1. Introduction

Balfin Real Estate Shpk is pleased to welcome you to the space dedicated to our Personal Data Processing Policy (referred to as the “Privacy Policy”).
“Personal Data” refers to any information related to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identification number or one or more specific factors related to their physical, physiological, mental, economic, cultural, or social identity (hereinafter referred to as “Personal Data” or “Data”).

Whether you are a client (seller or buyer, lessor or lessee), a person seeking information on a specific matter or service (visitor), a partner, agent, shareholder, or more generally a contact of Balfin Real Estate Shpk, a job applicant, or employee, we recommend that you carefully read the “Privacy Policy” as it contains important information regarding your “Personal Data”, especially regarding their use, categories of data, purposes of processing, security measures, as well as the rights and remedies available to you.

Employees of Balfin Real Estate Shpk take the protection of personal data seriously and handle personal data with sufficient care and responsibility in the performance of their work and business activities. This privacy policy applies to all branches of Balfin Real Estate Shpk.
If you consider that any important element is missing from the above, please do not hesitate to contact our Data Protection Officer (“DPO”) at the following address: info@dpoalbania.al.

2. Who is the Controller?

The “Controller” refers to the natural or legal person who determines the purposes and the manner of processing Personal Data (“Controller”), as referred in Article 3 of Law No. 9887, dated 10.03.2008, “On the Protection of Personal Data.”

The Controller is the company Balfin Real Estate Shpk, for the data collected and processed through the website, data processed within the scope of sales activities and services offered, data processed through telephone communications and social media for customer service or marketing purposes, data processed through the Zoho system provided by Zoho Corporation B.V., based in the Netherlands (through the service contract) for recruitment and human resources purposes, as well as data processed through the CRM system of ODOOO provided by the company Odoo S.A., having its registered office at Chaussée de Namur, 40, 1367 Grand-Rosière, based in Belgium (through the service contract),which supports the operations and work processes of Balfin Real Estate Shpk.

Balfin Real Estate Shpk also collaborates with other companies within the Balfin Group that develop various construction projects (such as Green Coast, Rolling Hills 2, etc.), for the purpose of real estate sales realization, and is considered the “Processor.”

The registered office of Balfin Real Estate Shpk is located at: Boulevard “Bajram Curri, Business Center ETC, 8th floor, Units 131-134, Tirana, Albania.

3. Who are the Data Subjects?

• Clients (sellers or buyers, lessors or lessees).
• Potential clients.
• Interested individuals (website visitors).
• Partners/collaborators.
• Shareholders.
• Job candidates.
• Employees.
• Visitors to the company premises.

Balfin Real Estate Shpk has notified the Commissioner’s Office about the categories of data subjects, in compliance with Article 21 of Law No. 9887.

4. What Personal Data Do We Process?

We are careful to inform you “repeatedly and continuously” about the nature of the data we process, the methods, purposes, security measures, and your rights in effect. Overall, the data is collected directly from you and with your consent as the data subject.

Balfin Real Estate Shpk and any of its branches, within the scope of fulfilling its business activities, process the following categories of data:

• For clients: Balfin Real Estate Shpk, in the context of executing agreements and with their consent, will manage the necessary documentation (Property Certificate and property documentation, Photocopy of Identification Document – passport or ID, Brokerage Agreement, Income Source Declaration) and process the personal data and information provided by the Client, including general information (First name, Last name, Date of birth, Place of birth), address, personal identification number, phone number, and email address. These data are accessed manually through property documentation and electronically through the CRM system (ODOOO) by the agent managing the relationship with the client and the office manager.
• For job candidates: Through the website, the “Career” section, where vacant positions are published, and via the job posting link, each candidate submits their CV and Cover Letter. In this context, the following data will be processed in the initial phase: name, surname, email, phone number, date of birth (information contained in the CV), as well as data related to professional qualifications and experience. Applications and data are processed electronically via the “Zoho” platform, for which the company has contracted with Zoho Corporation B.V., based in the Netherlands (EU). This platform ensures the security and confidentiality of your data with the highest standards in compliance with EU legislation. Those data are accessed electronically only by the Recruitment Specialist and the Director of the Human Resources Department, responsible for selection and interviewing, reviewing documentation, and communicating with successful candidates.

