Privacy policy

Last updated: [DATE]

This policy explains how personal data is processed when you visit albmania.al, albmania.com, when you write to us or ask for a quote, and when you are a client, or a contact person at a client, of Albmania, the web and marketing agency of Magus Group Albania SHPK. It is drafted under Albanian Law No. 124/2024 “On personal data protection” and, for cookies, Article 158 of Law No. 54/2024 “On electronic communications in the Republic of Albania”. For people in the European Union we also apply Regulation (EU) 2016/679 (GDPR), which applies to us under its Article 3(2) because we offer our services to clients in the EU, in particular in Italy.

• We collect only what we need to answer you, to work with you and to keep the site secure.

• We do not sell or rent personal data, and we do not use it to feed AI tools.

• Analytics loads only if you accept it in the cookie banner, and you can change your choice at any time.

• Our servers and backups are in data centres in the European Union (Germany, Austria, Italy, France, the Netherlands).

• You can ask at any time to access, correct or delete your data (section 11).

The controller of the data described here is:

• Magus Group Albania SHPK (SHPK, an Albanian limited liability company, i.e. LTD); Albmania is one of its brands

• Tax ID (NIPT): L92228018L

• Address: Linzë, Bldg. 30, Entr. 31, Apt. 52, Dajti, 1040 Tirana

• Email for personal data matters: support@magusgroup.al

• Phone: +355 69 20 24 511

Albmania started in 2011 as Albmania Group and merged into Magus Group Albania SHPK in 2024.

Data protection officer: [TO CONFIRM: is a data protection officer required (art. 33 of Law 124/2024, art. 37 GDPR)? If yes: name and contact; if not, delete this paragraph]

This policy covers:

• the agency’s websites (albmania.al, albmania.com) and their forms;

• our relationships with clients and prospective clients (quotes, contracts, invoices, support);

• staff accounts in the website’s admin panel.

It does not cover:

• websites and apps we build or run for our clients. For those, the client is the controller and we process the data only on the client’s instructions, as a processor. If you have a question about your data on such a site, please contact the site’s owner;

• the other platforms of Magus Group Albania SHPK (such as Magus ID, Magus Hub and Magus Pay), which have their own privacy policy.

Legal bases refer to Article 7(1) of Law 124/2024 and, for people in the EU, to Article 6(1) GDPR.

Required data. Only your name, email address and message (or the chosen service, in the quote form) are required [TO CONFIRM: final list of required fields]. Without them we cannot answer you; the other fields are optional.

The checkbox in the form. By ticking it you confirm that you have read this policy. We process your message in order to answer you, not on the basis of consent [TO CONFIRM: wording of the checkbox; see README, "Still open"].

Automatic reply. After you send a form, we email you a confirmation in the language of the site. It contains no advertising.

Newsletter. We currently send no newsletter and do not use your email address for marketing. [TO CONFIRM: if a newsletter is launched, add a section here: consent with double opt-in, data stored, unsubscribe link, retention, provider; and art. 165 of Law 54/2024]

What we do not collect. The site has no comments, no visitor accounts and no job applications. We do not ask for sensitive data; please do not include any in your message.

We keep data longer only where the law requires it or where we need it for a legal claim, and only for that purpose.

We share data only with those we need for the purposes above. Providers working for us (processors) process data only on our instructions, under a contract that meets Article 26 of Law 124/2024 and Article 28 GDPR.

Staff sign in to the panel through Magus ID, the identity service of Magus Group Albania SHPK itself. If your request concerns another brand of the company, we pass it to the relevant team within it.

We are established in Albania; our servers and backups are in the European Union. The Albanian Commissioner for the Right to Information and Personal Data Protection recognises EU and European Economic Area countries as providing an adequate level of protection (Decision No. 1 of 30 April 2025, under Article 40 of Law 124/2024). The same decision recognises the United States as adequate only for companies that participate in the EU–US Data Privacy Framework.

Some providers are US companies or have group companies outside the EU:

• Google, Microsoft, Cloudflare and Sentry (Functional Software, Inc.): transfers rely on the EU–US Data Privacy Framework for certified companies, recognised by the Commissioner’s decision above and, for people in the EU, by Commission Implementing Decision (EU) 2023/1795; otherwise on the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914) [TO VERIFY: each provider's current DPF certification]. Sentry stores error reports in Frankfurt but keeps our account data and some metadata in the United States.

