1. Introduction

Vlora Marina Residences SH.P.K is pleased to welcome you to the section dedicated to our personal data processing policy (referred to as the “Privacy Policy”).

“Personal data” refers to any information related to an individual, identified or identifiable, directly or indirectly, particularly by reference to an identification number or one or more specific factors of their physical, physiological, mental, economic, cultural, or social identity (referred to hereafter as “Personal Data” or “Data”).

Whether you are a client (seller or buyer, lessor or lessee), a person seeking information on a particular matter or service (visitor), a partner, agent, shareholder, or, more generally, a contact of Vlora Marina Residences SH.P.K, or a job applicant or employee, we recommend carefully reading the “Privacy Policy” as it contains important information regarding “your personal data,” particularly regarding its use, categories of data, processing purposes, security measures, as well as the rights and remedies available to you.

If you believe any essential element is missing concerning the points outlined above, do not hesitate to contact us at the following address: sales@balfinrealestate.com

 

2. Who is the Controller?

The “Controller” refers to the natural or legal person who determines the purposes and means of processing Personal Data (the “Controller”), as defined in Article 3 of Law No. 9887, dated 10.03.2008 “On the Protection of Personal Data.”

For the purpose of managing relationships with clients (sellers or buyers, lessors or lessees), individuals seeking information on a specific issue or service (visitors), partners, or agents, Vlora Marina Residences SH.P.K has engaged Balfin Real Estate SH.P.K, a limited liability company organized under Albanian law, headquartered at Bajram Curri Boulevard, ETC Business Center, Eighth Floor, Units 131-134, Tirana, registered with the National Business Center under NUIS L81507052H. This company is responsible for collecting and processing personal data communicated by any individual through the communication channels provided on this website.

For managing relationships with job candidates or employees, Vlora Marina Residences SH.P.K has engaged Balfin Development SH.P.K, a limited liability company organized under Albanian law, registered with the National Business Center under NUIS M22119033A, and headquartered at: “Tish Daija” Street, Kika 2 Complex, Building 3, First  Floor. This company is responsible for collecting and processing personal data communicated by any individual through the communication channels provided on this website.

The Controller is Vlora Marina Residences SH.P.K, while the main processors are Balfin Real Estate SH.P.K and Balfin Development SH.P.K. They are responsible for the data collected and processed through the website, data processed in the context of sales and services offered, data processed via phone communications and social networks for customer service or marketing purposes, and data processed through the Zoho system provided by Zoho Corporation B.V., headquartered in the Netherlands (via a service agreement) for recruitment and human resources purposes. Additionally, data is processed through the CRM system of Odoo, provided by Odoo S.A., headquartered at Chaussée de Namur, 40, 1367 Grand-Rosière, Belgium (via a service agreement). This system supports the activities and work processes of Balfin Real Estate SH.P.K.

 

3. Who are the Data Subjects?

• Clients (sellers or buyers, lessors or lessees)
• Potential clients
• Interested individuals (website visitors)
• Partners/collaborators
• Shareholders
• Job applicants
• Employees
• Visitors to the company premises

Vlora Marina Residences SH.P.K has notified the Office of the Commissioner regarding the categories of data subjects, in compliance with Article 21 of Law No. 9887.

 

4. What Personal Data Do We Process?

We take care to inform you “repeatedly and continuously” about the nature of the data we process, the methods, purposes, security measures, and your rights in effect. Generally, the data is collected directly from you and with your consent as the data subject.

Vlora Marina Residences SH.P.K and its subsidiaries, in fulfilling their activity objectives, process the following categories of data:

• For Clients: in the context of implementing agreements and with their consent, the company administers the necessary documentation (Property Certificates and related ownership documentation, photocopies of identification documents such as passports or IDs, Brokerage Agreements, and Declarations of Income Sources). The company processes personal data and the information provided by the Client, including: Full name (first name, last name), date of birth, place of birth, Address, Personal identification number, Phone number, Email address.

These data are accessed manually through written property documentation and electronically through the CRM system (ODOOO) by the agent managing the client relationship and the office manager at Balfin Real Estate SH.P.K.

