Privacy Policy

Who we are

drh.al is a digital agency based in Albania. For the purposes of the GDPR we are the data controller for personal data collected through this website. You can reach us at info@drh.al or on +355 68 204 1518.

What we collect, and why

When you submit a project enquiry

The project brief form collects your name, email address and project details, and optionally your phone number, company, website and an attached document. We use this to respond to your enquiry, prepare a proposal and keep a record of the conversation. The legal basis is our legitimate interest in responding to a business enquiry you initiated, and steps taken at your request prior to entering a contract.

We also store attribution data with your enquiry: the page you landed on, the page you submitted from, the referring site, any campaign (UTM) parameters, a coarse country and city derived at the network edge, and a device category. This tells us which channels produce genuine enquiries. It is business analytics, not profiling, and it is never used to make automated decisions about you.

When you subscribe to our newsletter

We store your email address, your language preference and where you subscribed from. Consent is the legal basis, and you can withdraw it at any time using the unsubscribe link in any email.

Analytics and advertising

We use Google Analytics 4, and may use Google Ads, Meta Pixel and Microsoft Clarity. None of these load until you accept the matching cookie category. If you reject optional cookies, no analytics or advertising script is loaded at all.

We also record a small number of first-party events — such as a case study being viewed or a contact link being clicked — without cookies and without any identifier that could single you out.

What we do not do

• We do not store full IP addresses for analytics. Rate limiting uses a one-way hash of your IP combined with a salt that rotates daily, which cannot be reversed to an address.
• We do not sell personal data.
• We do not use your project brief to train machine learning models.
• We do not send marketing email to people who only submitted a project enquiry.

Who processes data on our behalf

We use a small number of processors, each under a data processing agreement:

• Supabase — database and file storage for enquiries and website content.
• Resend — delivery of transactional email (your confirmation and our internal notification).
• Cloudflare Turnstile — spam protection on our forms.
• Vercel — website hosting and delivery.
• Google and Meta — analytics and advertising measurement, only with your consent.

Where a processor is outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses.

How long we keep it

• Project enquiries: up to 36 months from our last contact, so we can pick up a conversation that resumes later.
• Newsletter subscriptions: until you unsubscribe.
• Rate limiting hashes: deleted after 24 hours.
• Analytics data: according to the retention period configured in the relevant platform.

Your rights

You have the right to access, correct, delete, restrict or object to the processing of your personal data, and the right to data portability. Where processing is based on consent, you can withdraw it at any time. Email info@drh.al and we will respond within 30 days. You also have the right to complain to your local data protection authority — in Albania, the Information and Data Protection Commissioner.

Security

Data is transmitted over TLS and stored in a database protected by row level security, with access limited to authorised team members. Uploaded documents are stored in a private bucket that is not publicly readable.

Changes

If we change this policy we will update the date at the top of this page.