Privacy Policy
Effective date: 8 October 2026 · Last updated: 8 October 2026
This policy explains what personal data ILLYRIAN SH.P.K. ("Illyrian", "we", "us") processes when you use this website (illyrian-ks.com), why we process it, how long we keep it and what rights you have. We have written it in plain language.
In short
- The website collects the personal data that you send us through the contact form. As on every website, our server also receives technical data such as your IP address when you open a page, and it records attempts to sign in to the staff area.
- The website uses no analytics, no advertising trackers, no third-party embedded content and no newsletters. It does not send email.
- Contact form data is stored on a server operated by our infrastructure provider, Vultr (The Constant Company, LLC), in Frankfurt, Germany.
- A contact message is kept for 12 months after we received it and is then deleted.
- You can ask us for access, correction, deletion and other rights, and you can complain to the Information and Privacy Agency in Kosovo.
1. Who is responsible for your data
The controller is ILLYRIAN SH.P.K., a limited liability company in Prishtina, Kosovo.
- Phone: +383 46 112 111
- Email: info@illyrian-ks.com
Write to this email address for any privacy question or request.
2. What this policy covers
This policy covers this corporate website only. It does not describe how personal data is processed inside the platforms that Illyrian operates, such as eShkollori. Those are separate services.
When we refer to the "Data Protection Law" in this policy, we mean the Kosovo Law on the Protection of Personal Data, Law No. 06/L-082, as in force.
3. What we collect and why
3.1 The contact form
When you send us a message through the contact form, we store the following.
| Data | What it is |
|---|---|
| Name | The name you enter. |
| Email address | The address you enter, so that we can answer you. |
| Institution or organisation (optional) | The name of your school, institution or company, if you choose to enter it, so that we know whom your enquiry concerns. |
| Topic | The subject you choose for your enquiry, so that we can route it to the right person. |
| Message | The text you write. |
| Language | The language of the form you used (Albanian or English). |
| Time of privacy policy confirmation | The date and time at which you confirmed that you had read this policy before sending. It records that this policy was shown to you. It is not a request for your consent, and we do not rely on consent to answer your message. |
| Keyed hash of your IP address | A one-way value calculated from your IP address using a secret key that we hold. We do not store your IP address in readable form in the contact record. We use the value only to recognise repeated or automated submissions, and also for short-lived counters that limit how many messages one connection can send. Those counters are deleted within 2 days. We still treat the value as personal data. |
| User agent | The text your browser sends to describe itself, such as the browser and its version. We use it, together with the hash, for the same purpose. |
| Status and dates | Internal fields that our staff use to handle the message (for example, whether it is new, read or answered), with the related dates. |
| Staff notes | Free text that our staff may add while handling your message. It can quote or summarise what you wrote. |
| Event record | A short entry in our activity log saying that a message arrived, with its topic and an internal reference. It does not contain your name, email address or IP address, and it stays after the message is deleted. |
To stop abuse, the form limits how many messages one connection can send per hour and per day, and it rejects messages sent implausibly fast. If you are blocked by mistake, write to info@illyrian-ks.com or call +383 46 112 111.
Please do not include sensitive information in your message, such as health information or political or religious views, or personal data about other people. We do not need it to answer you.
3.2 Technical data when you visit the website
Whenever you open a page, your browser sends technical data to the server that delivers the website, such as your IP address, the date and time, the address you requested and information about your browser. The server processes this data to deliver the page and to keep the website secure. It is kept in technical server logs for 15 days and is then deleted by routine log rotation. We do not use it for analytics or to build profiles.
3.3 Staff sign-in
The website has a sign-in area that is only for authorised Illyrian staff. Every attempt to sign in, successful or not, is written to a security log with the date and time, the IP address and a description of the browser of the device making the attempt and, where the account exists, the account concerned. This applies to anyone who tries to sign in, including a visitor who opens the sign-in page by mistake. We keep this log for 12 months to detect and stop break-in attempts (our legitimate interest in security, section 4). When staff sign in, strictly necessary cookies are used. They are described in our Cookie Information.
3.4 If you contact us directly
If you write to info@illyrian-ks.com or call +383 46 112 111 instead of using the form, we process what you tell us (your contact details and the content of your message) in order to answer you. Replies by email are sent from our ordinary email system, outside this website. Correspondence that continues by email is kept in our mailbox for as long as needed to handle it and is then deleted. We review and delete it at least once a year.
3.5 What we do not do
- We do not use analytics tools.
- We do not use advertising or cross-site tracking technologies.
- We do not load embedded content from third parties, such as videos, maps or social media widgets.
- We do not run a newsletter or mailing list, and we do not use your data for direct marketing.
- The website does not send email. In particular, it does not send you an automatic confirmation of your message. A member of our staff reads the message, and any reply comes from our ordinary email address.
- We do not offer accounts to visitors.
- We do not take decisions about you based solely on automated processing, and we do not profile you.
- We do not sell your data.
4. Why we use your data and on what legal basis
| Purpose | Legal basis in the Data Protection Law |
|---|---|
| Answering your enquiry. | Our legitimate interest in answering messages addressed to us (Article 5(1), point 1.6). Where you ask us to take steps towards a contract, the processing is also necessary for those pre-contract steps (point 1.2). |
| Preventing abuse of the contact form, such as spam and automated or repeated submissions. | Our legitimate interest in keeping the form usable and safe (point 1.6). |
| Keeping the website and our systems secure, including logging sign-in attempts. | Our legitimate interest in security (point 1.6). |
| Complying with the law, answering lawful requests from competent authorities, and establishing, exercising or defending legal claims. | A legal obligation that applies to us (point 1.3) or our legitimate interest in protecting our legal position (point 1.6). |
We rely on legitimate interests only where they are not overridden by your interests, rights and freedoms. We limit the data we collect to what the form needs, and you can object (see section 10).