• For Job Applicants, through the website, under the “Careers” section, where job openings are posted, applicants submit their CVs and cover letters via the provided application link. During the initial phase, the following data will be processed:
  Name, surname, email, phone number, and date of birth (as included in the CV)
  Professional qualifications and work experience Applications and data are processed electronically via the Zoho platform, contracted by the company through a service agreement with Zoho Corporation B.V, headquartered in the Netherlands (EU). This platform ensures the security and confidentiality of your data with the highest standards in accordance with EU legislation.

The processed data is electronically accessed only by recruitment specialists and the Director of the Human Resources Department at Balfin Development Sh.P.K., who are responsible for selecting and interviewing candidates, reviewing documentation, and communicating with successful candidates.

Job postings may also be published on external websites, including www.duapunë.al, www.njoftime.com, www.balfin.al, as well as on LinkedIn.

• For Employees, the following data is processed: name, surname, email, phone number, educational background, signature, salary, bank account number, ID, professional qualifications and work experience, data regarding work abilities and health, residential address, marital status, criminal record, photo.

These data are accessed both manually and electronically (via platforms such as Zoho, email, etc.) by the Human Resources Department at Balfin Development Sh.P.K.

• For Interested Individuals/Visitors, through the website’s “Contact” section, which allows users to request service information, submit complaints, or inquire about professional services, the following data is collected: name, surname, email, phone number. Whether they are Albanian citizens (with a “yes” or “no” option for statistical purposes) as well as the message they send.
• For Partners/Collaborators, data processed through collaboration agreements, physically archived at the company’s premises, include: name, surname, position, contact number, email, signature.
• For Employees and Visitors in Company Offices, data is also processed through the CCTV camera system installed in the company’s offices.
• Potential clients are individuals who express interest and contact the company via email, the website, or social media. With their consent, they provide: name, surname, phone number or email.

This data is for the sole and exclusive use of Vlora Marina Residences SH.P.K.

5. Purposes for Processing Personal Data

The purposes for processing your personal data depend on the relationship that “data subjects” maintain with Vlora Marina Residences SH.P.K and the services offered by the company.

• The personal data and information managed through the relevant legal documentation submitted by the client, in the context of mediation and real estate purchases, will be processed for these lawful purposes:
• For the management of the mediation relationship and the sale-purchase contract for the real estate and to provide quality and accurate service to the client;
• For market research and statistical purposes by the company;
• For compliance with applicable legislation regulating the real estate sector and affecting its activities (such as legislation on the profession of mediation, tax legislation, legislation on the prevention of money laundering and terrorist financing, etc.);
• For post-sale client contact purposes and marketing of various offers that may present investment opportunities.
• Personal data of job candidates will be processed in the context of conducting the selection and interview process, aiming to employ qualified individuals and professionals in this sector.
• Personal data of employees is processed in the context of maintaining the employment contractual relationship, their ongoing training, respecting obligations between the parties, and compliance with legislation regulating these relationships.
• Personal data of interested parties (website visitors) is processed to inform them about the services of Vlora Marina Residences SH.P.K, information about projects and real estate of interest, handling potential requests and complaints regarding services, as well as analysing the quality level of services.
• Personal data of partners/collaborators is processed in the context of maintaining specific contractual relationships and services obtained between the parties.
• Personal data of potential clients is processed for advertising properties they may be interested in buying or renting.
• Personal data of agents is processed to ensure service quality and standards, unify practices, adhere to contracts and agreements with them, provide continuous professional training, ensure compliance with rules of ethics, good and transparent practices, and legislation regulating and governing this sector, avoiding abusive practices and preventing money laundering and terrorist financing.
• Data obtained from the CCTV system in company premises for visitors and employees is processed to ensure their physical safety, as well as the security of assets and monetary values.

