Your data, handled with care.

How HATCH, run by B2BMALTA Ltd, collects, uses and protects personal information when you visit hatch.mt, apply, get in touch, sign up for updates or come to our events.

At a Glance

The short version.

The key points in brief. The full policy follows below.

What we collect

What you tell us when you apply, get in touch, sign up or register for an event, plus programme records, basic technical data and, if you allow it, analytics and advertising data.

Why we use it

To review applications, run the programme and our events, answer enquiries and send the updates you asked for. If you allow it, we also measure how our website and ads perform, and show our ads to people who have visited. We don't sell it.

What you control

See, correct or delete your data, unsubscribe at any time, change your cookie choices and complain to Malta's data protection regulator.

Last updated: 19 October 2026

This policy explains how we collect, use, share and protect personal information when you visit hatch.mt, apply to our programme, get in touch, sign up for updates or come to our events, including The Innovation Exchange. It also explains your rights and how to use them.

We follow the EU General Data Protection Regulation (GDPR) and Malta's Data Protection Act (Cap. 586).

Who we are

HATCH is a startup incubator in Malta, run by B2BMALTA Ltd. In this policy, “HATCH”, “we”, “us” and “our” mean B2BMALTA Ltd.

Company B2BMALTA Ltd

Company registration no. C47353

VAT registration no. MT19420526

Registered office Business Labs Office Centre, Level 1, Dun Karm Street, Birkirkara Bypass, Birkirkara BKR 9037, Malta

Privacy questions info@hatch.mt

We are the data controller for the personal information described here. That means we decide why and how it's used, and we're responsible for protecting it. For the Meta Pixel, we share this role with Meta, as explained in Who we share it with.

What we collect, and where it comes from

Most of the information we hold comes straight from you. The rest comes from your use of our website, from our programme and events, and, if you join the programme, from Lucian.

Information you give us

Applications. Your name and email address, whether you're based in Malta, and your phone number and LinkedIn profile if you give them. Details of your venture: its name, website, sector and description, the problem it solves, its stage, evidence of traction, team size and funding raised. What you want from HATCH, how you heard about us, anything else you choose to add, and your consent.

Enquiries. Your name and email address, your organisation if you give it, the topic you choose and your message.

Newsletter. Your email address.

Innovation Exchange updates. Your email address, when you ask us to let you know about the next edition.

Event registrations. Your name, organisation and role, and any dietary or access needs you choose to tell us about.

Correspondence. Emails and other messages you send us, and our replies.

Information from our programme and events

Programme records. If you join the programme: your one-to-ones, the workshops you take part in, your progress and your use of Lucian, the platform that helps you plan your venture and apply for funding.

Event attendance. Whether you attended The Innovation Exchange or another HATCH event.

Photos and video. We take photos and video at our events, and you may appear in them.

Information from your use of our website

Technical data. Details such as your IP address, browser and device type, and the pages you request, recorded to keep the site secure and working.

Cookies and similar technologies. Your cookie choice and, only if you accept them, analytics, advertising and embedded media cookies. Our cookie policy explains these.

Campaign details. Only if you accept analytics or advertising cookies: how you reached hatch.mt, such as the campaign tags in the link you followed (and, only if you accept advertising cookies, the click ID added by Google or Meta), the page you landed on and the website that referred you. If you then send us a form, these details are sent with it.

You don't have to give us any information. But we can't review an application, reply to an enquiry or send you updates without the details we ask for. Please don't send us sensitive information, such as health details, unless we ask for it for a specific reason.

How we use it, and why we're allowed to

Data protection law only lets us use personal information when we have a valid reason, called a legal basis. We rely on four:

Consent (Article 6(1)(a) GDPR). You've said yes. You can withdraw your consent at any time, and that won't affect anything we did before.

Agreement (Article 6(1)(b)). We need the information to take steps you've asked for before joining the programme, or to deliver the programme to you.

Legitimate interests (Article 6(1)(f)). We have a genuine reason that doesn't override your rights and interests. You can object.

Legal obligation (Article 6(1)(c)). The law requires it.