• Zoho: email is stored in Zoho’s EU data centres; Zoho group companies outside the EU (for example in India) may have access as sub-processors, under the European Commission’s standard contractual clauses.

• Under Albanian law we use the safeguards of Article 41 of Law 124/2024 [TO VERIFY: whether the Commissioner has published standard clauses under art. 41(1)(c) or an authorisation under art. 41(2)(a) is needed].

For visitors and clients in the EU: the data you send us is processed by us, in Albania, as a controller directly subject to the GDPR under its Article 3(2). You can ask for a copy of the safeguards used at support@magusgroup.al.

We do not use personal data to feed AI tools. No personal data of visitors or clients (form messages, contact details, project data) is sent to AI providers. Only our staff use AI, in the admin panel, to translate and improve the site’s own texts that we publish. AI is never used to make decisions about people.

We take technical and organisational measures under Article 28 of Law 124/2024 and Article 32 GDPR, including:

• encrypted connections (HTTPS/TLS) on all domains;

• backups encrypted with AES-256 before they leave our servers, with regular restore tests;

• staff sign-in to the panel only through Magus ID, with two-step verification;

• roles and permissions on a least-privilege basis, with the admin panel reachable on one domain only;

• a log of actions in the panel;

• secrets and service keys stored encrypted;

• Turnstile, rate limits and honeypot fields on forms;

• a content security policy that allows only the services that are switched on.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we notify the Commissioner within 72 hours (Article 29 of Law 124/2024; Article 33 GDPR) and notify you directly where the law requires it.

The site is aimed at businesses and adults. We do not knowingly collect data from anyone under 16 (Article 8(6) of Law 124/2024). If you think a minor has sent us data, write to us and we will delete it.

We make no decisions based solely on automated processing that have legal or similarly significant effects on you, and we do no profiling. The Turnstile check automatically tests whether a form is sent by a person; if you cannot pass it, email us instead.

Under Articles 13–20 of Law 124/2024 (and, for people in the EU, Articles 15–22 GDPR) you have the right to:

• be informed and access your data (Articles 13 and 14);

• have it corrected or erased (Articles 15 and 16, the “right to be forgotten”);

• restrict processing (Article 17);

• receive it in a structured, commonly used, machine-readable format (Article 18);

• object to processing based on our legitimate interest (Article 19);

• not be subject to automated decisions (Article 20);

• withdraw consent at any time, as easily as you gave it, without affecting the lawfulness of earlier processing (Article 8(3)). For cookies, use “Cookie settings” at the bottom of every page.

How to exercise them. Write to support@magusgroup.al or to our postal address. We answer free of charge, as soon as possible and no later than 30 days from receiving your request; for complex or numerous requests the period may be extended up to 60 days, and we tell you why within the first 30 days (Article 12(4) of Law 124/2024) [TO VERIFY: whether the extension is "up to 60 days" in total or 60 additional days; GDPR art. 12(3) allows two further months]. If we have reasonable doubts about your identity, we may ask for additional information to verify it (Article 12(3)).

If you believe your data is processed unlawfully, you have the right to complain to:

• the Commissioner for the Right to Information and Personal Data Protection (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale), Rr. “Abdi Toptani”, Nd. 5, 1001 Tirana · info@idp.al · +355 42 23 7200 · idp.al (Article 86 of Law 124/2024);

• if you live or work in the EU, also the supervisory authority of your country (Article 77 GDPR). In Italy this is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome · garanteprivacy.it [TO VERIFY: current contact details].

You may also go to court. We would appreciate the chance to sort things out with you first.

When we change this policy, the new version is published on this page with its date. For significant changes we also tell you on the site and, where we have your email for an ongoing relationship, by email.

For any question about your data: support@magusgroup.al · Magus Group Albania SHPK (Albmania), Linzë, Bldg. 30, Entr. 31, Apt. 52, Dajti, 1040 Tirana.

See also the Cookie policy and the Terms of use.