PRIVACY POLICY
1. INTRODUCTION
INNOVAWAY ALBANIA Sh.p.k. is pleased to welcome you to the section dedicated to our personal data processing policy (hereinafter referred to as the “Privacy Policy”), which provides information on the processing of personal data pursuant to Article 13 of Law No. 124/2024 “On Personal Data Protection” and Article 13 of GDPR 2016/679.
“Personal data” means any information relating to a data subject (as defined in point 3 of Article 5 of Law No. 124/2024 “On Personal Data Protection”).
The protection of your privacy and personal data is an important matter to which the INNOVAWAY Group and INNOVAWAY ALBANIA Sh.p.k. pay particular attention. We respect the confidentiality of your personal data and always act in compliance with the provisions of Law No. 124/2024 “On Personal Data Protection” and this Privacy Policy.
This Privacy Policy is intended to describe to “Data Subjects,” in a simple and transparent manner, which personal data are processed, for what purposes, by whom and by what methods, and to inform them about the measures implemented to protect their rights and freedoms, as well as the security and confidentiality of their personal data.
This Privacy Policy applies to all processing operations carried out by INNOVAWAY ALBANIA Sh.p.k. in the course of its activities, as well as to the online activities of this website, and is valid for all data subjects. The purpose of the Privacy Policy is to provide maximum transparency regarding the information and personal data collected/processed and how they are used.
2. Who is the Controller?
A “Controller” is any natural or legal person, as well as any public authority, which, alone or jointly with others, determines the purposes and means of the processing of personal data (as defined in point 8 of Article 5 of Law No. 124/2024 “On Personal Data Protection”).
The website is managed by the parent company, INNOVAWAY S.p.A., with registered office in Naples, Italy. With regard to the personal data of Albanian citizens (data subjects) processed through the website, the parent company and INNOVAWAY ALBANIA Sh.p.k. are considered “Joint Controllers.”
With regard to personal data processed locally as part of the other processing operations carried out by INNOVAWAY ALBANIA Sh.p.k. within the territory of the Republic of Albania, the Controller is INNOVAWAY ALBANIA Sh.p.k.
3. Categories of Data Subjects
4. General Information
Data subjects are informed of the following general policies and rules, which apply to all areas of processing:
• All data are processed lawfully, fairly and transparently in relation to the data subject, in accordance with the general principles established by Law No. 124/2024 “On Personal Data Protection” and the GDPR;
• We collect and process your data only for the purposes specified in this Notice or for the specific purposes already communicated to you and/or for which you have provided your consent;
• We aim to collect, process and use as little personal data as possible;
• When we need to collect your personal data, we ensure that they are as accurate and up to date as possible;
• If the personal data we collect are no longer required for any purpose and we are not legally obliged to retain them, we will make every effort to erase, destroy or anonymise them;
• Specific security measures have been implemented to prevent data loss, unlawful or improper use and unauthorised access;
• Your personal data will not be disseminated, sold, made available or disclosed to entities other than those specified in this Privacy Policy.
5. Regarding the Processing Operations Carried Out by INNOVAWAY ALBANIA Sh.p.k.
5.1 Personal Data We Process
We take care to inform you “regularly and comprehensively” about the categories of data we process, the methods, purposes and security measures, as well as the rights you enjoy. In general, the data are collected directly from you and with your consent as the data subject.
In the course of fulfilling its scope of activity, Innovaway Albania Sh.p.k. processes the following categories of personal data:
• Customers who delegate services to Innovaway under a service agreement. In general, the personal data of the legal representatives of the customer companies with which Innovaway Albania Sh.p.k. cooperates in the provision of services are processed. Specifically, data concerning the first name, surname, ID number, signature and email address of the administrator, legal representative or contact person are processed manually through the physical documentation signed between the parties, as well as through electronic email communications.
• Subjects whose data are collected by Innovaway’s customers and in respect of whom Innovaway, as part of the provision of the service, may access certain categories of personal data solely for the purposes of providing the service, specifically: first name, surname, date of birth, identification document number, email address, telephone number and credit card details.
• Partners/collaborators to whom certain services may be delegated as part of the achievement of the company’s objectives, through cooperation agreements physically stored in the company’s archives. Data such as first name, surname, position, contact number, email address and signature are processed.
• Visitors/interested persons, through the website, which enables them to obtain information about the services and submit complaints or requests. Data such as their name, email address, telephone number, address and the message submitted are accessed.