Here is each thing we do with your information, what we use and the basis we rely on.

Reviewing your application

What we use Everything you give us in the application form, and any messages about your application.

Legal basis Agreement: steps you've asked us to take before you join the programme.

Running the programme with you

What we use Your contact details, your programme records (one-to-ones, workshops, progress and your use of Lucian) and our correspondence.

Legal basis Agreement: we need it to deliver the programme to you.

Replying to your enquiries

What we use What you send us through the contact form or by email.

Legal basis Legitimate interests: answering the people who contact us.

Sending the newsletter and updates

What we use Your email address, and a record of when you signed up for the newsletter or asked to hear about the next Innovation Exchange.

Legal basis Consent. Every email includes a link to unsubscribe.

Running our events

What we use Your registration and attendance details. If you tell us about dietary or access needs, we use them only to make arrangements for you.

Legal basis Legitimate interests: running and promoting our events. For any dietary or access needs you tell us about: your explicit consent, which you can withdraw at any time.

Event photos and video

What we use Photos and video taken at our events, in which you may appear.

Legal basis Legitimate interests, for general photos and video of our events. You can object at any time. Where we need your consent to feature a photo that clearly identifies you, we'll ask first.

Analytics and embedded videos

What we use If you accept analytics cookies, how you use the site, measured by Google Analytics: for example the pages you view, how you found us, the type of device you use, your approximate location (worked out from your IP address) and when you send one of our forms (but not what you write in it). It's linked to a random ID stored in a cookie, and we use it as statistics to see what works and improve the site. If you play one of our videos, the technical data YouTube receives.

Legal basis Consent, given through our cookie banner, Cookie Settings or the Allow and Play button on one of our videos. Neither loads until you accept.

Measuring and showing our ads

What we use If you accept advertising cookies: whether you came from one of our ads, the pages you visit on hatch.mt and when you send one of our forms (but not what you write in it), together with technical data such as your IP address and browser type. Google Ads and the Meta Pixel collect this using cookies and send it to Google and Meta. We use it to count the applications, enquiries and sign-ups our ads lead to, to show our ads again to people who have visited hatch.mt, through Google and on Facebook and Instagram, and to stop showing them to people who have already applied. We don't use Google Analytics to choose who sees our ads.

Legal basis Consent, given through our cookie banner or Cookie Settings. Neither Google Ads nor the Meta Pixel loads until you accept advertising cookies. For the Meta Pixel, we and Meta are joint controllers, as explained in Who we share it with.

Knowing which campaign brought you to us

What we use If you accept analytics or advertising cookies: the campaign details of your first visit and your most recent one. That means the campaign tags in the link you followed (such as utm_source or utm_campaign), any click ID added by Google or Meta (only if you accept advertising cookies), the page you landed on, the website that referred you and the date. We save these in your browser under the name hatch-attribution. If you send us a form, they're sent with it to HubSpot, so we know which campaign led to your application, enquiry or sign-up.

Legal basis Consent, given through our cookie banner or Cookie Settings. If you'd like us to remove these details from a form you've already sent, email info@hatch.mt.

Keeping a record of your cookie choice

What we use A random ID, the time, the version of our cookie banner and the choices you made. We don't record your IP address. If you send us a form, we also note with it whether you had accepted advertising cookies.

Legal basis Legal obligation, because the law requires us to be able to show that you consented. If you said no, our legitimate interest in being able to show that we respected your choice.

Improving our programme and website

What we use Feedback you give us, and what we learn from running the programme, our events and this website.

Legal basis Legitimate interests: making what we offer more useful.

Keeping the website secure

What we use Technical data, such as your IP address and the pages you request, and strictly necessary cookies.

Legal basis Legitimate interests: protecting the site and the people who use it.

Meeting our legal obligations

What we use The records we must keep for accounting and tax, and for audits of funded activities where the law requires them.

Legal basis Legal obligation.

If we ever want to use your information for a purpose not listed here, we'll tell you first and, where needed, ask for your consent.