 

6. Criteria/Legal Basis for Processing Personal Data

The company Vlora Marina Residences SH.P.K processes personal data lawfully, respecting the legal criteria for processing:

• Your consent, particularly in your capacity as a client, job candidate, employee, agent, interested person, or contact of Vlora Marina Residences SH.P.K;
• The contractual relationship between you and Vlora Marina Residences SH.P.K or its affiliated agencies. This particularly applies if you are a client (seller, buyer, landlord, or tenant), employee, or other party to any transaction conducted with Vlora Marina Residences SH.P.K;
• Compliance with our legal and regulatory requirements, mainly referring to commercial legislation, legislation regulating civil legal relationships, contracts, and obligations in this field, employment-related procedures, tax and banking legislation, as well as legislation in the field of anti-money laundering and counter-terrorism financing, which define the purposes of each processing action or procedure we must carry out in accordance with them;
• Our legitimate interests, especially in the context of protecting our offices and premises and the physical integrity of our employees and clients (video surveillance). This applies to agencies with installed CCTV systems.

 

7. How Long Are Data Retained?

Your personal data will not be retained in a form that enables your identification beyond the time period necessary for the purposes for which the data is processed, in accordance with our contractual, legal, and regulatory obligations and requirements:

• Client data processed in the context of contractual and mediation relationships will be retained for 10 years, starting from the termination date of the business relationship between the company and the client (i.e., the end date of the contract/agreement), in accordance with Law No. 9917, dated 19.05.2008, “On the Prevention of Money Laundering and Terrorist Financing,” as amended. Based on this law, documentation and data may be retained longer if requested by the responsible authority (General Directorate for the Prevention of Money Laundering (DPPPP)).

After this period, data managed in physical archived documentation will be destroyed by the agency using shredding machines, while data stored electronically will be permanently deleted.

• Job candidate data will be retained until the completion of the competition process for the vacant position. Once the successful candidate is selected, the data will be destroyed.
• Employee data will be retained throughout the employment relationship and up to two years after termination, corresponding to the period during which the employee can raise legal claims in court against the employer.
• Data from interested parties/website visitors, related to inquiries or complaints, will be retained as long as necessary to address their purpose (i.e., until the inquiry or complaint is resolved), after which it will be deleted or destroyed. Typically, these cases are handled within 30 days.
• Partner/collaborator data will be retained as long as the collaborative relationship exists and up to five years after its termination, to account for possible civil legal claims.
• Agent data will be retained as long as the contract is valid and up to two years after its termination, for potential civil legal claims.
• Training participant data will be retained as long as the subject holds the status of agent, manager, or employee as part of Vlora Marina Residences SH.P.K, after which it will be deleted.
• CCTV data will be retained based on the server’s capacity, but for no longer than two months.
• Data from interested persons via the website, phone, or social media will be retained for up to 60 months if no concrete relationship is established with them.

 

8. Security Measures

Data security is essential for protecting information and personal data, preserving integrity, and complying with legal and ethical standards. Our company operates in compliance with the current legislation on personal data protection and has established the necessary policies and systems to achieve this goal.

We have implemented strict security measures to reduce the risk of data breaches and misuse of your personal data, such as unauthorized disclosure and unauthorized access to your data.

We ensure privacy and personal data protection by safeguarding your data and obtaining your informed consent before collecting any information. Personal information will not be disclosed to anyone outside the company. Individuals have rights under applicable legislation, such as the right to access, correct, and delete their data.

To protect personal data and maintain the integrity of processing activities, we implement the following approaches:

Data Storage – We use encrypted storage solutions and restricted-access databases to safeguard personal data.

Access Control – We enforce strict access controls to limit access to personal data, ensuring only authorized personnel can view, modify, or delete specific information or data.

Secure Communication Channels – We use secure channels for the exchange/communication of information, including encrypted email services, to prevent data interception.

The equipment/premises where we store personal data are located in a secure environment with restricted physical access (e.g., a locked room).

We use firewalls, strong passwords, antivirus programs, and other measures to protect personal data, including encryption and pseudonymization.

Data Retention Policy – We have adopted rules for data retention periods and safe disposal to mitigate the risk of unauthorized access to outdated (expired retention period) or unnecessary data.

Data Security Training – Before starting their duties, relevant personnel are trained and certified in data protection, updated on our data security standards and rules, practices, and protocols for managing specific data.

 

9. Who Are the Recipients of Your Personal Data?

The recipients of your data are as follows:

• Authorized personnel, employees of the company, in accordance with their job responsibilities, authorized to process data solely for the purposes mentioned above in the company’s Vlora Marina Residences SH.P.K, Balfin Real Estate SH.P.K, and Balfin Development SH.P.K.

