Website Privacy Notice

(Last updated _____)

1. Purpose of this Notice

1.1 This Website Privacy Notice explains what personal data is collected when you visit our website: https://www.emante.eu/en (our website) (or on social media or other electronic offerings), and how this data is processed by the company EMANTE PANEL, a company established and existing in Albania at the address: Zona Kadastrale 1198, Pasuria 64/16, Rrashbull, Durrës, registered in the Commercial Register with identification number NIPT L72220506A, as controller of your personal data ("the Company" or "we").

1.2 This Notice is addressed to every visitor of our website ("the data subject" or "you"). If you request services from us, or communicate with us in this regard and use our online service offering, this online data privacy policy applies in addition to the privacy policies for our services.

1.3 We process your personal data in accordance with Law No. 124/2024 "On the Protection of Personal Data" ("the DPL") and the applicable secondary legislation on data protection. Unless otherwise specified in this Notice, the terms used here shall have the same meaning as defined in the DPL.

2. What Personal Data Is Collected and How We Use It

2.1 When you use our website, we may process the personal data that you voluntarily provide to us (e.g., through our contact form).

2.2 However, you may visit our website without actively providing us with information about yourself. In this case, we collect certain data that your browser transmits to our website's server (e.g. the IP address of the device from which the services are accessed and details about the device and technology you use, log files) as well as data we collect through the use of cookies or similar technologies.

2.3 The explanations below are intended to inform you about the various ways we may collect personal data about you on our website and the legitimate purposes for which we may use it.

If you are under 16 years old, please ensure that you obtain your parent's/guardian's permission before sharing your personal data with us. We will not process your personal data without such consent. Legal basis: Article 8(6) of the DPL.

2.4 Personal data that you actively make known to us

2.4.1 When you actively communicate with us through our website, we process the personal data that you voluntarily provide to us, mainly in order to offer and provide services for the products we offer, and we rely on a number of legal bases for processing this personal data. In particular, this relates to the following services of ours:

Contact forms: When you choose to contact us through the contact form provided on our website, the personal data you provide us (e.g. name, email address, correspondence, phone number) will be processed for the purpose of responding to your questions, fulfilling your requests, or for other communications with you. Legal basis: Article 7(1)(b) of the DPL – performance of (pre-contractual) obligations.

User Account: If you have registered a user account on our website, the personal data you voluntarily provide us (e.g. name, email address, date of birth, password, product inquiries) will be processed for the purpose of providing access to your user account, enabling you to write comments, and sending you personalised content offers. Legal basis: Article 7(1)(b) of the DPL – performance of the contract.

Job Applications: When you choose to contact us to apply for job opportunities posted on our website, the personal data you provide us (e.g. name, contact details, cover letter, CV, certificates and references, etc.) will be processed for the purpose of reviewing your application and considering it in the recruitment process for the vacant position. Legal basis: Article 7(1)(b) of the DPL – performance of (pre-contractual) obligations.

Additional purposes including: registering you as our customer; carrying out proper due diligence or other data or credit control activities; processing your applications, orders and payments, and facilitating delivery requests; evaluating, processing or tracking your use of and requests for our products and services; providing maintenance services for our products and services; carrying out your instructions or responding to your questions; contacting or communicating with you regarding our products or services; preventing or investigating any fraud, illegal activity, omission or misconduct; facilitating or administering any internal or external audit of our business; complying with any applicable law and order of a court or regulatory body, including legal and regulatory requirements for disclosure and retention of data; carrying out research, market surveys, analyses and/or business development activities (including data analytics, surveys and/or profiling) to improve and promote our products and services; producing statistics and research for internal and statutory reporting; facilitating a business transaction such as a merger, sale, purchase, lease or acquisition; operating, developing and maintaining our IT systems, including the storage and processing of personal data in computer databases and servers. Legal basis: Article 7(1)(dh) of the DPL – fulfilment of legitimate interests.

If we need to process your personal data for any other purpose not mentioned among the purposes above, we will notify you in advance.

2.4.2 Some of the data we request in connection with our services above may be marked as mandatory fields. You are not obliged to provide this data. However, if you do not provide this information, we may not be able to process your request or provide you with our services.

