what we hold. That address reaches a person, not a queue.
What this policy covers
This site, at mediterraneancannabissummit.com, and the three other MCS domains that redirect to it. It does not cover a ticketing platform, which has not been appointed [TBC:ticketing], or any third party site you reach from a link here.
What we collect, and why
There are two forms on this site and one analytics connection. That is the whole list.
The enquiry form
Used on Exhibit, Sponsorship, In-kind partners and Contact. It asks for your first name, last name, company, email address and message. A phone number is optional, and company is optional on the contact form because a journalist or a prospective speaker is not a company. Where a page offers to send you a price list or a partner pack, the form also records whether you asked for it.
We use it to answer your enquiry and, where you have asked for one, to send you the pack. The legal basis is taking steps at your request before entering a contract, and our legitimate interest in answering business enquiries sent to us.
The email signup
In the footer of every page, and as its own block on the homepage, Exhibit and Tickets. It asks for your email address and records which page you signed up from, so the programme announcement does not go to someone who asked about stand space. The legal basis is your consent, and you can withdraw it from any email we send.
The hidden field on both forms
Each form carries one field that is invisible to a person and only an automated script fills in. If it comes back filled, the submission is discarded and nothing about it is recorded. It exists so the forms do not need a puzzle, a tracking script or a third party bot check, none of which this site uses. The legal basis is our legitimate interest in not being flooded.
Analytics, only if you allow it
If you accept analytics on the cookie banner, Google Analytics records which pages are read, which buttons are pressed, which forms are submitted, roughly where in the world you are, and what browser and device you used. It does not record your name or anything you typed into a form. The legal basis is your consent, and the full list of what is stored on your device is on the cookie policy.
Nothing else
There is no account to create, no password, no basket and no payment on this site. Tickets are not sold here. We do not buy lists, we do not enrich what you give us from other sources, and we do not build a profile of you.
Where it goes
Including the part that is not finished yet, which is written here plainly rather than described as though it were.
What happens when you use a form
When you submit a form, the details you enter are sent to Brevo (Sendinblue SAS, a company based in France), the platform we use to manage contacts and send email. Brevo stores the information so we can reply to you and, where you asked for it, send you what you requested. Brevo processes this data within the European Union.
- Enquiry forms (exhibiting, sponsorship, in-kind partnership, and the contact page): we receive your name, company, email, phone number if you gave one, and your message, and a member of our team follows up. If you ticked the box, we also email you the price list.
- Newsletter signup: we send you an email asking you to confirm your address by clicking a link, and only add you to our mailing list once you do. You can unsubscribe from any email we send.
The fact that a form was submitted is also passed to analytics if you have allowed analytics. The hidden anti-spam field on each form is never seen or filled by a person and is discarded.
Who else is involved
- Google. Tag Manager loads on every page, and Analytics and Maps run through it. What each one stores, and when, is on the cookie policy.
- Cloudflare, which hosts and serves these pages, runs the small function that passes form submissions to Brevo, and keeps ordinary server logs.
- Brevo (Sendinblue SAS), our email and contact platform, as described above.
- Professional advisers, and anyone we are legally required to tell.
We do not sell your data, and we do not pass it to sponsors, exhibitors or partners.
Outside the EEA
Brevo and Cloudflare process your form and contact data within the European Union. Google processes some analytics data outside the European Economic Area; those transfers rely on the European Commission's standard contractual clauses and, where it applies, the EU to US Data Privacy Framework.
How long we keep it
We keep your enquiry and subscription data only as long as we need it for the purpose you gave it, and no longer. The specific retention periods are being finalised as part of the legal review of this page. [TBC:data-retention] You can ask us to delete your data at any time. Marketing consent lasts until you withdraw it, which you can do from any email we send or by writing to hello@mcs.com.mt.
Your rights
Under the General Data Protection Regulation, and they cost nothing to use.
- See it. Ask for a copy of what we hold about you.
- Correct it. Have anything wrong put right.
- Delete it. Ask us to erase it, where we have no reason to keep it.
- Restrict or object. Ask us to stop using it for a particular purpose, including marketing, which we will always stop.
- Take it with you. Ask for it in a portable format.
- Withdraw consent. At any time, without affecting anything done before you withdrew it.
Write to hello@mcs.com.mt and we will answer within one month. There is no form to fill in and no fee.
If we get it wrong
You can complain to a data protection supervisory authority. In Malta that is the Information and Data Protection Commissioner. You may also complain to the authority in the country you live in. We would rather you told us first, so we can fix it.
Changes to this policy
When this changes, the date at the top of the page changes with it. Anything that alters what we do with data already given to us will be told to you directly rather than left here to be found.