Last updated: 28 August 2026
1. Who we are
Studio Eleven54 Ltd. (“Eleven54”, “we”, “us”, “our”) is a marketing, design and web development agency registered in Malta. We are the data controller for the personal data described in this policy, which means we decide why and how your personal data is used.
- Registered office: Triq il-Mastrudaxxa, Hal Qormi QRM 3573, Malta
- Company registration number: C 92415
- Email: hello@eleven54.com
- Telephone: +356 7979 7999
- Website: https://eleven54.com
This policy explains what we collect when you visit eleven54.com, contact us, or interact with our advertising on Google, Meta (Facebook and Instagram), LinkedIn and TikTok, and what rights you have over that data.
2. Personal data we collect
2.1 Data you give us
When you complete our contact form, send us an email, call us, message us on social media, or request a quote or proposal, we collect:
- Your name
- Your email address
- Your telephone number
- Your company or organisation name, where you provide it
- The content of your message and any details you share about your project, budget or requirements
- Any other information you choose to send us, including files or attachments
2.2 Data we collect automatically
When you visit our website we and our analytics and advertising partners may collect:
- IP address, which may be truncated or shortened by some of our partners
- Browser type and version, operating system and device type
- Approximate location derived from your IP address, usually at city or country level
- Pages you view, time spent on each page, links you click and scroll behaviour
- The website, advertisement or search term that brought you to us, including click identifiers such as gclid, fbclid and li_fat_id
- Cookie and similar identifiers assigned to your browser or device
We only place non-essential cookies and similar technologies, including advertising and analytics tools, after you have given consent through our cookie banner. Strictly necessary cookies that make the site work are set without consent.
2.3 Data we receive from others
We may receive limited information about you from:
- Advertising and analytics platforms, in aggregated or pseudonymised form, telling us how our campaigns performed
- Lead forms you complete directly on Meta, LinkedIn or Google, which pass your name, email and phone number to us
- Publicly available professional sources, such as a company website or LinkedIn profile, when we research a prospective client
- Referrals, where an existing client or partner passes on your contact details
We do not knowingly collect special category data such as health, religious or political information, and we ask that you do not send it to us.
3. Why we use your data and our legal basis
| What we do | Why | Legal basis under the GDPR |
|---|---|---|
| Reply to your enquiry and prepare a quote or proposal | To answer you and discuss working together | Steps taken at your request prior to entering a contract, Article 6(1)(b), or our legitimate interest in responding to business enquiries, Article 6(1)(f) |
| Deliver our services and manage the client relationship | To carry out the work you have engaged us for | Performance of a contract, Article 6(1)(b) |
| Invoicing, accounting and tax records | To run the business and meet Maltese legal requirements | Legal obligation, Article 6(1)(c) |
| Run and measure advertising on Google, Meta, LinkedIn and TikTok, including conversion tracking | To reach potential clients and understand which campaigns work | Consent for cookies and similar identifiers, Article 6(1)(a), and our legitimate interest in promoting our services, Article 6(1)(f) |
| Retargeting and audience building, including custom and lookalike audiences | To show relevant ads to people who have already shown interest in us | Consent, Article 6(1)(a) |
| Website analytics and performance monitoring | To improve the site and fix problems | Consent for non-essential analytics cookies, Article 6(1)(a) |
| Send marketing emails and newsletters | To share our work, offers and insights | Consent, Article 6(1)(a), or the soft opt-in for existing clients where permitted, Article 6(1)(f) |
| Keep our systems and records secure, and defend legal claims | To protect the business | Legitimate interest, Article 6(1)(f), and legal obligation where applicable |
Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and concluded that it is not. You can ask us for details of that assessment or object at any time, see section 8.
4. Advertising, retargeting and tracking technologies
Marketing is our business, and we advertise ourselves in the same way we advertise for our clients. This section explains exactly what that means for your data.
4.1 What we run
We run paid campaigns on Google Ads, including Search, Display, YouTube and Performance Max, on Meta across Facebook and Instagram, on LinkedIn, and on TikTok. These campaigns are for lead generation, which means their purpose is to bring potential clients to our website and encourage them to contact us.
4.2 Tracking tools on our website
Subject to your cookie consent, our website may load:
- Google Analytics and the Google Ads conversion tag or tags, to measure traffic and record when a visit turns into an enquiry
- Google Tag Manager, which manages the tags above
- Meta Pixel and the Conversions API, to measure results and build audiences on Facebook and Instagram
- LinkedIn Insight Tag, to measure results and build audiences on LinkedIn
- TikTok Pixel, where we are running TikTok campaigns
These tools set cookies or use similar identifiers, and they send information about your visit, such as the pages you viewed and whether you submitted a form, to the platform that provides them.
4.3 Retargeting
If you visit our website or engage with our content, you may later see our ads on other websites, on Facebook, Instagram, LinkedIn, YouTube or TikTok. This is called retargeting or remarketing. It works by adding your pseudonymous browser or device identifier to an audience list held by the advertising platform. We do not see your identity through these lists, and we do not know who individually saw or clicked an ad.
We may also upload contact details, such as an email address or phone number, to Google, Meta or LinkedIn in hashed form to create customer match or custom audiences, and lookalike or similar audiences based on them. We only do this where we have a lawful basis to do so, and hashing means the platform receives a scrambled value rather than the raw detail. You can object to this at any time by emailing hello@eleven54.com and we will remove you from these lists.