2.4.3 As a rule, you can use our online service offering without providing any personal information. However, if you provide us with personal data by completing a form, you give your consent to the processing of this data in accordance with the applicable legislation on the protection of personal data. As part of an online completion process, a request notice, or a conversation, we process the data provided during that process.

2.4.4 Direct Marketing and Data Subject Consent. The use of personal data to send advertising materials or commercial information about the sale of the Company's products or services requires the prior consent of the data subject. Through the use of the form, you give your consent regarding the further processing of the data, while having the option to unsubscribe via a dedicated link if you do not wish to be informed further, or to visit our offices in person to complete the relevant form. Withdrawal of consent does not affect the lawfulness of the processing based on this consent before its withdrawal.

2.5 Log Files

2.5.1 You may also visit our website without actively providing us with information about yourself. In this case, we collect certain data that your browser transmits to our website's server (e.g. log files).

2.5.2 Our log files contain the following information: (i) the date and time our website is accessed, (ii) the type, version and settings of your internet browser, (iii) your operating system and internet service provider, (iv) the pages and files requested, (v) the website visited before visiting our website, and (vi) your IP address. An IP address is a specific number assigned to your computer that enables your device to communicate on a network using the Internet Protocol (IP). IP addresses may be considered personal data as they technically allow the identification of the user under certain circumstances.

2.5.3 Processing of log files is necessary to maintain the functionality, stability and security of our website. We may also process them for investigative purposes in the event of a security incident or to generate user statistics. For statistical purposes, your IP address is used only in anonymised form. Legal basis: Article 7(1)(dh) of the DPL – legitimate interest in maintaining the functionality, stability and security of our website.

2.6 Cookies

2.6.1 In addition, this website uses cookies. These are small text files that may be placed on your device while browsing our website, which store certain information about you. Cookies cannot access, read or modify other data stored on your device. When we refer to "cookies", we also include other technologies with similar purposes, such as pixel tags.

2.6.2 We use two types of cookies on our website:

(i) Necessary cookies: Without necessary cookies, the proper functioning of our website would not be possible or would be limited. The use of necessary cookies on our website is possible without your consent. However, you may disable cookies at any time by adjusting your browser settings. For a detailed description of necessary cookies and their respective purposes, please see Section 2.7 below. Legal basis: Legitimate interest.

(ii) Optional cookies: These types of cookies may be used to improve our website, to optimise your user experience, to analyse user behaviour, or to personalise marketing activities. Optional cookies may also be placed by third-party advertising companies ("third-party cookies"). Optional cookies will only be used with your consent, which you may give by clicking "OK" on our website's cookie banner. This consent may be withdrawn at any time with effect for the future. For a detailed description of the optional cookies used and their respective purposes, please see Section 2.8 below. Legal basis: Article 7(1)(a) of the DPL – consent.

2.7 Necessary Cookies Used on Our Website

2.8 Optional Cookies Used on Our Website

2.9 Web Analytics

2.9.1 Google Analytics

In order to better understand how our Website is used and what content we should further develop, we use "Google Analytics" to compile anonymous usage statistics. This analysis tool uses (third-party) "cookies" to collect standard log information as well as visitor behaviour on our website in aggregated form. The aggregated analyses will be carried out, in particular, on the following factors: number and duration of page views of individual (sub-)pages, geographic location of accesses, end devices used by visitors (web/mobile), language, operating system, service provider, and screen resolution (on mobile devices).

However, this service is provided by Google LLC, an entity based in the USA. The European Court of Justice has found that the United States of America does not have an adequate level of data protection.

With your express consent, data may be transferred to a third country (Article 41.3(a) of the DPL). We inform you here of the possible risks associated with a potential transfer of data and the lack of appropriate data protection measures. In particular, there is a risk that your data may be accessible to US authorities for control and monitoring purposes and that there are no effective legal remedies against this. Before we place a cookie and transfer your data to these companies, we will ask for your express consent and provide you with detailed information on the relevant data processing (in particular, the purposes, categories of data, and retention period). You may withdraw your consent at any time with effect for the future.

Further information regarding the terms of use and Google's privacy statement can be found at https://www.google.com/analytics/terms/gb.html.

2.9.2 [add other web analytics tools or social media plug-ins, if applicable]

2.10 How to Control and Manage the Use of Cookies

2.10.1 By clicking the "OK" button on the Website's cookie banner, you agree to the use of the optional cookies mentioned above on our Website. Your consent may be withdrawn (for all or for individual cookies) at any time, with effect for the future.

