/ Privacy Policy

1. TYPES OF DATA PROCESSED

The website processes three types of data:

• Browsing data: IP address, URLs of requested resources, date and time of the request, HTTP method, response status code, browser and operating system parameters, necessary for the functioning and security of the website;
• Data you provide voluntarily: through the “Book a meeting” and “Submit your CV” forms, by email or by phone. Form data is sent to the info@armundiafactory.com and talent@armundiafactory.com mailboxes respectively, provided by Microsoft 365, and is stored at the same time in the website’s content management system (CMS);
• Data processed by third-party services: Usercentrics, for consent management, always active; Adobe Fonts and Google reCAPTCHA, activated only after you give your consent through the cookie banner.

2. PURPOSES AND LEGAL BASES

The tables below show, for each activity, the data, the purpose, the legal basis and the retention period.

The website offers two forms: “Book a meeting”, to request a meeting or a demo, and “Submit your CV”, to send your application. You may also contact us directly by email or phone. In all cases we process only the data you yourself provide, for the purpose for which you provide it:

3. PROVISION OF DATA

4. CONTROLLER AND DPO

The controller of the personal data processed in connection with this website is:

DATA PROTECTION OFFICER (DPO)

Armundia Factory has appointed a two-tier DPO structure, notified to the Commissioner for the Right to Information and Protection of Personal Data pursuant to Article 34(3) of Law no. 124/2024. For any question or request regarding the processing of your data, you may contact:

5. DATA RECIPIENTS

The data may be made accessible, only to the extent necessary, to the following recipients:

• Authorised staff of Armundia Factory and of the Armundia Group companies with access to the emails and to the website CMS, bound by confidentiality;
• Amazon Web Services (AWS), as provider of the cloud infrastructure and hosting of the website, with data stored in European Union regions, and the website’s technical maintenance provider, bound by a processing agreement pursuant to Article 26 of Law no. 124/2024;
• Microsoft, as provider of the email service (Microsoft 365) in which the info@armundiafactory.com and talent@armundiafactory.com mailboxes are stored, bound by a processing agreement pursuant to Article 26 of Law no. 124/2024;
• Adobe Inc. (Adobe Fonts) and Google LLC (Google reCAPTCHA), only where you have given your consent, as providers of the services described in sections 1 and 2;
• Usercentrics GmbH, as provider of the consent management platform;
• Public authorities, where required by law or by court order.

6. PROCESSING METHODS AND RETENTION PERIODS

Data is processed by electronic means, by authorised staff, only for the purposes set out in section 2. Form data is stored in the info@armundiafactory.com and talent@armundiafactory.com mailboxes in Microsoft 365 and in the website CMS.

The retention periods are those set out in the tables in section 2. They apply equally to emails and to CMS records, which are deleted periodically once the period has expired.

7. TRANSFER OF DATA OUTSIDE ALBANIA

The website infrastructure is located in AWS European Union regions. Data may be accessed by Armundia Group companies in Italy, by Microsoft as email provider and, where you have given your consent, by Adobe Inc. and Google LLC in the United States of America. These transfers are made to countries with an adequate level of protection, pursuant to Article 40 of Law no. 124/2024 and Commissioner Decision no. 01 of 30.04.2025; for the United States, the recipients are certified under the EU–U.S. Data Privacy Framework. For information on the safeguards applied, you may contact us at the addresses above.

8. YOUR RIGHTS AND HOW TO EXERCISE THEM

Under Law no. 124/2024, you have the following rights:

• The right to information and access to your data (Articles 13 and 14);
• The right to rectification of inaccurate or incomplete data (Article 15);
• The right to erasure (“right to be forgotten”), where the legal conditions are met (Articles 15 and 16);
• The right to restriction of processing (Article 17);
• The right to object to processing, including processing based on legitimate interest (Article 19);
• The right to data portability (Article 18);
• The right to withdraw consent at any time, where processing is based on consent;
• The right to lodge a complaint with the Commissioner (Article 86; section 14).

To exercise any right, you may write to us at info@armundiafactory.com, contact the local contact point at orjon.nallbati@itaka7.com or the Group DPO at paolo.todaro@armundia.com. We respond within 30 days; this period may be extended up to 60 days pursuant to Article 12 of Law no. 124/2024, in which case we will inform you. For security reasons, we may ask you to verify your identity before acting on the request.

9. COOKIES

The website uses cookies and similar technologies managed through the Usercentrics platform. For details, please read the Cookie Policy.

10. SECURITY MEASURES

Armundia Factory implements appropriate technical and organisational measures to protect data against unauthorised access, loss or disclosure, in accordance with Article 28 of Law no. 124/2024.

11. LINKS TO OTHER WEBSITES

The website may contain links to other websites (e.g. our LinkedIn profile). This Policy does not extend to those websites; we recommend reading the privacy policy of each website you visit through such links.

12. MINORS

The website is not intended for minors under 16.

13. OTHER PROCESSING BY ARMUNDIA FACTORY

In addition to website-related processing, Armundia Factory also processes personal data in the course of its activity, for the following categories of data subjects. These data subjects are informed directly, at the time of collection, through specific privacy notices, in accordance with Article 13 of Law no. 124/2024:

14. CONTACTS AND RIGHT TO COMPLAIN

For any question about this Policy, you may contact us at the addresses set out in section 4.

If you believe that the processing of your data infringes Law no. 124/2024, you have the right to lodge a complaint with the supervisory authority:

15. APPLICABLE LAW

This Policy is governed by Albanian law, in particular Law no. 124/2024 “On the protection of personal data” and the acts of the Commissioner for the Right to Information and Protection of Personal Data.

16. CHANGES TO THIS POLICY

The version in force is always the one published on the website, with the date indicated below. We recommend consulting it periodically.

Last updated: 02.10.2026 — Version 3.0