This policy explains what personal data we process when you visit this website or contact us, why, and what rights you have. It is provided under Albanian Law No. 124/2024 "On personal data protection" and, because we offer services to people in the European Union and the UK, Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR.
1. Who is responsible
The data controller is RockFole, Albania, trading as RockFole. Contact for all privacy matters: esla@rockfole.com.
2. What we collect and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Contact form: name, company (optional), email address, selected challenge, message | Replying to your enquiry and, if you wish, preparing a proposal | Art. 6(1)(b) GDPR (steps prior to a contract at your request); Art. 6(1)(f) (legitimate interest in answering business enquiries) | Up to 12 months after our last exchange if no engagement follows; otherwise for the duration of the contract and the statutory retention periods that apply to business records |
| Emails you send us directly | Same as above | Same as above | Same as above |
| Technical access data: IP address, date and time, requested page, browser user agent | Delivering the website securely, preventing abuse, diagnosing errors | Art. 6(1)(f) GDPR (legitimate interest in a secure, working website) | Short-term server logs kept by our hosting provider for security and operations |
Providing your name, email address and message is necessary for us to reply. We do not use your data for automated decision-making or profiling, and we do not sell it.
3. No cookies, analytics or tracking
This website does not use cookies, analytics, advertising pixels, social media plugins or third-party embeds. Fonts are served from our own domain, so no data is sent to font providers. See our cookie policy.
4. Who receives your data
We use the following service providers, bound by data processing agreements under Art. 28 GDPR:
- Netlify, Inc. (San Francisco, USA): website hosting and contact form processing. Form submissions are screened for spam using Akismet (Automattic Inc.).
- Google (Gmail): Google Ireland Ltd / Google LLC, which receives contact form notifications and stores the related email correspondence.
Where these providers process data outside the European Economic Area, transfers are protected by an adequacy decision (including the EU–U.S. Data Privacy Framework for certified providers) or by the European Commission's Standard Contractual Clauses (Art. 46 GDPR).
5. Your rights
You have the right to:
- access the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable format (Art. 20);
- object at any time to processing based on legitimate interest (Art. 21).
To exercise any right, email esla@rockfole.com. We respond within one month.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work. The authority responsible for us is the Information and Data Protection Commissioner of Albania (IDP).
6. Security
The website is served exclusively over HTTPS with modern security headers. Access to enquiries is restricted to the people who need it to reply.
7. Changes
We update this policy when our processing changes. The date at the top shows the latest version.