2.10.2 You may also refuse the use of cookies by selecting the relevant settings in your browser or by deleting cookies from your device and browser. Most browsers automatically accept cookies, but you can change your browser settings to delete cookies or to prevent automatic acceptance if you prefer. In general, you have the option to see which cookies have been placed and delete them individually, block third-party cookies or cookies from specific websites, accept all cookies, be notified when a cookie is placed, or refuse all cookies. Visit the "options" or "preferences" menu in your browser to change settings, and check the following links for more browser-specific information: Cookie settings in Internet Explorer, Cookie settings in Firefox, Cookie settings in Chrome, Cookie settings in Safari.

2.9.3 You should be aware that any preferences will be lost if you delete all cookies, and many websites will not function properly or you will lose certain functionality. For these reasons, we do not recommend disabling cookies while using our website.

2.10 How Do We Appear on Social Networks?

We operate our pages on social networks and other platforms (e.g. Facebook, Instagram, LinkedIn, TikTok, Snapchat, Pinterest and YouTube). If you communicate with us there, or comment on or share content, we collect information for this purpose, which we use mainly for communicating with you, for marketing purposes, and for statistical evaluation. The platforms may collect further data online, e.g. log data and other details. Based on this, these platforms may assess how you use our online service offerings (e.g. what content you view, what you comment on, "like" or share, etc.), and they may combine this behavioural data with other information about you (e.g. information about age or gender), thereby creating profiles about you as well as usage statistics for the site. The platforms use this information to personalise advertising and content, for market and user research, and to provide us and third parties with statistical user information. The relevant providers also collect and use online data for their own purposes, possibly together with other data known to them, e.g. for marketing purposes or to personalise content. To the extent that we are joint controllers with the provider, we enter into a relevant agreement, about which you can obtain information from the relevant provider (see below for Facebook). We process the data we receive from the platforms for the purposes described here, in particular for communication, marketing purposes and market research. Content published by you (e.g. comments on public profiles and posts) may be redistributed by us (e.g. in our advertising on the platform or elsewhere), and we and the provider may delete content in accordance with the usage policy. More information on the processing activities of the platform operators (e.g. in which countries data is disclosed or what data subject rights you have) can be found in the providers' privacy policies: XXXXX

How do we process data in apps? We may also offer applications for installation on mobile devices ("apps") as part of our online service offering. During installation, the operator of the relevant app store (e.g. Apple or Google) processes certain data for itself and according to its own data protection rules. When you use the app, we process the data you provide us during this process (including, as applicable, direct personal data such as name or email address) and other online data, such as a unique mobile device identification number, your IP address, device information such as operating system information, and behavioural data (e.g. search queries, pages viewed and session duration) for the purposes set out here.

3. Who May We Disclose Your Personal Data To

3.1 For the purposes mentioned above, we may share your personal data with the following recipients: group companies, when necessary to provide our services (e.g. when you request certain services through our Website); a list of group companies can be found here (there is no list); IT service providers who provide hosting, maintenance and security services for our Website; advertising and web analytics partners (e.g. Google LLC) who provide certain services in connection with our Website; [add other categories of recipients: no information].

In cases where disclosure is mandatory (i) by law or regulations, state authorities, or (ii) to establish, exercise or defend legal claims, we may also disclose personal data to a competent authority, such as supervisory, regulatory or criminal authorities, courts, or third parties advising us in this context (e.g. lawyers or investigating experts). Legal basis: Article 7(1)(dh) – fulfilment of the legitimate interests of the controller and third parties.

3.2 Some of these recipients may be located in countries outside the EU/EEA for which the Commissioner for the Right to Information and Protection of Personal Data has not yet assessed as having an adequate level of data protection. In particular, this includes our group companies. It should be noted that the level of data protection in these countries may not be the same as in the EU/EEA. Also, in accordance with Albanian legislation, the data may be accessible to local authorities or courts.

3.3 However, when personal data is transferred to these third countries, we implement appropriate protective measures to ensure that your rights are protected in accordance with the DPL. This includes signing standard contractual clauses approved by the Commissioner for the Right to Information and Protection of Personal Data regarding the transfer of personal data (Article 41.1(c) of the DPL). Further details on the protective measures implemented, as well as copies of the relevant agreements, are available upon request at _____________

4. How Long We Retain Your Personal Data

4.1 Log records (see Section 2.5 above) are generally kept for a period of three months. After this period, log records will be retained solely for the purpose of investigating irregularities or security incidents in our system. For the retention period of cookies, see Section 2.6 above.

