Privacy Policy

Last updated: 4 October 2026

1. Who we are

This policy explains how Joseph Galea trading as Blue Tool Case (“we”, “us”, “our”), established in Malta, handles personal data when you visit bluetoolcase.com, use our free tools, contact us, or arrange a consultation. Joseph Galea trading as Blue Tool Case is the data controller for these activities. Contact us at [email protected] for privacy enquiries and requests.

We handle personal data in accordance with applicable law, including the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Maltese Data Protection Act. Third-party websites linked from our site have their own privacy policies.

2. Information we process

• Website and security information: IP addresses, requested URLs, request times, browser and device information, and technical or security events may be processed in hosting, firewall, error and access logs. URLs may include parameters you submit to a tool.
• Enquiries and consultations: information you send by email, through our support form or provide when booking, such as your email address, selected support subject, message content, name, appointment details and business requirements. Please do not include passwords or unnecessary sensitive information.
• Tool inputs: the domain name or IP address you choose to look up, together with the technical information needed to fulfil the request.
• Analytics and consent information: your cookie choice and, only after accepting optional tracking, information about pages, interactions, browsers and devices through enabled Google Analytics or Jetpack statistics. Cookie-based identifiers are used only where permitted by your consent.
• Jetpack service information: our live site is connected to Jetpack. Depending on enabled features, Automattic may process visitor IP addresses, browser information, referring URLs, pages viewed, timestamps, security events and information submitted to a subscription or contact feature. Connecting Jetpack does not mean every optional feature is used.
• Authorised user accounts: WordPress administrative account details and authentication data for people who manage the site. These are separate from ordinary visitor use.

The current site does not offer public WordPress account registration or an online shop. We do not ask you to create an account to use the public tools.

3. Free tools and external lookup services

Base64 and JSON tools: the theme’s conversion and formatting operations run in your browser. Their implementation does not send the entered text to our server for conversion. Avoid entering confidential data into public tools; hosting and other page services operate separately from these local operations.

Your public IP: when you request your IP address, our WordPress endpoint reads the network address associated with the request, including relevant proxy headers, and returns it to your browser. The custom endpoint does not create a dedicated history of these results, although the request can appear in server or security logs.

DNS lookup: submitting a domain makes a request from your browser to Google Public DNS at dns.google. Google receives the queried domain, record type, your network IP address and request metadata. This is a user-requested lookup service, separate from optional Google Analytics.

IP/WHOIS lookup: the IP address you submit is sent from our server to IANA’s RDAP service and, as needed, regional internet registries such as RIPE NCC, APNIC, ARIN, LACNIC and AFRINIC, or the relevant registry identified by IANA. These services receive the queried IP and our server’s request metadata. Registry results may contain public network allocation or contact information. The plugin does not create a dedicated database history of lookup results; request URLs and errors may still appear in logs.

4. Why we use information and our legal bases

• Provide requested services and respond to enquiries: take steps at your request before entering into a contract, or perform a contract, where applicable (GDPR Article 6(1)(b)).
• Operate and protect the site: our legitimate interests in reliable hosting, preventing abuse, maintaining backups and diagnosing faults (Article 6(1)(f)), subject to your rights and interests.
• Optional analytics and associated cookies: your consent (Article 6(1)(a)). You may withdraw it through Cookie Settings.
• Comply with legal duties: applicable legal obligations, including obligations relating to records or lawful requests (Article 6(1)(c)).

We do not use this site’s tools to make solely automated decisions that produce legal or similarly significant effects about you. We do not sell your personal information.

5. Hosting and service providers

Our website is hosted with ScalaHosting. Hosting involves processing website files, databases, technical requests and logs, and may involve backups and support access. Processing locations and safeguards depend on the hosting services and facilities used. See ScalaHosting’s privacy policy. A hosting provider’s policy is not a substitute for our responsibilities as controller.

Other services involved in operating the site include:

• Google: Analytics through Site Kit, Google Public DNS for requested lookups, externally loaded Google Fonts, and Gmail-based email delivery through WP Mail SMTP. Font requests disclose your network IP and request metadata to Google even when analytics cookies are rejected. Email delivery processes addresses and message content. See Google’s privacy policy.
• Cloudflare: where traffic is routed through our Cloudflare configuration, performance and security services may process IP addresses, requests and security events. See Cloudflare’s privacy policy.
• Wordfence / Defiant: site security software can process IP addresses, security events, login attempts and diagnostic information, and communicate with its security services according to enabled features. See Wordfence’s privacy policy.
• Jetpack / Automattic: our live WordPress site is connected to Automattic’s Jetpack services. Enabled features can provide site statistics, security and account protection, image delivery through a content delivery network, and site management. Statistics can involve pages viewed, referring URLs, IP addresses, browser details and timestamps; security features can process IP addresses and login or abuse events; requests for images delivered through Automattic’s network disclose request metadata to that service. If a Jetpack subscription or contact feature is offered and you use it, the submitted email address and other supplied information may be processed by Automattic. Jetpack also synchronizes selected site content and configuration with WordPress.com; enabled authenticated management/API features may access live site data. The information processed depends on the features and permissions in use. See the Jetpack Privacy Center, Automattic’s Privacy Notice for visitors to users’ sites and Automattic’s privacy policy.
• Calendly: our consultation link takes you to Calendly. If you book there, Calendly processes the booking information under its own policy and provides appointment details to us. See Calendly’s privacy notice.
• Internet registries: the DNS/RDAP lookup recipients described above process the queries needed to return results.