• Visitors to the company’s office premises: through the entry and exit register, data such as the visitor’s first name, surname and reason for the visit are collected for security purposes. Image data are also collected through the CCTV system for security purposes.
• Job applicants/candidates are required to send a CV to the email address [email protected]. In this context, the following data are processed: first name, surname, email address, telephone number, date of birth, qualifications and professional experience, which are items of information generally included in a CV. These data are accessed electronically only by the Company Administrator and the Human Resources Specialist, who oversee the recruitment process. The data of candidates who are not selected for the vacant position are erased immediately after completion of the recruitment selection process and announcement of the successful candidate.
• Employees: the following data are processed: first name, surname, email address, telephone number, educational information, signature, salary, bank account number, ID, qualifications and professional experience, data concerning fitness for work and health, residential address and criminal record certificate. These data are accessed manually, through the physical file, only by the Administrator, the Human Resources Specialist and the Finance Specialist.
5.2 Purpose of Data Processing
The purposes for which personal data are processed depend on the relationship that the data subjects have with INNOVAWAY ALBANIA Sh.p.k., as well as on the services provided by the company.
• The personal data of customers who delegate services to Innovaway under a service agreement are processed for the proper management of the specific contractual relationships and to ensure that the services are provided as correctly and comprehensively as possible.
• With regard to the personal data of subjects collected by Innovaway’s customers, in respect of whom Innovaway may access certain categories of personal data as part of providing the service, the purpose of the processing is exclusively connected with providing the service specified in the agreement between the parties, namely between Innovaway and its customer company.
• The personal data of partners/collaborators to whom Innovaway Albania Sh.p.k. may delegate certain services as part of achieving the company’s objectives, through cooperation agreements, are processed in connection with contractual obligations and civil-law legislation, in order to ensure compliance with the rights and obligations between the parties.
• The personal data of visitors/interested persons are processed through the website for the purpose of providing them with information about the company’s services and handling their requests or complaints.
• The personal data of visitors to the company’s office premises, collected through the entry and exit register or the CCTV system, are processed to ensure their physical safety, as well as the security of the company’s assets and monetary valuables.
• The personal data of job applicants/candidates are processed to ensure the operation of the recruitment and selection process, with the aim of employing qualified individuals and professionals in this sector.
• Employees’ personal data are processed to ensure the proper functioning of the employment relationship, compliance with the obligations between the parties and compliance with employment legislation.
5.3 Legal Basis for Data Processing
We inform you that, pursuant to Article 5, point 8, Article 7 and Articles 22 and 23 of Law No. 124/2024 “On Personal Data Protection,” the personal data you provide will be processed in accordance with the applicable legislation, the legal processing criteria and the rights and obligations arising therefrom.
• Your consent, particularly in your capacity as a website visitor, a visitor to the company’s office premises, a job applicant/candidate or an employee of the company;
• The contractual relationship between you and Innovaway Albania Sh.p.k. This applies particularly if you are an employee, a customer, the subject of a customer with which the company has a service agreement, or a partner/collaborator of Innovaway Albania Sh.p.k.;
• Compliance with our legal and regulatory obligations, primarily with reference to commercial legislation; civil-law legislation governing legal relationships between the parties, contracts and obligations; employment legislation and procedures; and tax and banking legislation, which determine the purposes of any processing activity or procedure that we are required to carry out in accordance with these laws;
• Our legitimate interests, particularly the protection of our offices and premises and the physical integrity of our employees and visitors through CCTV monitoring of the premises.
Within the framework of the processing, the following secondary legislation approved by the Commissioner for the Right to Information and Personal Data Protection applies:
• Instruction No. 03, dated 30 April 2025, “On the Processing of Personal Data by Video- Surveillance Systems”;
• Instruction No. 11, dated 8 September 2011, “On the Processing of Employee Data in the Private Sector,” as amended;
• Instruction No. 12, dated 21 December 2011, “On Identity Checks at Building Entrances”;
• Instruction No. 19, dated 3 August 2012, “On Regulating the Relationship between the Controller and the Processor in Cases Where Data Processing Is Delegated and on the Use of a Standard Agreement in Such Cases,” as amended;
• Instruction No. 42, dated 22 July 2014, “On the Processing of the Personal Data of Job Candidates”;
• Decision No. 01, dated 30 April 2025, “On Determining the Countries That Ensure an Adequate Level of Personal Data Protection.”