4.2 In general, we retain your personal data for as long as necessary to fulfil the purpose for which it was obtained. Thus, in every case we process your personal data for the duration of our contractual or service relationship with you (see Section 2.4 above). After this period, we retain your personal data to fulfil legal retention obligations (e.g. to fulfil the 5-year retention obligation under applicable tax and commercial law). Where necessary, we may also retain your data for as long as legal claims against us are not yet time-barred; for certain claims, the legal limitation period may be up to 10 years. Legal basis: Article 21(2)(dh) – retention periods.

4.3 Once there are no longer any legitimate reasons for the further retention of personal data, it will be deleted or anonymised.

5. Your Rights as a Data Subject

5.1 As a data subject, you have, among others, the following rights under the conditions set out by law: to check whether and what kind of personal data we hold about you and to request a free copy of this data (the right of access); to request the correction, completion or deletion of your personal data that is inaccurate or processed in a manner that does not comply with applicable requirements (the right to rectification and erasure); to request that we restrict the processing of your personal data, e.g. if you contest its accuracy, the processing is unlawful or no longer necessary, or you have objected to the processing (the right to restriction); in certain circumstances, to object to the processing of your personal data for legitimate reasons or to withdraw consent previously given for processing (the right to object or withdraw consent) — in this context, you may also object if we use your personal data for direct marketing purposes; to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit that data to another controller (the right to data portability).

5.2 We do not process your personal data for the purpose of making decisions based solely on automated processing, including profiling, which produce legal effects concerning you (Article 20 of the DPL).

5.3 To exercise any of the above rights, please send an email to info@emante.eu. In addition, you have the right to lodge a complaint with a supervisory authority if you believe that your data protection rights have been violated. For the Republic of Albania, the competent authority is the Commissioner for the Right to Information and Protection of Personal Data.

Commissioner for the Right to Information and Protection of Personal Data

Rr. "Abdi Toptani", Nd. 5, Postal code 1001, Tirana, Albania

+355 42 23 7200; 08002050

info@idp.al

6. Updates to this Notice

6.1 We may update this Notice to reflect legal, technical or business changes. When we update this Notice, we will take reasonable steps to inform you of the changes made. The "last updated" date will be found at the beginning of this Notice.

7. Legal Advice / Disclaimer

7.1 Our website contains links to other third-party websites. We have no control over the content or privacy practices of these other websites. Please read the relevant data protection provisions of the other websites you visit.

8. Security

How do we protect your data? We treat online data confidentially and take appropriate technical and organisational security measures to protect the confidentiality, integrity and availability of your personal data, to protect it from unauthorised or unlawful processing, and to protect it from the risk of loss, accidental alteration, disclosure or unauthorised access. We use recognised security standards such as ISO 27001. Our security procedures are continuously improved by implementing new technologies. Our information systems are protected with strong passwords and security control mechanisms at various levels. Electronic transfer of personal data is carried out using encrypted messages and strict criteria for identifying the recipient. When your data is transmitted through our websites or applications, we protect it during transmission using appropriate encryption mechanisms. However, we can only secure areas that are under our control. Your personal data is stored in a secure database located in the EEA. This database is accessible only by specialists residing in the EEA, solely for repair and maintenance purposes. If you contact us by email, you do so at your own risk and accept that we may reply to the sender's address through the same channel. If you send us emails over the internet in unencrypted form, third parties may be able to access, view and manipulate them, and the data may be lost or intercepted and/or manipulated by third parties. Furthermore, we take appropriate technical and organisational security measures to reduce risk on our websites and in our applications. However, your end device is outside the security area under our control. Therefore, you are required to inform yourself about the necessary security measures and take appropriate steps in this regard.

8. Our Contact Details

Head office phone number: +355 52 420 130

Email: info@emante.eu

8.1 If you have any requests or questions regarding our processing of your personal data, please contact Emante Panel at info@emante.eu.

8.2 Our office address is: Zona Kadastrale 1198, Pasuria 64/16, Rrashbull, Durrës.