Legal

Privacy Policy

Last updated: May 4, 2026

This Privacy Policy explains how drh.al ("we", "us", "our") collects, uses, and protects your personal data when you visit our website or contact us. We comply with the EU General Data Protection Regulation (GDPR — Regulation 2016/679) and Albanian Law No. 9887 "On the Protection of Personal Data" as amended.

1. Data controller

The data controller is drh.al. You can contact us for any privacy-related question at info@drh.al or +355 68 204 1518.

2. What data we collect

We only collect what we need to operate the site and respond to you.

a) Information you give us

Contact form / project inquiries: name, email, optional company name, message, services of interest, budget range, timeline, and the page you submitted from.

b) Information collected automatically (analytics)

Anonymous session identifier stored in your browser's sessionStorage (cleared when you close the tab).
Pages visited, referring URL, time of visit.
Device information: browser, operating system, device type, screen width, language.
Approximate location derived from your IP address (country, region, city) and the IP address itself.

We do not use third-party advertising trackers, do not sell your data, and do not build advertising profiles.

3. Why we use your data (legal basis)

Respond to inquiries and deliver services — Art. 6(1)(b) GDPR (steps prior to a contract).
Site analytics, security and abuse prevention — Art. 6(1)(f) GDPR (legitimate interest in keeping the service working and secure).
Legal compliance — Art. 6(1)(c) GDPR (e.g. accounting, responding to lawful requests).

4. Cookies and similar technologies

We use only strictly necessary storage. A random session ID is stored in your browser's sessionStorage to count unique visits and detect live presence. We do not set advertising or cross-site tracking cookies, so no cookie banner consent is required for these.

5. How long we keep data

Project inquiries: up to 24 months after our last interaction, then deleted or anonymized.
Analytics pageviews and visitor sessions: up to 12 months, then aggregated or deleted.
Live presence records: session is considered offline after 60 seconds of inactivity.

6. Who we share data with

We share data only with processors strictly necessary to run the site:

Hosting & database infrastructure (Lovable Cloud / Supabase) — stores submissions and analytics on our behalf.
Email providers — when you contact us by email.

Some providers may process data outside Albania / the EEA. In such cases transfers are protected by Standard Contractual Clauses or an equivalent safeguard under Art. 46 GDPR.

7. Your rights

Under GDPR and Albanian Law No. 9887 you have the right to:

access your personal data and receive a copy;
rectify inaccurate data;
request erasure ("right to be forgotten");
restrict or object to processing;
data portability;
withdraw consent at any time, where processing is based on consent;
lodge a complaint with the Information and Data Protection Commissioner of Albania (IDP) at idp.al, or your local EU supervisory authority.

To exercise any of these rights, email info@drh.al. We respond within 30 days.

8. Security

Data is transmitted over HTTPS and stored with access controls and row-level security. We restrict admin access to authorized people and monitor for abuse. No system is 100% secure, but we apply industry-standard measures.

9. Children

The site is not directed to children under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

10. Changes

We may update this policy. The "Last updated" date above will reflect the latest version. Material changes will be highlighted on the site.