Job announcements may also be published on websites such as www.duapunë.al, www.njoftime.com, www.balfin.al, and on LinkedIn.

• For employees: The following data are processed such as: first name, last name, email, phone number, educational background,  signature, salary, bank account number, ID, data about professional training and experience, data regarding work ability and health, home address, marital status, criminal record certificate, photo. These data are accessed manually and electronically (through the Zoho platform, email, etc.) by the Human Resources Department.
• For interested parties/visitors: Through the website, the “Contact” section, which allows them to receive information about services, submit complaints, or request professional services, collects data such as first name, last name, email, phone, whether they are Albanian nationals or not (with the option to select “yes” or “no” for statistical purposes), and the message they send.
• For partners/collaborators: Through cooperation agreements physically managed in the company’s archive, data such as name, surname, position, contact number, email, and signature are processed.
• For employees and visitors at the company’s offices: Data is also processed via the CCTV camera system.
• For potential clients: These are individuals who express interest and call or contact via email, website, or social media. With their consent, they provide data such as first name, last name, phone number, or email.

These data are for the exclusive and sole use of Balfin Real Estate Shpk.

5. Purposes for Processing Personal Data

The purposes for processing your personal data depend on the relationship that the “data subjects” have with Balfin Real Estate Shpk, as well as the services offered by the company.

• The personal data and information managed through the relevant legal documentation submitted by the client, within the scope of mediation and real estate transactions, will be processed for the following legitimate purposes:
  • To manage the mediation relationship and the sale-purchase contract for the real estate, and to provide quality and accurate service to the client.
  • For market research and statistical purposes by the company.
  • To comply with the applicable legislation regulating the real estate sector, and to ensure the proper operation of this sector (such as legislation on the profession of real estate brokers, tax legislation, anti-money laundering and counter-terrorism financing regulations, etc.).
  • For contacting clients after the sale of properties and marketing various offers in which they may be interested in investment.
• The personal data of job applicants will be processed within the selection and interview process, aiming to hire qualified individuals and professionals in this sector.
• The personal data of employees will be processed in the context of managing the employment contract, their continuous training, and ensuring compliance with obligations between the parties and the legislation that governs these relationships.
• The personal data of interested persons (website visitors) will be processed to inform them about Balfin Real Estate Shpk’s services, information about projects and real estate of interest, handling of inquiries and complaints regarding services, as well as analyzing the quality level of services.
• The personal data of partners/collaborators will be processed within the scope of managing specific contractual relationships and services provided between the parties.
• The personal data of potential clients will be processed for the purpose of advertising properties they may be interested in purchasing or renting.
• The personal data of agents will be processed to ensure the quality and service standards, unify practices, comply with contracts and agreements, provide continuous professional training, guarantee adherence to ethical rules, best practices, and transparency, as well as compliance with the legislation regulating and governing this sector, preventing abusive practices, money laundering, and terrorism financing.
• The data collected by the CCTV system at the company premises for visitors and employees will be processed to ensure their physical security, the safety of assets, and monetary values.

6. Criteria/Legal Basis for Processing Personal Data.

Balfin Real Estate Company processes personal data in a lawful manner, in accordance with the legal criteria for data processing.

• Your consent, particularly in your capacity as a client, job applicant, employee, agent, interested party, or contact of Balfin Real Estate Shpk;
• Contractual relationship between you and Balfin Real Estate Shpk or its affiliated agencies. This applies especially if you are a client (seller or buyer, lessor or lessee), employee, or any other party involved in a transaction with Balfin Real Estate Shpk;
• Compliance with our legal or regulatory obligations, primarily referring to commercial legislation, legislation governing civil legal relations, contracts, and obligations in this area, employment law, tax and banking legislation, anti-money laundering and counter-terrorism financing legislation, which determine the purposes of any processing activity or procedure we must carry out in accordance with these laws.
• Our legitimate interests, particularly within the scope of protecting our offices and premises and the physical integrity of our employees and clients (video surveillance). This applies to agencies that have installed a CCTV system.