5.4 Data Retention Period
6. Regarding the Processing of Data Through the Website Managed by the Parent Company, INNOVAWAY S.p.A., With Registered Office in Naples, Italy
This website processes data on the basis of consent. By using or consulting this website, visitors and users explicitly approve this Privacy Notice and consent to the processing of their personal data in accordance with the methods and purposes described below, including any disclosure to third parties where necessary for the provision of a service or compliance with a legal obligation.
The provision of data and, consequently, consent to the collection and processing of data are optional. The user may refuse consent and may withdraw consent already provided at any time. However, refusal to provide consent may make it impossible to provide certain services and may compromise the browsing experience on the website.
6.1 Personal Data
As a rule, the disclosure of personal data is not required in order to use our online services. If personal data, namely a name and email address, are collected within the scope of our online services, this is done, as far as possible, on a voluntary basis.
If you use the contact form to request printed materials or information, the information you provide will be used to process your request and will be retained for subsequent use in the event of follow-up questions. If necessary for the purpose of processing your request, we may also transmit your personal data to other companies within the INNOVAWAY Group or to third parties involved, such as technical or commercial consultants. Your personal data will be retained for the duration of the processing of the request and for a maximum period of one year following completion of the processing, unless longer retention is legally permitted on other grounds.
For data-security purposes and to optimise ease of use, we also collect non-personal data relating to the use of our online services.
6.2 Browsing Data
Like all websites, this website also uses log files in which information collected automatically during users’ visits is stored. The information collected may include the following:
• Internet Protocol address (IP address);
• Browser type and the settings of the device used to connect to the website;
• Name of the Internet Service Provider (ISP);
• Date and time of the visit;
• The website from which the visitor arrived, namely the referrer, and the exit page;
• Where applicable, the number of clicks.
The above information is processed automatically and collected exclusively in aggregate form in order to verify the proper functioning of the website and for security purposes.
For security purposes, such as spam filters, firewalls and virus detection, automatically recorded data may also include personal data such as an IP address. In accordance with applicable laws, these data may be used to block attempts to damage the website itself, cause harm to other users or otherwise carry out harmful activities or activities constituting a criminal offence.These data are never used to identify or profile the user, but solely to protect the website and its users. This information will be processed on the basis of the owner’s legitimate interests. The data collected by the website during its operation are used exclusively for the purposes specified above and are retained for the period necessary to carry out the specified activities. Under no circumstances will the data collected by the website be provided to third parties for any reason, unless there is a legitimate request from a judicial authority and only in the cases provided for by law. Data used for security purposes, namely to block attempts to damage the website, are retained for seven days.
6.3 Cookies
Cookies are items of information stored by the browser when a website is visited using any suitable device, such as a PC, tablet or smartphone. Each cookie contains different data, for example the name of the server from which it originates, a numerical identifier, etc. A cookie may remain on the system for the duration of a session, until the browser is closed, or for longer periods, and may contain a unique identification code.
Cookies are used for different purposes depending on their type. Some are essential for the proper functioning of a website, namely technical cookies, while others optimise its performance to provide a better user experience or make it possible to obtain statistics on the website and its use, such as analytical cookies. Others make it possible to display personalised advertisements, such as profiling cookies.
By using the website, the visitor expressly accepts the use of cookies.
6.3.1 Disabling Cookies
Cookies are linked to the browser used and may be disabled directly through the browser, thereby refusing or withdrawing consent to the use of cookies. It should be noted that disabling cookies may prevent certain functions of the website from operating correctly.
6.3.2 Third-Party Cookies
This website also acts as an intermediary for third-party cookies used to provide visitors with additional services and features and to improve use of the website, such as social-media buttons or videos. This website has no control over third-party cookies, which are managed entirely by the respective third parties. Consequently, information about the use and purposes of these cookies, as well as how to disable them, is provided directly by the third parties on the pages specified below.
6.3.3 Social-Network Plug-ins
This website also includes plug-ins and/or buttons for social networks to facilitate the sharing of content on your preferred social networks. These plug-ins have been programmed so that they do not install any cookies when you access the page, in order to protect user privacy. Cookies are installed, where provided by the social networks, only when the user actually and voluntarily uses the plug-in. Please note that if the browser user is logged in to the social network, the user has already consented to the use of the cookies transmitted through this website at the time of registering with the social network.
The collection and use of information obtained through the plug-in are governed by the respective privacy policies of the social networks, to which you are kindly requested to refer:
• Facebook - (cookie information link)
• Twitter - (cookie information link)
• LinkedIn - (cookie information link)
• Google+ - Youtube (cookie information link).