4.4 Your controls
You can:
- Change or withdraw your cookie consent at any time through the cookie settings link on our website
- Adjust Google ad personalisation at https://adssettings.google.com
- Adjust Meta ad preferences in your Facebook or Instagram account settings
- Adjust LinkedIn ad preferences in your LinkedIn account settings
- Use your browser settings to block or delete cookies, and enable Do Not Track or Global Privacy Control signals where supported
Turning off personalisation does not stop you seeing ads. It means the ads you see will be less relevant to you.
4.5 Automated decision making
We do not make decisions that produce legal or similarly significant effects about you using automated processing alone. Advertising platforms do apply automated targeting and bidding, but this does not have a legal or similarly significant effect on you.
5. Who we share your data with
We do not sell your personal data. We share it only with:
- Advertising and analytics platforms: Google Ireland Limited, Meta Platforms Ireland Limited, LinkedIn Ireland Unlimited Company and TikTok Information Technologies UK Limited, as described in section 4. For some of this processing, notably pixel data and audience matching, we and the platform act as independent or joint controllers, and each platform’s own privacy policy governs what it does with the data afterwards.
- Service providers acting on our instructions, such as our website hosting provider, email and CRM systems, form and helpdesk tools, cloud storage, and accounting software. These act as our processors under written agreements.
- Professional advisers, such as our accountants and lawyers, where necessary.
- Public authorities, where we are required to disclose data by law.
- A buyer or successor, if we sell or restructure the business, in which case your data would transfer with appropriate protections.
6. International transfers
Some of our partners, particularly advertising, analytics and cloud providers, process data outside the European Economic Area, including in the United States. Where that happens we rely on one or more of the following safeguards:
- The European Commission’s adequacy decision, including the EU-US Data Privacy Framework where the recipient is certified
- Standard Contractual Clauses approved by the European Commission, with supplementary measures where needed
You can ask us for a copy of the safeguards that apply to a specific transfer by emailing hello@eleven54.com.
7. How long we keep your data
| Data | Retention |
|---|---|
| Enquiries that do not become a project | Up to 24 months from the last contact, then deleted |
| Client records and project files | For the duration of the relationship and 6 years after it ends |
| Invoices and accounting records | 10 years, as required by Maltese tax and company law |
| Marketing email subscribers | Until you unsubscribe, plus a suppression record so we do not contact you again |
| Advertising and analytics identifiers | As set by each platform, typically between 30 days and 26 months |
| Cookie consent records | 12 months, then we ask you again |
Where we no longer need your data, we delete it or anonymise it so it can no longer identify you.
8. Your rights
Under the GDPR and the Maltese Data Protection Act, Chapter 586 of the Laws of Malta, you have the right to:
- Access the personal data we hold about you and receive a copy of it
- Rectify data that is inaccurate or incomplete
- Erase your data, sometimes called the right to be forgotten, where we no longer have a valid reason to keep it
- Restrict how we use your data while a concern is being resolved
- Portability, to receive certain data in a structured, machine readable format or have it sent to another controller
- Object to processing based on our legitimate interests, and to object at any time to direct marketing, including profiling for advertising, which we will always honour
- Withdraw consent at any time, without affecting processing carried out before you withdrew it
- Not be subject to a decision based solely on automated processing that significantly affects you
To exercise any of these rights, email hello@eleven54.com or write to us at the address in section 1. We will respond within one month, and will tell you if we need to extend that by up to two further months because your request is complex. We may ask you to confirm your identity before we act.
If you are not satisfied with our response, you can lodge a complaint with the Office of the Information and Data Protection Commissioner, Malta:
- Website: https://idpc.org.mt
- Email: idpc.info@idpc.org.mt
- Address: Floor 2, Airways House, High Street, Sliema SLM 1549, Malta
- Telephone: +356 2328 7100
You may also complain to the supervisory authority in the EU country where you live or work.
9. Cookies
Our website uses cookies and similar technologies. They fall into these groups:
- Strictly necessary: required for the site to function, for example remembering your cookie choice and protecting forms against spam. These are always active.
- Analytics: help us understand how the site is used. Set only with your consent.
- Advertising and retargeting: used by Google, Meta, LinkedIn and TikTok to measure campaigns and show you relevant ads. Set only with your consent.
You can accept, reject or change your preferences through the cookie banner when you first arrive, and afterwards through the cookie settings link on our website. Rejecting non-essential cookies will not stop you using the site.
10. Security
We take reasonable technical and organisational measures to protect your data, including encryption of our website in transit using HTTPS, access controls and least privilege on our systems and tools, protected accounts with multi factor authentication where available, regular software and platform updates, and limiting access to client data to the team members who need it. No system is completely secure, so we cannot guarantee absolute security, but we will notify you and the IDPC where we are legally required to do so following a personal data breach.
11. Children
Our website and services are aimed at businesses and are not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Third party websites
Our website and our social media profiles may link to sites we do not control, including client work, portfolio platforms and social networks. We are not responsible for their privacy practices, and we encourage you to read their policies.
13. Changes to this policy
We may update this policy as our services, tools or the law change. The date at the top shows when it was last revised. If we make a material change we will highlight it on our website, and where required we will ask for your consent again.
14. Contact
For any question about this policy or your data:
Studio Eleven54 Ltd.
Triq il-Mastrudaxxa, Hal Qormi QRM 3573, Malta
Email: hello@eleven54.com
Telephone: +356 7979 7999