Home/Legal/Data protection
Data protection

Data protection policy

How ERAM Group collects, processes, stores, and protects personal data. Compliant with the General Data Protection Regulation (Regulation EU 2016/679 — GDPR) and Kosovo Law 06/L-082 on Personal Data Protection.

Draft template — legal counsel review required. This page is a structural draft prepared to the framework of GDPR (Regulation EU 2016/679), the EU Whistleblower Directive (2019/1937) where relevant, and applicable Kosovo law. It is not legal advice. Final text must be reviewed and approved by qualified legal counsel before publication.

1. Controller identity

The data controller responsible for the processing of your personal data is ERAM Group Ltd., a limited liability company incorporated in the Republic of Kosovo with registered office at Str. Bajram Gashi, no. 212, 14000 Lipjan (the "Controller", "we", "us", "our").

2. Data Protection Officer

The Controller has designated a Data Protection Officer (DPO) under Article 37 GDPR. The DPO can be contacted at:

  • Email: dpo@eram-group.net
  • Postal: Data Protection Officer, ERAM Group Ltd., Str. Bajram Gashi, no. 212, 14000 Lipjan, Republic of Kosovo

3. Categories of personal data we process

We process the following categories of personal data:

  • Identification data: name, professional title, employer.
  • Contact data: email address, postal address, telephone number.
  • Commercial data: purchase history, payment data, account history, contract terms.
  • Connection data: IP address, device identifiers, browser type, pages visited, timestamps.
  • Recruitment data: for candidates — CV, application materials, interview notes.

4. Purposes and legal bases for processing

We process personal data on the following bases under Article 6 GDPR and the corresponding Kosovo Law 06/L-082 provisions:

  • Performance of a contract (Article 6(1)(b) GDPR): to process orders, fulfil deliveries, provide service and warranty, administer B2B accounts.
  • Legitimate interest (Article 6(1)(f) GDPR): to operate and improve the website, prevent fraud, secure our IT systems, conduct B2B marketing to existing customers within the soft-opt-in.
  • Legal obligation (Article 6(1)(c) GDPR): to comply with tax, accounting, customs, and regulatory record-keeping obligations.
  • Consent (Article 6(1)(a) GDPR): for optional cookies, marketing communications to prospects, and any other processing where consent is the appropriate legal basis.

5. Recipients of personal data

Personal data may be shared with: (a) our processors providing IT infrastructure, payment processing, logistics, and email delivery, all under written data processing agreements compliant with Article 28 GDPR; (b) public authorities where required by law; (c) professional advisors (lawyers, auditors) under professional duties of confidentiality; (d) prospective acquirers in the context of a corporate transaction subject to confidentiality undertakings.

6. International transfers

Where personal data is transferred outside the European Economic Area or outside the Republic of Kosovo, transfers are made under appropriate safeguards including European Commission adequacy decisions, Standard Contractual Clauses, or other mechanisms permitted under Articles 44 to 49 GDPR.

7. Retention

Personal data is retained for no longer than is necessary for the purposes for which it was collected, subject to legal retention obligations. Specific retention periods are documented in our internal retention schedule and are available on request.

8. Your rights

Under GDPR Articles 15 to 22 and the corresponding provisions of Kosovo Law 06/L-082, you have the following rights in respect of your personal data:

  • Right of access (Article 15): obtain confirmation of whether we process your data and a copy of that data.
  • Right to rectification (Article 16): have inaccurate data corrected.
  • Right to erasure (Article 17): have your data deleted where the legal grounds apply.
  • Right to restriction of processing (Article 18).
  • Right to data portability (Article 20).
  • Right to object (Article 21) to processing based on legitimate interests or for direct marketing.
  • Right not to be subject to automated decision-making (Article 22), including profiling, that produces legal effects.
  • Right to withdraw consent at any time where processing is based on consent.
  • Right to lodge a complaint with the supervisory authority — the Information and Privacy Agency of the Republic of Kosovo (Agjencia per Informim dhe Privatesi).

To exercise any of these rights, contact our Data Protection Officer at dpo@eram-group.net. We will respond within one month of receipt of the request, as required by Article 12(3) GDPR.

9. Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, in accordance with Article 32 GDPR. Personal data breaches are reported to the supervisory authority within 72 hours where required under Article 33 GDPR, and to affected data subjects without undue delay where required under Article 34 GDPR.

10. Updates to this policy

We may update this policy from time to time. Material changes will be notified through the website and, where appropriate, by direct communication to affected data subjects.

Last updated: [date]. Version [x.y]. This document constitutes ERAM Group's data protection policy under Article 13 and Article 14 GDPR.