6.4 Transfers
This website may share some of the data collected with services located outside the European Union. In particular, data may be shared with Google, Facebook and Microsoft (LinkedIn) through social plug-ins and the Google Analytics service. The transfer is authorised on the basis of specific decisions of the European Union and the Personal Data Protection Authority, in particular EU-US Data Privacy Framework – DPF and Decision No.1, dated 30.04.2025 "On determination of countries which ensure an adequate level of personal data protection ), for which no further consent is required. The companies mentioned above guarantee their compliance with the EU-US Data Privacy Framework – DPF.
6.5 Security Measures for the Website
This website processes users’ data lawfully and fairly, using appropriate security measures to prevent unauthorised access to, disclosure, alteration or destruction of the data. Processing is carried out using IT and/or telematic tools, with organisational methods and logic strictly related to the purposes specified.
7. Rights of the Data Subject
Pursuant to Articles 13–21 of Law No. 124/2024 “On Personal Data Protection,” you have rights concerning your personal data, in accordance with the methods and within the limits established by the legislation currently in force, and you may request additional information concerning the processing of your personal data at any time. You have the following rights:
• The right to be informed (Article 13);
• The right of access (Article 14);
• The right to rectification or erasure (Article 15);
• The right to be forgotten (Article 16);
• The right to restriction of processing (Article 17);
• The right to data portability (Article 18);
• The right to object (Article 19);
• The right not to be subject to automated decision-making (Article 20);
• The right to lodge a complaint (Article 86);
• More generally, the right to exercise all rights recognized by the provisions of the law currently in force.
Requests must be addressed to the relevant Data Controller by writing to the following addresses:
1. For requests or complaints concerning personal data processed locally as part of the processing operations carried out by INNOVAWAY ALBANIA Sh.p.k., please contact: [email protected].
2. For requests or complaints concerning personal data processed through the website, please contact: [email protected].
Where data are processed on the basis of legitimate interests, the rights of data subjects are guaranteed, with the exception of the right to data portability, which is not provided for by the regulations. This applies in particular to the right to object to processing, which may be exercised by submitting a request to the Data Controller.
8. Security Measures
Security measures are essential to protect personal data, preserve integrity and comply with legal and ethical standards. Our company operates in accordance with Albanian and European data-protection legislation and has established the necessary policies and rules.
We ensure privacy and the protection of personal data by securely storing your information and obtaining your informed consent before collecting data. Personal information will not be disclosed to any person outside the company. Individuals have the rights provided for by applicable law, including the right to access, rectify and erase their data.
To protect personal data and preserve the integrity of processing activities and operations, we implement the following measures:
• Data Storage – We use encrypted data-storage methods, secure servers and restricted access to protect personal data.
• Access Control – We implement strict access controls to restrict access to personal data, ensuring that only authorized personnel may view, access, erase or modify specific information or data.
• Physical Security of Equipment/Premises – The equipment and premises where we store personal data are located in a secure environment with restricted physical access, such as locked cabinets and rooms.
• Data Retention Policy – We have established rules concerning data-retention periods and secure erasure in order to mitigate the risk of unauthorized access to data.
• Data-Security Training – Before commencing their duties, the relevant personnel receive training in data protection and are regularly updated on our specific data- management standards, practices and protocols relating to data security.
9. Privacy of Minors
Our website is intended for the general public and does not offer services intended for children. If we become aware that a minor has provided us with personal data without the authorisation of a parent or guardian, we will erase this information immediately.
10. Data Controller and Data Protection Officer
1. The Data Controller is INNOVAWAY ALBANIA Sh.p.k., with registered office at: Municipal Unit No. 9, “Jordan Misja” Street, Gener 2 Building, First Floor, Unit D, Apartment 1, Tirana, Albania.
The Data Protection Officer (DPO) may be contacted at: [email protected].
2. With regard to data processed through the website, the parent company, INNOVAWAY S.p.A., and INNOVAWAY ALBANIA Sh.p.k. are considered “Joint Controllers.”
INNOVAWAY S.p.A. has its registered office at Via G. Porzio No. 4, Centro Direzionale Isola G1, 80143 Naples, Italy.
The Data Protection Officer (DPO) may be contacted at: [email protected].
11. Changes to This Privacy Policy
The Data Controller reserves the right to make changes to this Privacy Policy at any time by notifying data subjects and users through this website. You are therefore kindly requested to consult this page frequently, referring to the date of the most recent amendment indicated at the bottom.
Updated as of 06/01/2026
Innovaway Albania Sh.p.k_Politika e Privatesise Shqip dt 28 07 2026
