PRIVACY POLICY

Effective date: 01 September 2025

Website: lalajandpartners.al

1. Purpose and scope

This Privacy Policy explains how Lalaj & Partners (“we”, “our”, or “us”) collects, uses, stores, and protects your personal data when you interact with our website “lalajandpartners.al”. We are committed to ensuring full transparency and compliance with applicable legal frameworks, specifically Law no. 124/2024 “On the Protection of Personal Data”. This Policy applies to all visitors and users of our website and describes your rights as a data subject, our responsibilities, and the measures we take to ensure your data remains safe, confidential, and lawfully processed.

2. Identity of the data controller and data processor

The entity responsible for the collection and processing of personal data through our website is:

Data controller:

Lalaj & Partners

Legal form:

Law firm (limited liability company)

Address:

Rruga e Kavajes, Kompleksi Square 21, Njesia 1, Kati 9, Apt. 36 Tirana, Albania

Email:

ened@lalajandpartners.al

Phone:

+355 (0) 69 238 7494

Lalaj & Partners determines the purposes and means of processing personal data as required under Law no. 124/2024 “On the Protection of Personal Data”. As the data controller we are committed to ensuring lawful, fair, and transparent processing of personal information for all website users and clients.

We may engage trusted service providers (e.g. hosting and IT support) as data processors, who process data only under our instructions and subject to confidentiality obligations.

3. Categories of personal data collected

We only collect personal data that you voluntarily provide to us through our website contact form or by email/phone. These may include:

  • Identification data – name, surname.
  • Contact information – email address, phone number.
  • Communication data – the content of your message, inquiries, or correspondence.

We do not collect sensitive categories of data (e.g., health, political opinions, or biometric data) through our website. Any such information, if required for the provision of legal services, will be handled strictly under professional secrecy obligations.

We securely store your data in trusted data centers. At any time you may require from us and we will disclose the relevant information on the location of the data center.

4. Purpose and legal basis for processing

We process your personal data only for specific, explicit, and legitimate purposes, including:

  • Responding to inquiries submitted through our website or email.
  • Communicating with clients or potential clients about legal services.
  • Complying with legal and regulatory obligations applicable to law firms.

The legal bases for processing are:

  • Consent (e.g., when you submit your data via the contact form);
  • Pre-contractual steps or performance of a contract, when you contact us for legal services;
  • Legal obligations, meaning compliance with professional and regulatory duties;
  • Legitimate interests, ensuring the proper management of our website and communications.

5. Data retention periods

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law (e.g., for tax, accounting, or legal obligations). If you withdraw your consent or request deletion, we will delete or anonymize your personal data unless we are legally required to retain it.

6. Sharing and transfers of data

We do not sell your personal data to third parties. We may share your personal data with third parties only in limited circumstances and in accordance with Law no. 124/2024 “On the Protection of Personal Data”:

  • Service providers: We may disclose your data to trusted third-party providers (if applicable) strictly for the purposes of providing our services.
  • Legal and regulatory requirements: We may disclose your data when required by law, regulatory authorities, court orders, or legal proceedings.
  • International transfers: Where your data is transferred outside Albania or the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, in line with Law no. 124/2024 “On the Protection of Personal Data”.

7. Data subject rights

As a data subject, you have the following rights under Law no. 124/2024 “On the Protection of Personal Data”:

  • Right to information and access – You have the right to request confirmation on whether we process your personal data and to obtain a copy of such data.
  • Right to rectification – You have the right to request the correction of inaccurate or incomplete personal data.
  • Right to erasure (Right to be Forgotten) – You may request the deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
  • Right to restriction of processing – You can request the restriction of processing when contesting the accuracy of data or when processing is unlawful.
  • Right to data portability – You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit those data to another controller.
  • Right to object – You may object to the processing of your data when it is based on legitimate interests or for direct marketing purposes.
  • Right not to be subject to automated decision-making, including profiling – You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, unless required by contract, law, or based on your explicit consent. In such cases, appropriate safeguards, including the right to human intervention, will apply.
  • Right to withdraw consent – If processing is based on your consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, you may contact us at: ened@lalajandpartners.al

8. Data security measures

We are committed to protecting your personal data and take appropriate technical and organizational measures to prevent unauthorized access, disclosure, alteration, or destruction of your data. These measures include, but are not limited to:

  • Secure data transmission protocols (HTTPS);
  • Access controls and authentication procedures for authorized staff;
  • Regular monitoring and updating of systems and security tools;
  • Secure storage and encryption of sensitive data (where applicable);
  • Staff training on data protection and confidentiality;
  • Regular backups and contingency planning.

Despite our efforts, no method of transmission over the internet or method of electronic storage is 100% secure. Therefore, while we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security.

9. Data Subject consent

By using this website and submitting your personal data through it, you acknowledge and give your explicit consent to the processing of such data, in accordance with this Privacy Policy and Law No. 124/2024, for the purposes outlined above. You have the right to withdraw this consent at any time by contacting: ened@lalajandpartners.al.

10. Changes to this Policy

We may update this Privacy Policy from time to time in response to legal, technical, or business developments. When we update our policy, we will take appropriate measures to inform you, consistent with the significance of the changes. The date of the latest update will always be indicated at the top of this document. We encourage you to review this page periodically to stay informed about how we are protecting your personal data.

11. Contact information

If you have any questions, requests, or concerns regarding this Privacy Policy or our data processing practices, you may contact us at: ened@lalajandpartners.al.

Address: Rruga e Kavajes, Kompleksi Square 21, Njesia 1, Kati 9, Apt. 36 Tirana, Albania