5. Who receives your data
- Our staff. Only authorised staff who handle enquiries or administer the website, and only as needed for their work.
- Our infrastructure provider, Vultr (The Constant Company, LLC). It operates the server on which the website and its database run, and processes the data on our behalf under written terms.
- Authorities, courts and our professional advisers. Where the law requires it, or where it is needed to establish, exercise or defend legal claims.
The contact form does not use a third-party bot check, and the website does not load services from third parties. We do not share your data for advertising or marketing.
6. Where your data is stored
Contact form data is stored on a server operated by Vultr (The Constant Company, LLC) in Frankfurt, Germany. Authorised staff in Kosovo access it over encrypted connections. The server is located in Germany, a member state of the European Union; the provider is a company based in the United States.
7. How long we keep your data
- Contact messages. We keep a contact message for 12 months after the day we received it, and then delete it automatically. Messages that we mark as spam are deleted after 30 days.
- Technical values of a message. The keyed hash of your IP address and the user agent are removed from the record 30 days after we received the message. The message itself stays until the period above ends.
- Sign-in security log. 12 months (section 3.3).
- Longer retention. Only where the law requires it, or where we need the data to establish, exercise or defend legal claims. In that case we limit access to what is necessary.
- Technical server logs. 15 days, and then deleted by routine log rotation.
- Backups. Backups of the database are kept for 30 days. When we delete a record, it disappears from backups when the backup that contains it expires.
8. How we protect your data
We use technical and organisational measures that are appropriate to the risk. They include limiting access to authorised staff, requiring authentication for the staff area, serving the website over an encrypted connection (HTTPS), storing your IP address only as a keyed hash in the contact record, and collecting only the data the form needs.
No system is completely secure. If a personal data breach occurs that is likely to put people's rights at risk, we will act as the Data Protection Law requires, including notifying the Information and Privacy Agency and, where required, the people affected.
9. Your rights
Under the Data Protection Law you have:
- The right of access to your personal data and to a copy of it (Article 14).
- The right to correction of data that is inaccurate or incomplete (Article 15).
- The right to erasure in the cases the law provides (Article 16).
- The right to restriction of processing in the cases the law provides (Article 17).
- The right to portability (Article 19), which applies only where processing is based on consent or on a contract and is carried out by automated means. Because we process contact messages on the basis of our legitimate interests, it will usually not apply, but we will give you a copy of your data in a commonly used electronic form if you ask for access (Article 14).
- The right to object to processing (Article 20). See section 10.
- The right to complain to the supervisory authority (Article 52). See section 11.
These rights are not absolute, and the law sets conditions and exceptions for each of them.
To exercise any of these rights, email info@illyrian-ks.com. We answer without undue delay and in any case within one month. If your request is complex or we receive many requests, the law allows us to extend that period by up to two further months, and we will tell you within the first month if we do. If we do not act on your request, we will tell you why within one month and explain that you can complain to the Information and Privacy Agency and go to court.
The first copy of your data is free of charge. We may charge a reasonable administrative fee for further copies, and we may charge a reasonable fee for, or refuse to act on, a request that is manifestly unfounded or excessive. In that case we must be able to show why. If we have reasonable doubts about who you are, we may ask for additional information to confirm your identity.
Because we store your IP address only as a keyed hash, it helps us if you tell us the email address you used and roughly when you wrote, so that we can find your message.
10. Your right to object
You have the right to object at any time, on grounds relating to your particular situation, to processing that we base on our legitimate interests (section 4). If you object, we will stop that processing unless we can show compelling legitimate reasons that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims. To object, email info@illyrian-ks.com. We do not use your data for direct marketing.
11. Complaints
You have the right to complain at any time to the Information and Privacy Agency (Agjencia për Informim dhe Privatësi), the independent authority that supervises personal data protection in Kosovo. Its website is aip.rks-gov.net. This right does not affect your other administrative or judicial remedies, including the possibility of going to court. We invite you to contact us first so that we can resolve your concern, but you do not have to do so before you complain.
12. Do you have to give us your data?
No. Using the contact form is voluntary. The fields marked as required on the form are needed so that we can answer you. If you leave them out, we cannot process the message. You can also contact us by email or phone.
13. Children
This website is not directed at children. If you believe that a child has sent us personal data through the contact form, write to us and we will delete it.
14. Links to other websites
The website links to eshkollori.com, the public website of the eShkollori platform, and may link to other websites. Each of them has its own privacy information. When you follow a link, your browser connects to that website, and this policy does not apply there.
15. Principles we follow
We process personal data in line with the principles in Article 4 of the Data Protection Law: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.
16. Changes to this policy
We may update this policy when our practices or the law change. The "Last updated" date at the top shows the latest version. If we make a significant change, we will announce it on the website. The Albanian and English versions of this policy are both published. If they differ, the Albanian version prevails.
17. Contact
- ILLYRIAN SH.P.K., Prishtina, Kosovo
- Phone: +383 46 112 111
- Email: info@illyrian-ks.com