We use WordPress and plugins for page layout, accessibility, search optimisation, caching, consent coordination and migration/backups. A migration or backup export may contain website databases and personal data already held in them. Administrative licensing, updates and support may involve plugin vendors; installing a plugin does not mean every optional vendor service is enabled. We restrict access to personal data to what is needed for the relevant purpose.

We may also disclose information where required by law or necessary to establish, exercise or defend legal claims.

Support form: your email address, selected subject and details are emailed to the WordPress site administrator through our configured mail service. Your address is used as the reply address. The form does not keep a separate database copy of your message, although email systems, configured mail logs and backups may retain it. To limit abuse, the site temporarily stores a submission count under a salted hash of the server connection address, expiring 15 minutes after the most recent counted attempt. This hash is pseudonymous, not anonymous. Requests for data erasure may require identity verification and are subject to applicable legal exceptions; sending the form does not automatically erase records.

6. Cookies and Google Consent Mode

Essential WordPress cookies may support authentication, session integrity and site functionality. The btc_cookie_consent cookie remembers your choice for up to 180 days, and wp_consent_* cookies communicate category choices to compatible plugins. These consent-choice cookies remain after Reject All so the site can remember and honour your decision.

Optional Google Analytics cookies, such as _ga, _ga_*, _gid and _gat*, are governed by your choice. Cookie Settings in the footer lets you accept or reject optional categories later. Rejecting denies analytics and advertising storage and attempts to remove existing visible first-party Google Analytics cookies, known Google advertising cookies (_gcl_au, _gcl_aw, _gcl_dc, _gac_*) and Automattic analytics/referral cookies (tk_ai, tk_ni, tk_qs, tk_or, tk_lr, tk_r3d). Our script cannot delete HttpOnly or third-party cookies. Browser controls offer additional cookie management.

Our theme blocks Google Analytics, Google advertising and Google Tag Manager snippets until you accept optional tracking (basic consent-mode blocking). If you do not choose, or select Reject All, these tags remain blocked rather than sending cookieless analytics signals. Accepting activates the enabled tags; rejecting after acceptance saves your new choice and reloads the page to stop previously loaded trackers. Requests already sent under earlier consent cannot be recalled. Requested DNS lookups, external fonts and visits to linked services remain separate from optional tracking consent, so rejection is not a promise that no request of any kind reaches Google. This does not itself mean that we run advertising campaigns.

Jetpack statistics scripts and pixels are separately gated by the same optional-tracking choice: they do not activate until acceptance. Google tracking and Jetpack statistics pixels are disabled on AMP pages because our custom consent banner cannot operate there. Jetpack security, image-delivery and other requested service processing may continue independently of optional analytics consent. Rejecting does not delete HttpOnly or third-party Automattic cookies or disconnect necessary Jetpack services. Information about Automattic’s technologies is available in its Cookie Policy. You may contact us about the Jetpack features in use or exercise the applicable rights described below.

If a changed choice cannot be saved in cookies after tracking has started, we attempt to keep a denial in your browser’s session storage for that tab and reload with tracking blocked. If both storage mechanisms are unavailable, we leave the page to stop the loaded trackers. Allow cookies and use Cookie Settings again to persist your choice. Older consent choices are re-requested when the scope of the banner changes.

For further information, see our Cookie Policy.

7. International transfers

Some providers may process information outside Malta and the European Economic Area. Where GDPR requires safeguards for a transfer we arrange, we use an applicable adequacy decision or other appropriate mechanism, such as standard contractual clauses, with additional measures where necessary. Contact us for information about the relevant arrangements. We do not assume all data remains in the EU simply because the business is established in Malta.

In particular, the connected Jetpack services may involve Automattic entities and infrastructure outside the EEA, including the United States. The applicable locations and transfer arrangements depend on the services used and Automattic’s current terms and privacy notices.

8. Retention

We retain information only for as long as reasonably necessary for the purpose for which it was collected, subject to legal obligations and the establishment or defence of claims. Enquiries and appointment records are reviewed according to our business needs; security and hosting logs are managed according to the enabled logging and hosting arrangements. Analytics retention is governed by our Google Analytics configuration and applicable consent controls. The consent-choice cookie lasts up to 180 days unless deleted or replaced.

The custom lookup plugins do not maintain a dedicated query history, but technical logs may retain requests. Backups and migration exports can retain earlier copies until their retention cycle ends. A deletion from the live site does not necessarily remove that information immediately from a retained backup. You can contact us about the retention applicable to a particular record.

Information processed through Jetpack, including statistics, security records, synchronized site information and any subscription data, is subject to the enabled feature’s retention arrangements and Automattic’s applicable policies. Disconnecting Jetpack does not necessarily immediately delete information already held by Automattic. Contact us about relevant records and deletion requests.

9. Security

We use measures appropriate to the information and risks, including access controls, site security software and maintenance. We aim to limit unnecessary access and disclosure. No internet service, email transmission or storage system can be guaranteed completely secure.

10. Your rights

Subject to GDPR’s conditions and exceptions, you may request access, correction, erasure, restriction of processing or data portability. You may object to processing based on legitimate interests and withdraw consent at any time without affecting the lawfulness of earlier processing. We may need proportionate information to verify a request. Contact [email protected]; we normally respond within one month, with any lawful extension explained.

You may complain to Malta’s Information and Data Protection Commissioner or another competent supervisory authority, including where you live or work in the EU.

11. Children and changes

This site is intended for a general professional audience and is not directed at children. If you believe a child has supplied personal information that should be removed, please contact us.

We may update this policy as services or practices change. The date above identifies the latest revision. We will provide further notice where appropriate.

12. Contact

Joseph Galea trading as Blue Tool Case
Malta
[email protected]