• Service providers involved in managing our relationship with you, particularly for purposes such as communication, document transmission, and electronic management, such as ODOO and ZOHO.

ODOO is a company certified under ISO/IEC 27001:2013, an internationally recognized standard for Information Security Management Systems (ISMS). This certification ensures that ODOO has implemented strict controls and measures to protect information and data, ensuring confidentiality, integrity, and availability.

These companies, with whom we collaborate by delegating these services, are considered data processors under the relevant legislation.

• Competent public institutions, such as the Tax Directorate, Social Insurance Institute (ISSH), Labor Inspectorate, and judicial institutions, under the circumstances provided in the applicable legislation and upon their justified request.

• Banks with which we collaborate.

Vlora Marina Residences SH.P.K and its collaborators ensure compliance with a security and confidentiality policy that aligns with Law No. 9887, dated 10.03.2008, “On Personal Data Protection,” as amended, and its implementing sub-legal acts. They also adhere to the highest standards concerning personal data processing, equivalent to those in the European Union and the European Economic Area.

Employees of Vlora Marina Residences SH.P.K, Balfin Real Estate SH.P.K, and Balfin Development SH.P.K have signed Non-Disclosure Agreement to ensure the confidentiality of data they become aware of during their duties, which include penalties for breaches.

Under no circumstances will your personal data be subject to commercial transactions with third parties.

 

10. What Are Your Rights?

Under Articles 12-17 of Law No. 9887, dated 10.03.2008, “On Personal Data Protection,” as amended, you have several rights regarding your personal data and can request additional information about the processing of your personal data at any time.

Pursuant to Law No. 9887, dated 10.03.2008, “On Personal Data Protection,” as amended, regarding the personal data processed by Balfin Real Estate SH.P.K, you have the following rights:

• Right of Access – You have the right to request confirmation at any time as to whether your personal data is being processed by Vlora Marina Residences SH.P.K and to access this data and information regarding the purpose, duration, legal basis for processing, categories of data processed, and categories of recipients.
• Right to Request Blocking, Correction, or Deletion – If you are informed that your data is irregular, inaccurate, or false, or if it has been collected and processed in violation of the law, you have the right to request its correction, possible deletion, and the immediate cessation of processing.
• Automated Decision-Making – You have the right to request not to be subjected to decisions that produce legal effects or significantly affect you, where the decision is based on the automated processing of data.
• Right to Object – You have the right, under certain circumstances, to object to the processing of your personal data for specific purposes, in accordance with the provisions of Article 15 of Law No. 9887, dated 10.03.2008, “On Personal Data Protection.”
• Right to Complain – If you believe your rights, freedoms, or legitimate interests concerning personal data have been violated, you can submit a written complaint to our official address or email, published on our website.
• Right to Compensation – If you prove that damage has been caused to you as a result of the unlawful processing of personal data, you have the right to seek compensation under the rules established by the Civil Code.

A written request must include your signature and be accompanied by a valid copy of your identification document to prevent potential abuse by third parties.

Requests should be submitted in writing to the relevant address of Vlora Marina Residences SH.P.K, directed to the Data Protection Officer, or via email at: sales@balfinrealestate.com

You may exercise your rights freely.

Within 30 days of receiving your request, we will send you the requested information or provide the reason for the refusal or non-fulfilment of your request.

If dissatisfied with how your requests are handled by Vlora Marina Residences SH.P.K, you always have the right to address the Office of the Commissioner for Personal Data Protection at the address: Rr. “Abdi Toptani,” Building no. 5, Tirana. For further information, please visit the Commissioner’s website: www.idp.al.

If personal data processing is based on consent, you can withdraw it at any time.
To withdraw consent, you may contact us at: Email: sales@balfinrealestate.com, Phone Number: +355 69 801 4999

11. Changes to Our Privacy Policy

We regularly update our privacy policy to ensure its accuracy and relevance and reserve the right to modify its content if deemed necessary.

You will be informed of all changes and additions in a timely manner through our website, in accordance with the principle of transparency.

Last Update: 08.01.2025.