PRIVACY POLICY
Based on the Albanian Law no. 124/2024 “On Personal Data Protection”, as well as other applicable data protection laws, bylaws, guidelines, and decisions enforced in Albania (altogether, the “Data Law”), and also based on our ethical responsibility as legal professionals, Frost & Fire Consulting (“FFC”, “we”, or “us”) has drafted this privacy policy statement (“Privacy Policy”), through which we would like to inform our prospective clients, job applicants, or other relevant third parties (“Data Subject”, or “you”) acting as data subjects on the purpose and means of collecting and processing their data, duration of the processing, the data protection rights of the Data Subjects, as well as other matters listed below.
The data protected also includes personal data not provided directly by the Data Subjects, but also data provided by third parties lawfully and in accordance with the Data Law for the Data Subjects.
1. Purpose and Legal Basis of Data Processing
FFC may collect and process your personal data for the following purposes:
- to contact and respond/inform you about your requests or enquiries;
- to organize the recruitment process and to inform job applicants about such process;
- to provide you our legal services and administer every process related with such legal services;
- to enter into, perform, or administer various kinds of agreements;
- to comply with legal obligations applicable to FFC;
- to organize legal or business events; and/or
- for other legitimate business, networking, or limited marketing purposes.
We collect and process your data based on one or more of the lawful grounds provided by the Data Law, including, as applicable:
- your explicit consent;
- the performance of a contract or pre-contractual measures;
- compliance with a legal obligation; and/or
- the legitimate interests of FFC or a third party (provided that such interests do not override the fundamental rights and freedoms of the Data Subject).
This collection and processing concerns data which may be mandatory to be collected or processed by the Data Law, or data voluntarily provided by the Data Subjects. FFC will collect and process the data only to the extent necessary for the proper fulfillment of the services we provide and of the purposes listed in this Section.
2. Confidentiality, Security Measures, and Data Retention
Unless otherwise provided in this Privacy Policy under Section 3 (Disclosure and Transfer of Data”) below, or unless disclosure is required by law, or unless the data is already publicly available or lawfully disclosed by the Data Subject or unrelated third parties, all personal data collected and processed by us will remain strictly confidential.
All data will be secured, protected and stored by implementing appropriate technical and organizational measures, in accordance with the Data Law.
We may retain the personal data provided by you only for as long as necessary, in order to:
- comply with our legal and regulatory obligations; and/or
- achieve the purposes for which the data was originally collected.
Personal data is retained for periods determined in accordance with the purpose of processing and applicable legal obligations. Once the applicable retention period expires, the data will be deleted or anonymized, unless further retention is required or permitted by the Data Law.
Further information regarding retention periods may be requested pursuant to Section 7 (Contact Us) below.
3. Disclosure and Transfer of Data
We may disclose your personal data to third parties acting as processors or independent controllers, strictly to the extent necessary for the provision of our services, to comply with legal obligations, or as instructed by the Data Subject.
Such third parties are required to process the data in compliance with the Data Law and applicable safeguards. FFC shall not be responsible for independent data processing activities carried out by third parties outside the scope of our instructions, unless otherwise provided by the Data Law.
Where personal data is transferred outside the Republic of Albania, such transfers shall be carried out only in accordance with the conditions and safeguards provided by the Data Law.
4. Data Subjects’ Rights
Under the Data Law, the Data Subject has the following rights:
- the right of access;
- the right to rectification and erasure (“right to be forgotten”);
- the right to restriction of processing;
- the right to object to the processing of personal data;
- the right not to be subject to automated decision-making, including profiling, where applicable;
- the right to data portability;
- the right to file a complaint with the supervising authority; and
- the right to compensation for material or non-material damage, in accordance with the Albanian Civil Code.
FFC shall respond to requests for the exercise of Data Subjects’ rights within thirty (30) days, extendable to sixty (60) days where permitted by the Data Law. The exercise of these rights is, in principle, free of charge, unless the request is manifestly unfounded or excessive, as provided by the Data Law.
5. GDPR and Foreign Data Subjects
Where applicable, and in cases involving Data Subjects located outside Albania, including within the European Union, FFC shall comply with the relevant obligations arising under the GDPR or other applicable foreign data protection legislation.
However, we strongly recommend that Data Subjects seek advice from a qualified local professional in their jurisdiction, where necessary, in order to better understand their rights under such foreign legislation.
6. Changes to this Privacy Policy
We reserve the right to amend or update this Privacy Policy at any time, in compliance with the Data Law. Any changes shall be published on this website and/or communicated through other appropriate means, including engagement letters or contractual documentation.
7. Contact Us
For any request, clarification, or information related to this Privacy Policy or the processing of your personal data, you may contact us at:
Email: [email protected]
Address: Rr. “Papa Gjon Pali II”, ABA Business Center, 14th Floor, Suite 1401, Tirana, Albania.
Please note that we reserve the right to refuse requests where the requesting party is not a Data Subject or where disclosure is not required under the Data Law.
disclaimer
This website contains general information about Frost & Fire Consulting shpk. and is not intended to serve as a source of legal advice for any purpose.
Neither receipt of information presented on this site, nor any email or other electronic communication sent to Frost & Fire Consulting shpk. or its lawyers through this site will create an attorney-client relationship. Frost & Fire Consulting expressly disclaims liability with respect to actions taken or not taken based on the contents of this site.