7. How Long Are the Data stored?

Your personal data will not be kept in a form that allows identification beyond the time necessary for the purposes for which the data is processed, in accordance with our contractual, legal, and regulatory obligations and requirements.

• Client data: Data processed within the framework of contractual relationships and mediation will be retained for a period of 10 years from the date of completion of the business relationship between the company and the client (i.e., from the date of termination of this contract/agreement), in accordance with Law No. 9917, dated 19.05.2008 “On the Prevention of Money Laundering and Terrorist Financing,” as amended. According to this law, at the request of the responsible authority (DPPPP), the documentation and data may be retained for a longer period. After the expiration of this period, data managed in physical archival documentation will be destroyed by the Agency through shredding with a paper shredding device, while data stored electronically will be irreversibly deleted.
• Job candidate data: Data will be retained until the conclusion of the recruitment process for the vacant position. After the winner is selected, the data will be destroyed.
• Employee data: Data will be kept throughout the employment relationship and for up to two years after departure, corresponding to the period during which the employee has the right to raise legal claims in court against the employer.
• Interested parties/visitor data: Data collected via the website related to requests or complaints will be retained for as long as the purpose of processing exists (i.e., until the request or complaint is resolved). Afterward, they will be deleted or destroyed. Based on experience, these cases are usually processed within a period of 30 days.
• Partner/collaborator data: Data will be retained as long as the cooperation relationship exists and for up to five years after its termination, in the context of possible legal civil claims.
• Agent data: Data will be retained as long as the contract is in effect and for up to two years after its termination, in the context of possible legal civil claims.
• Trainee data: Data will be retained as long as the subject holds the status of an agent, manager, or employee as part of BALFIN REAL ESTATE SHPK, and will be deleted thereafter.
• CCTV data: Data collected through the CCTV system will be retained according to the server capacity but for no more than two months.
• Interested party data via the website, phone, or social media: Data will be retained for a period of up to 60 months if no concrete relationship is established with them.

For any further information, we suggest you contact our DPO (email: info@dpoalbania.al).

8. Security Measures

Data security is fundamental to protecting personal information and data, preserve integrity, and comply with legal and ethical standards. Our company operates in accordance with the applicable legislation on personal data protection and has established the necessary policies and systems for this purpose.

We have implemented stringent security measures to reduce the risk of data breaches and misuse of your personal data, such as unauthorized disclosure and unauthorized access to your data.

We ensure privacy and protection of personal data by safeguarding your data, as well as ensuring your informed consent prior to data collection. Personal information will not be disclosed to any third party outside the company. Individuals have rights under the applicable legislation, such as access, correction, and deletion.

To protect personal data and maintain the integrity of processing activities, we implement the following approaches:

• Data Storage – We use encrypted storage solutions and databases with restricted access to protect personal data.
• Access Control – We implement strict access controls to limit access to personal data, ensuring that only authorized personnel can view, modify, or delete specific information or data.
• Secure Communication Channels – We use secure channels for the exchange/communication of information, including encrypted email services to prevent data interception.
• Physical and Environmental Security – The devices/environments where we store personal data are, located in a secure environment with restricted physical access (i.e., locked rooms).
• Cybersecurity Measures – We use firewalls, strong passwords, antivirus programs, and other measures to protect personal data (such as encryption and pseudonymization).
• Data Retention Policy – We have adopted rules for the duration of data retention and secure destruction to mitigate the risk of unauthorized access to outdated (expired retention period) or unnecessary data.
• Data Security Training – Before starting their duties, we ensure that relevant personnel are trained and certified in data protection, kept up to date on our data security standards and regulations, and familiar with specific data management practices and protocols.

9. Who Are the Recipients of Your Personal Data?

The recipients of your data are as follows:

Authorized Personnel of Balfin Real Estate Shpk, company employees, in accordance with their job duties, and only authorized to process the data for the purposes outlined above.