We share personal information only when we need to, and only with:

Service providers that run parts of our service for us. The main ones are HubSpot, Inc. (United States), our contact management and email tool, which receives what you send through our application, contact, newsletter and Innovation Exchange forms, with the campaign details described above if you've accepted analytics or advertising cookies; Google (Google Workspace), which hosts our info@hatch.mt mailbox, where we may also receive copies of those messages; DigitalOcean, which hosts the server that runs hatch.mt, where our website keeps a copy of each form you send, with the IP address and browser details it was sent from; Lucian, for programme participants; Google Ireland Limited and Google LLC (United States) for Google Analytics, only if you accept analytics cookies, and for Google Tag Manager, which loads our analytics and advertising tools only after you accept them; and Google (YouTube), only if you accept embedded media and play one of our videos. They may use your information only to provide their services to us, under contracts that require them to protect it, with two exceptions where Google acts as an independent controller under its own privacy terms: YouTube, for what it collects when you play a video, and Google Analytics data, which Google may also use to improve its own products and services, including its advertising tools, as our Google Analytics data-sharing settings allow.

Advertising partners, only if you accept advertising cookies: Google Ireland Limited and Google LLC (United States) for Google Ads, and Meta Platforms Ireland Limited for the Meta Pixel and our ads on Facebook and Instagram. They receive information about your visit, as described above, and also use it for their own purposes under their own privacy policies. Google explains how it uses information from sites that use its services, including Google Analytics and Google Ads, on its Business Data Responsibility site. Meta explains how it uses information in Meta's privacy policy, and you can change the ads you see on Facebook and Instagram in your Meta ad preferences.

Mentors and industry contacts. If you join the programme, we share what's relevant with your mentors and, with your agreement, with the industry players we introduce you to.

Programme and event partners or funders, where a programme or event requires us to report on it, for example activities funded by the European Union.

Professional advisers, such as accountants, auditors and lawyers, where they need it to advise us.

Authorities, where the law requires us to share it.

Meta Pixel: joint controllers. B2BMALTA Ltd and Meta Platforms Ireland Limited are joint controllers for collecting information on hatch.mt with the Meta Pixel and sending it to Meta. We've agreed how we share this responsibility in Meta's Controller Addendum. We ask for your consent before the Pixel loads, and we're responsible for telling you about this processing. Meta is responsible for letting you use your rights to access, correct, delete, restrict or move the information Meta stores once it has received it. Meta's contact details, how it uses the information, the legal basis it relies on and how to use your rights with Meta are in Meta's Privacy Policy. Once Meta has received the information, Meta decides how to use it and is responsible for that on its own. You can contact us or Meta. If you contact us about information Meta holds, we'll pass your request on to Meta.

We don't sell your personal information.

Our website links to other sites, such as our YouTube channel. When you visit them, their own privacy policies apply.

International transfers

Some of the organisations we work with, including HubSpot, Google and Meta, are based in the United States or share information with group companies there, so your information may be processed there or elsewhere outside the European Economic Area (EEA). When it is, the transfer is protected by either:

an adequacy decision, where the European Commission has decided that the country protects personal data to an adequate standard, including the EU-US Data Privacy Framework for US companies certified under it; or

the European Commission's Standard Contractual Clauses, which commit the provider to protect your information.

To find out more about these safeguards, email info@hatch.mt.

How long we keep it

We keep personal information only for as long as we need it. When that time is up, we delete it or anonymise it. Server logs and website backups, which can include copies of form submissions, are kept only for a limited period for security and recovery, then deleted or overwritten.

Unsuccessful applications Up to 12 months after our decision.

Programme participants For the length of the programme, and afterwards for as long as funding rules or the law require.

Enquiries Up to 2 years after our last contact with you.

Newsletter and Innovation Exchange updates Until you unsubscribe. We then keep a minimal record of your email address, only so that we don't email you again.

Event records, photos and video For as long as we need them to report on and promote the event. Dietary and access needs are deleted within one month after the event.

Accounting records For the period Maltese law requires.

Your cookie choice 6 months, stored in your browser. Then we ask again. The record of your choice on our server is kept for 24 months.

Google Analytics data 14 months, then Google deletes the data linked to its cookies. Reports that show only totals, and don't identify anyone, may be kept longer.

