Privacy Policy

1. Introduction

[COMPANY NAME] ("we", the "Company") respects your privacy. This Policy explains what personal data ServisiJot (the "Platform") collects, why, who it is shared with, how long it is kept, and what your rights are.

It is written in accordance with Law No. 124/2024 "On Personal Data Protection" of the Republic of Albania, which is aligned with the EU General Data Protection Regulation (GDPR).

2. The data controller

The controller of the data described in this Policy is [COMPANY NAME], NIPT [NIPT], [ADDRESS], Albania. Privacy contact: [CONTACT EMAIL].

Please note: for the data a garage records in the software about its customers, vehicles, mechanics and suppliers, the garage itself is the controller and we are only a processor (see section 4). If you are a garage's customer and have questions about your data, please contact the garage.

3. The data we collect

3.1 Visitors to the public map

You do not need an account to browse the map and the garage pages, and we do not store any personal data about you. However:

• your browser loads the map from OpenStreetMap, which receives your IP address;
• Cloudflare, which protects and delivers the Platform, processes your IP address and the technical details of the request for security purposes;
• the "Show current location" button uses your device's location only inside your browser, to centre the map; it is not sent to us.

3.2 Garages that register

• Request data: the garage's name, city, phone numbers, time zone, email and the optional message. The message only reaches us by email and is not stored on the Platform.
• Account data: email, password (stored only as a hash), language, and the date and version of the Terms accepted.
• Public page data: logo, name, descriptions, services, photos, opening hours, phone numbers, address and map location. These are published on the internet once we approve them.
• Subscription data: the plan, dates and recorded payments.
• Technical sign-in data: IP address, browser and session data.

4. The data garages keep about their customers

The software lets a garage record its customers (first name, last name, phone), vehicles (licence plate, VIN, year, mileage), work orders, payments and debts, notes and reminders, as well as its mechanics and suppliers.

For that data the garage is the controller, and we process it only to provide the service to the garage, on its instructions and under the Data Processing Agreement. We do not look at it, sell it or use it for any other purpose. Our administration panel does not display it; only authorised members of our team can access it, when strictly necessary for maintenance, technical support, a legal obligation or a written request from the garage, under a duty of confidentiality.

Requests from a garage's customers. If a customer asks a garage for a copy of their data, the garage writes to us and we export, for the garage, everything it holds about that customer (their details, vehicles, work orders, payments, notes and reminders). Every export we make is logged. When a garage deletes a customer, their name, phone, vehicles, notes and reminders are deleted; the work orders may stay for the garage's books, without the customer's name or the licence plate.

WhatsApp reminders are sent by the garage itself from its own device, after obtaining the customer's consent. The Platform only prepares the message.

5. How we use the data and the legal basis

Purpose	Legal basis
Reviewing a registration request and creating the account	Steps prior to entering a contract
Providing the software and the public page	Performance of the contract
System emails (account accepted, changes approved, subscription notices)	Performance of the contract
Recording sessions, protecting against unauthorised sign-ins	Legitimate interest in account security
Showing maps (OpenStreetMap) and protecting the Platform (Cloudflare)	Legitimate interest in making the Platform work and keeping it secure
Recording payments	Performance of the contract and legal obligations

We do not send marketing emails, we do not use analytics or advertising tools, and we do not build profiles of you.

6. Cookies

The Platform uses only cookies that are strictly necessary for it to work and stay secure. The full list is in the Cookie Policy.

7. Who we share the data with

We do not sell your data. We share it only with providers that help us run the Platform (sub-processors), each bound by a data protection agreement:

• [HOSTING PROVIDER] ([EU COUNTRY]): the servers and database where all the Platform's data is stored.
• Cloudflare, Inc. (USA): DNS and traffic protection. Processes the IP address and technical details of every request.
• Resend (USA): sending system emails. Processes the email address and the message content.
• OpenStreetMap Foundation (United Kingdom): map tiles and address search in the public page editor. Receives the IP address of the browser loading them.

Data may also be disclosed to public authorities where the law requires it, and to our professional advisers (lawyers, accountants) under a duty of confidentiality.

8. Transfers outside Albania

The data is stored in the European Union. Where a sub-processor is in the USA or the United Kingdom, the transfer relies on recognised safeguards: adequacy decisions (for the United Kingdom, and for companies certified under the EU–US Data Privacy Framework) or the standard contractual clauses approved by the European Commission.

9. Security

We use technical and organisational measures to protect the data: encrypted connections (HTTPS), passwords stored only as hashes, separation of each garage's data from the others, sessions that end after inactivity, the ability to block accounts, and access limited to those who need it.

If a data breach occurs that poses a risk to you, we will notify the Commissioner within 72 hours and notify you without undue delay, as the law requires.

10. How long we keep the data

• Rejected registration requests: deleted immediately.
• The account and public page: for as long as the account is active.
• After the subscription expires: the account is deleted 7 days (trial plan) or 30 days (paid plan) after expiry, and all its data, photos included, is permanently deleted 7 or 30 days later.
• Data a garage deletes itself (clients, vehicles, orders, notes, etc.): permanently deleted 7 or 30 days after deletion, depending on the plan.
• Sessions: until you sign out or the session expires.
• Technical server logs: 30 days.
• Registration request emails: 12 months.
• Backups: [X] days, after which they are overwritten.

11. Your rights

Under the law you have the right to:

• access your data and receive a copy of it;
• rectify inaccurate or incomplete data;
• erase your data when there is no longer a reason to keep it;
• restrict processing in certain circumstances;
• receive your data in a machine-readable format (portability); on request, we send a garage a copy of all its data;
• object to processing based on our legitimate interest;
• withdraw consent, where processing is based on it.

To exercise these rights write to us at [CONTACT EMAIL]. We will reply within 30 days and may ask you to confirm your identity. Exercising your rights is free, unless a request is manifestly unfounded or excessive.

12. Complaints

You have the right to complain at any time to the Commissioner for the Right to Information and Personal Data Protection (www.idp.al). We would appreciate the chance to address your concern first.

13. Changes to this Policy

We may change this Policy. The date of the version in force is shown at the top of the page. When it changes, registered garages must accept the new version the next time they sign in.

14. Contact us

For any question about this Policy or your data, write to us at [CONTACT EMAIL].