Service Providers involved in managing our relationship with you, particularly for purposes of communication, document transmission, and electronic management, such as ODDO and ZOHO. ODOO is a company certified under ISO/IEC 27001:2013, an internationally recognized standard for Information Security Management Systems (ISMS). This certification guarantees that Odoo has implemented strict controls and measures to protect information and data, ensuring confidentiality, integrity, and availability of the data. These companies, with whom we collaborate to delegate such services, are considered data processors under applicable law.

Competent Public Institutions (e.g., the Tax Directorate, ISSH, Labor Inspectorate, etc.), judicial authorities, under the circumstances provided by the applicable legislation in force and at their substantiated request.

Banks with which we cooperate.

Balfin Real Estate Shpk guarantees that it complies with a security and confidentiality policy that is in line with Law No. 9887, dated 10.03.2008, “On the Protection of Personal Data,” as amended, and the sublegal acts issued in its implementation. We also adhere to the highest standards regarding the processing of personal data, in accordance with the European Union and the European Economic Area standards.

Employees of Balfin Real Estate Shpk have signed Confidentiality Declarations to ensure the confidentiality of the data they have access to during the performance of their duties. These declarations include penalties in case of breach.

Under no circumstances will your personal data be subject to commercial transactions with third parties.

10. What Are Your Rights?

Under Articles 12-17 of Law No. 9887, dated 10.03.2008, “On the Protection of Personal Data,” as amended, you have several rights regarding your personal data and may request additional information at any time regarding the processing of your personal data.

In accordance with Law No. 9887, dated 10.03.2008, “On the Protection of Personal Data,” as amended, in relation to the personal data processed by Balfin Real Estate Shpk, you have the following rights:

• Right of Access – You have the right to request at any time a confirmation as to whether personal data concerning you is being processed by Balfin Real Estate Shpk, as well as access to these data and information regarding the purpose, duration, legal basis for processing, categories of data being processed, and the categories of recipients.
• Right to Request Rectification, Blocking, or Deletion – If you are informed that your data is inaccurate, false, or incorrect, or that it was collected and processed in violation of the law, you have the right to request the rectification or deletion of personal data, as well as the immediate cessation of processing.
• Automated Decision-Making – You have the right to request not to be subject to decisions that have legal effects or significantly affect you when the decision is based solely on automated processing of your personal data.
• Right to Object – You have the right, in certain circumstances, to object to the processing of your personal data for specific purposes, as provided in Article 15 of Law No. 9887, dated 10.03.2008, “On the Protection of Personal Data.”
• Right to Lodge a Complaint – If you believe that your rights, freedoms, or legitimate interests regarding your personal data have been violated, you may lodge a written complaint to our official address or via email, which will be published on our website.
• Right to Compensation – If you can prove that you have suffered damage as a result of unlawful processing of your personal data, you have the right to request compensation, in accordance with the provisions of the Civil Code.

A written request should include your signature and be accompanied by a valid copy of your identification document to avoid the risk of abuse by third parties.

The request should be sent in writing to the appropriate address of Balfin Real Estate Shpk, addressed to the Data Protection Officer, or via email to: sales@balfinrealestate.com, Phone: +355698014999

You are free to exercise your rights.

Within 30 days of receiving your request, we will provide you with the requested information or an explanation of why your request was not fulfilled or executed.

If you are dissatisfied with the handling of your request by Balfin Real Estate Shpk, you have the right to contact the Commissioner for the Protection of Personal Data at the address: Rr. “Abdi Toptani,” Nd. 5, Tirana. For further information, visit the Commissioner’s website at www.idp.al.

If the processing of personal data is based on consent, you may withdraw your consent at any time. To withdraw your consent, you may contact us at: Email: sales@balfinrealestate.com, Phone: +355698014999

11. Changes to Our Privacy Policy

We regularly update our privacy policy to ensure its accuracy and relevance, and we reserve the right to modify its content if deemed necessary.

Any changes and additions will be communicated to you in a timely manner through our website, in accordance with the principle of transparency.

Last updated: 10.12.204.