
LEGAL
Privacy Policy
Last updated: 16 October 2026
This page is an implementation draft prepared from owner-approved source documents and the current codebase. It has not been signed off by qualified legal counsel. It is not legal advice and is not a claim of GDPR, ePrivacy, or other legal compliance.
1. Who we are
This Privacy Policy explains how Web Kosovo L.L.C (“KosovoWeb”, “we”, “us”, “our”) collects, uses, stores, and protects personal data when you use kosovoweb.com (the “Website”), contact us, or interact with our services.
Controller: Web Kosovo L.L.C, 57 Bashkim Krasniqi, 14000 Lipjan, Kosovo. Email: info@kosovoweb.com. Phone: +383 48 477 066.
For privacy-related requests, contact info@kosovoweb.com.
2. Scope of this policy
This policy applies to personal data processed through this Website, the contact enquiry form, related business communications, and (when separately activated and documented) scheduling, analytics, or other tools listed below.
Third-party websites and services opened through links on this Website have their own privacy notices. This policy describes KosovoWeb's processing, not those providers' separate processing; review their notices before using their services.
A newsletter is not offered. Advertising tags, Google Tag Manager, Hotjar, and payment processors are not used on this Website at present.
3. The types of personal data we may collect
3.1 Information you provide directly
- First name and last name
- Email address
- Phone number (optional)
- Company or organisation (optional)
- Service interest
- Approximate budget range
- Expected timeline
- Preferred contact method (optional)
- Project message
- Locale of the page you used (English or Albanian)
The enquiry form includes a hidden honeypot field and an hCaptcha check. Those values are used only to reject automated abuse. The honeypot must be empty. The captcha token is checked and is not stored with the enquiry.
3.2 Information collected automatically
The hosting platform (Vercel) may generate ordinary request logs (for example IP address, user agent, and URL). When configured, optional Google Analytics 4 loads only after Analytics consent. It measures page visits, device/browser information and selected actions. The site sends only known page paths, referral origins and predefined event fields; enquiry contents, contact details, query strings and fragments are excluded. Google receives network information when its service is used.
3.3 Communications data
If you email or call us, we may keep the correspondence needed to respond. hCaptcha checks enquiry submissions for automated abuse. Resend delivers your enquiry to our monitored team mailbox, which uses Zoho Mail.
3.4 Data we do not seek to collect
Please do not send sensitive personal data (for example health, biometric, national ID, bank or other special-category data) unless we specifically request it in a clearly defined context.
4. How we collect personal data
- The Website contact form
- Emails or messages you send to our published addresses
- Phone or WhatsApp if you contact those published numbers
- Cookie/local storage choices in the consent banner
- hCaptcha on the enquiry form
- Google Analytics 4 only when configured and you allow Analytics; scheduling links or a CRM only if separately activated and documented
5. Why we process personal data
5.1 Enquiries and pre-contract steps
To receive, review, and respond to Website enquiries, prepare proposals, and arrange a conversation if useful.
5.2 Operating and securing the Website
Hosting, abuse detection (rate limits, honeypot, captcha), troubleshooting, and security logging.
5.3 Optional analytics
When configured, GA4 measures page visits, contact-link clicks and new enquiries accepted by the live email pipeline, only after you allow Analytics. Rejected, duplicate and test submissions are not counted as leads. Advertising features are disabled. When analytics is not configured it is unavailable in Cookie Settings.
5.4 Marketing tags
Advertising and remarketing tags are not active. Marketing is unavailable in Cookie Settings; advertising consent remains denied.
5.5 Legal and compliance
Recordkeeping, responding to lawful requests, and protecting our legal rights.
6. Legal bases for processing
Depending on context and applicable law, we may rely on: pre-contractual steps or contract necessity (responding to your enquiry); legitimate interests (operating and securing the Website); consent (optional analytics cookies, if activated); and legal obligation where recordkeeping duties apply.
If we rely on consent, you may withdraw it through Cookie Settings. Withdrawal does not affect processing already completed.
Kosovo's Law No. 06/L-082 on Protection of Personal Data provides the local legal framework for processing personal data. Other mandatory rules may apply according to the circumstances.
7. Cookies and similar technologies
We use cookies and similar technologies as described in the Cookie Policy. Necessary storage remembers your consent choice. Optional analytics cookies may be set only after Analytics consent when GA4 is configured.
8. Data sharing and processors
We use service providers to host the website, protect the enquiry form and deliver enquiries to our team. Optional Analytics is used only when configured and with your consent.
What we use today
- Your browser stores your cookie-consent choices and their timestamp
- Optional measurement: Google Analytics 4, only when configured and with Analytics consent; no advertising tracking
- Website processing for form validation, abuse prevention and redacted outcome logs
- Hosting: Vercel, which serves kosovoweb.com
- Bot protection: hCaptcha on the enquiry form
- Email delivery: Resend delivers your enquiry to our monitored team inbox in Zoho Mail
- Domain name resolution: Cloudflare DNS
9. International transfers
Vercel, Resend, hCaptcha and Google (when Analytics is configured and consented) may process data outside Kosovo, depending on their configuration. Exact processor regions and transfer safeguards remain open and must be confirmed by counsel. This page does not claim that a particular transfer law currently applies.
10. Data retention
- Enquiries that do not lead to a client relationship: up to 24 months from our last substantive contact, after which personal data is deleted or anonymised unless a legal obligation or substantiated legal claim requires longer retention
- Contracts, invoices, payment records and other required accounting documents: for the periods required by applicable tax and accounting law, and longer only where necessary to meet a legal obligation or establish, exercise or defend legal claims. Other personal data in project files is kept only while needed for the agreed work and applicable legal obligations
- Analytics data: retention must be confirmed in the GA4 property before activation; this remains an owner review item. The site configures its first-party GA cookies for up to one year without refreshing their expiry
- Security and application logs: kept according to operational need; current logs are redacted outcome events, not full form messages
You may request deletion at info@kosovoweb.com. If we must retain particular records, we will explain the reason and applicable retention period. A deletion request does not override a legal record-keeping obligation.
11. Your rights
Under Kosovo's data-protection law, you can request access, correction, deletion or restriction of your personal data and object to processing where the legal conditions apply. Portability is available where applicable. You can withdraw optional Analytics consent through Cookie Settings.
Send requests to info@kosovoweb.com. We may ask for information necessary to verify your identity before providing personal data or acting on a request.
12. Complaints and supervisory authority
You can contact us about privacy concerns or complain directly to Kosovo's Information and Privacy Agency (AIP). Contacting us first is not a condition for making a complaint.
13. Data security
We use reasonable technical and organisational measures, including access control on processors, process-local rate limiting, captcha/honeypot abuse controls, and redacted application logs. No method of transmission or storage is completely secure. Durable rate limiting across hosting instances is not yet in place.
14. Third-party links
The Website may contain links to third-party sites or services. We are not responsible for their privacy practices.
15. Children’s privacy
The Website serves businesses and individuals seeking our services. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us.
16. Changes to this Privacy Policy
We may update this policy to reflect operational, legal, or technical changes. The updated version will be posted here with a revised “Last updated” date. If cookie purposes or vendors change materially, the consent version in Cookie Settings will be increased so visitors are asked again.
17. Contact us
Web Kosovo L.L.C (KosovoWeb), 57 Bashkim Krasniqi, 14000 Lipjan, Kosovo. Email: info@kosovoweb.com. Phone: +383 48 477 066.