1. Identity of the Data Controller
The controller of personal data is Illyrian Pixel, based in Tirana, Albania. For any questions about data protection, you can contact us at: info@illyrianpixel.com
LEGAL DOCUMENT · GDPR
Privacy Policy
Last updated: October 2026 · Illyrian Pixel, Tirana, Albania Based on Regulation (EU) 2016/679, GDPR
2. What Data We Collect and Why (Legal Basis, Article 6 GDPR)
We collect the following data: • Contact form: name, email, phone, business name, message and, if you fill them in, service, budget and timeline. Legal basis: Article 6(1)(b) GDPR, pre-contractual steps at your request. • Newsletter: your email, the date you subscribed and confirmed (double opt-in), and whether you open our emails or click their links. Legal basis: Article 6(1)(a) GDPR, consent. You can unsubscribe with one click from any email. • King Genti assistant: the messages you type in the chat, linked only to a random session identifier (no name, no IP address). We use them to improve the answers. Legal basis: Article 6(1)(f) GDPR, legitimate interest. Please do not share sensitive information in the chat. • Internal visit statistics: only the page visited and the date, with no cookies and no personal data. Legal basis: Article 6(1)(f) GDPR, legitimate interest. • Analytics (Google Analytics, Microsoft Clarity): only if you click “Accept” in the cookie banner. Collects how the site is used (pages, clicks, scrolling, device, approximate location); Clarity also records on-page interactions. Legal basis: Article 6(1)(a) GDPR, consent, which you can withdraw at any time. • Marketing (Google Ads): only if you accept this category in the banner. Measures whether visits from our ads turn into enquiries and allows more relevant ads. Legal basis: Article 6(1)(a) GDPR, consent, which you can withdraw at any time. • Abuse protection: your IP address is used temporarily to limit excessive form submissions and is deleted within 24 hours. Legal basis: Article 6(1)(f) GDPR, legitimate interest in keeping the site secure. We do not collect special categories of data under Article 9 GDPR (health, ethnic origin, etc.).
3. Retention Period (Article 5(1)(e) GDPR)
Data is retained only for as long as necessary: • Contact and communication data: up to 2 years after the relationship ends. • Contractual and financial data: up to 5 years per legal obligations. • Newsletter subscription: until you unsubscribe. • Assistant conversations: 12 months, then deleted automatically; you can also ask us to delete them sooner. • IP addresses used for abuse protection: up to 24 hours. • Google Analytics, Google Ads and Microsoft Clarity: according to those services' retention periods (for Google Analytics, at most 14 months). Once the retention period expires, data is securely deleted or anonymized.
4. Data Recipients
We do not sell or share your personal data with third parties for marketing purposes. We may share it only with: • Vercel Inc. (USA), website hosting; processes the IP address and technical data of every request. • Supabase, the database where contact requests, newsletter subscriptions and assistant conversations are stored. • Resend (USA), for sending emails (confirmations, notifications and the newsletter). • Telegram and WhatsApp (via the CallMeBot service), internal notifications to us when you submit the contact form; they contain the details you entered. • Google (Google Analytics, Google Ads) and Microsoft (Microsoft Clarity), only if you consent to the relevant category. • Competent legal authorities, only when required by law.
5. International Transfers (Articles 44–49 GDPR)
Some of our providers are based outside the European Economic Area (EEA). Any such transfer only takes place if: • The receiving country has an adequacy decision from the European Commission, or • The Standard Contractual Clauses (SCC) approved by the EC are applied, or • Other appropriate safeguards under Article 46 GDPR have been put in place.
6. Cookies
The site works without non-essential cookies. Analytics and marketing cookies are only set if you accept them in the banner (each category is a separate choice), in line with the ePrivacy Directive (2002/58/EC) and Article 6(1)(a) GDPR: • Analytics, Google Analytics: _ga and _ga_<ID>, to distinguish visitors and sessions; up to 2 years. • Analytics, Microsoft Clarity: _clck and _clsk (plus Microsoft cookies), for usage analysis and session recording; up to 1 year. • Marketing, Google Ads: _gcl_au (plus Google advertising cookies), to measure ad results; up to 90 days. If you decline, Google only receives cookieless technical signals (Google Consent Mode) for aggregated statistics, while Microsoft Clarity is not loaded at all. In your browser's storage (localStorage/sessionStorage) we only keep technical choices: your cookie choice (12 months), whether you closed an informational pop-up, and the chat session identifier (deleted when you close the tab). You can change or withdraw your consent at any time via “Cookie settings” at the bottom of every page.
7. Your Rights as a Data Subject (Articles 15–22 GDPR)
Under GDPR, you have the following rights: • Right of access (Article 15), to obtain a copy of your data. • Right to rectification (Article 16), to correct inaccurate data. • Right to erasure ("to be forgotten") (Article 17), to request deletion of your data. • Right to restriction of processing (Article 18). • Right to data portability (Article 20), to receive your data in a readable format. • Right to object (Article 21), to processing based on legitimate interest. • Right not to be subject to automated decision-making (Article 22). To exercise any of these rights, contact us at: info@illyrianpixel.com. We will respond within 30 calendar days.
8. Right to Lodge a Complaint (Article 77 GDPR)
If you believe the processing of your data violates GDPR, you have the right to lodge a complaint with the competent supervisory authority. If you are an EU citizen, you can contact the supervisory authority of your country. The full list is available at: edpb.europa.eu/about-edpb/board/members
9. Data Security (Article 32 GDPR)
We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss or destruction. Communications are encrypted with SSL/TLS. Internal access is restricted according to the principle of least privilege.
10. Changes to This Policy
We may update this policy to reflect legal or operational changes. The update date is noted at the top of the document. We recommend reviewing it periodically. Continued use of the site after material changes implies acceptance of them, or we will ask for renewed consent where required by law.