Campaign details In your browser, until 90 days after your last visit from a campaign link or another website, or until you turn off both analytics and advertising. If you send us a form, we keep them with it, for as long as we keep that form.

Google Ads and Meta Google and Meta keep the information they receive under their own terms and privacy policies. We keep people in our advertising audiences for up to 180 days, except a list of people who have applied, kept for up to 14 months, which we use only to stop showing them our ads. The cookies Google Ads and Meta save on hatch.mt last up to 90 days.

Your rights

Data protection law gives you these rights over your personal information:

Access. Ask whether we hold information about you, and get a copy.

Correction. Ask us to correct information that's wrong or incomplete.

Erasure. Ask us to delete your information, for example when we no longer need it.

Restriction. Ask us to limit how we use it, for example while we look into a concern you've raised.

Portability. Get information you gave us in a common, machine-readable format, or ask us to send it to another organisation, where we use it with your consent or under an agreement with you.

Objection. Object to uses based on our legitimate interests, including event photography. You can always object to direct marketing, and we'll stop.

Withdrawing consent. Withdraw your consent at any time, for example by unsubscribing or changing your cookie settings. This doesn't affect anything we did before.

Some of these rights apply only in certain situations. If we can't do what you ask, we'll explain why.

How to use your rights

Email info@hatch.mt and tell us which right you want to use. It's free in most cases.

We'll reply within one month. If your request is complex, or you've sent us several, the law lets us take up to two more months, and we'll tell you if we need to. We may ask you to confirm your identity first, to make sure we only give your information to you.

Automated decisions

We don't make decisions about you by automated means alone that have legal or similarly significant effects on you.

Complaints

If you're unhappy with how we've handled your information, please tell us at info@hatch.mt. We'd like the chance to put it right, but you don't have to contact us first.

You have the right to complain to the Information and Data Protection Commissioner (IDPC), Malta's data protection authority, at idpc.org.mt. If you live or work in another EU country, you can also complain to the data protection authority there.

Keeping your data safe

We use appropriate technical and organisational measures to protect personal information against loss, misuse and unauthorised access. These include:

Encrypted connections to hatch.mt.

Access limited to the people who need it for their work.

Service providers bound by contracts to keep your information secure.

Keeping our systems and software up to date.

No website or system is completely secure. If a breach affects your personal information, we'll act quickly and, where the law requires it, tell the IDPC and you.

Cookies

hatch.mt uses cookies and similar technologies, such as your browser's local storage. On your first visit, a banner lets you choose Reject All, Accept All or Manage Settings. Until you choose, we use only strictly necessary cookies, and Google Analytics, Google Ads, the Meta Pixel and YouTube don't load.

Strictly necessary cookies are always on. They keep the site working and remember your choice.

Analytics cookies stay off unless you accept them. They let Google Analytics show us how the site is used.

Advertising cookies stay off unless you accept them. They let Google Ads and the Meta Pixel measure our ads and show them again to people who have visited hatch.mt.

Embedded media stays off unless you accept it. It loads YouTube videos, and YouTube may set its own cookies.

We store your choice in your browser for 6 months, then ask again. We'll also ask again sooner if we start using cookies for a new purpose. You can change your choice or withdraw your consent at any time from Cookie Settings at the bottom of every page. Our cookie policy lists each cookie and what it does.

Children

Our website, programme and events are not aimed at children under 16, and we don't knowingly collect their personal information. If you think a child has given us information, email info@hatch.mt and we'll delete it.

Changes to this policy

We'll update this policy when our services or the law change, and change the date at the top. If a change significantly affects how we use your information, we'll tell you directly where we can.

Get in Touch

Ask us anything about your data.

To use your rights, ask a question or raise a concern, email us. We'll reply within one month.

Email info@hatch.mt

Write to us B2BMALTA Ltd
Business Labs Office Centre, Level 1
Dun Karm Street, Birkirkara Bypass
Birkirkara BKR 9037, Malta

Supervisory authority Information and Data Protection Commissioner (IDPC), Malta
idpc.org.mt