- DATA CONTROLLER
Preliminary Information:
The Data Controller is Media Prospect S.H.PK, a project by Media Prospect SH.P.K., Rruga “Dibres” Njesia bashkiake Nr.4, Zona Kadastrale me nr.8140, 1007, Tirana, Albania (L92120015N). The Controller provides the data subject—i.e. the person to whom the data relates—with the following information pursuant to Articles 13 and 14 of European Regulation no. 2016/679, in order to describe the characteristics of the processing performed on the personal data provided by the data subject, the purposes for which they are collected, the measures adopted to secure such data, and the rights of the data subject.Contact Details:
For any privacy-related inquiries, please use the dedicated email address provided by the Data Controller:
privacy@media-prospect.com - DATA PROTECTION OFFICER
Pursuant to Article 37, letter b) of the GDPR, the Controller has appointed Mrs. N. Doku as the Data Protection Officer (“DPO”), who can be contacted at the following details:E-mail: dpo@media-prospect.com
Phone/Mobile: +355685754741 - PURPOSE OF PROCESSING AND LEGAL BASIS
The personal data collected will be processed, with the explicit consent of the interested party, for the purpose of transferring it to third parties operating in the marketing, commercial communications, and publishing sectors. Specifically, the transfer of the personal data collected is intended to allow such third parties:- to send promotional communications regarding products, services, events, or commercial initiatives, even if not directly related to the Data Controller’s activities;
- to disseminate editorial content, such as newsletters, articles, digital magazines, and informational materials, including advertising;
- to implement multi-channel advertising campaigns, including digital tools, social media, email marketing, SMS, push notifications, and other direct communication channels of third parties;
- to conduct market research, surveys, and customer satisfaction analyses, aimed at improving the commercial offering and segmenting the audience.
The data will be transferred exclusively to third parties who operate in compliance with current legislation on the protection of personal data and who have adopted adequate technical and organizational measures to guarantee the security and confidentiality of the data processed.
- METHODS OF EXPRESSING CONSENT
Where required, consent may be given by signing an electronic document or by ticking specific checkboxes. - METHODS AND LOGIC OF PROCESSING
For personal data processed for the purposes indicated in the “Purpose of Processing and Legal Basis” section of this privacy policy (indirect marketing purposes), processing will be carried out by third parties through mass email platforms for sending campaigns via email, SMS, push notifications, and similar methods.- Email Campaigns: Advertising campaigns carried out by sending targeted emails to a specific group of recipients—both potential and existing customers—with the aim of conveying a promotional, informational, or commercial message in a direct and personalized manner.
- SMS Campaigns: Advertising campaigns involving text messaging to phone numbers, delivering concise and targeted messages to a predefined list of contacts. These campaigns are designed to reach recipients quickly and effectively, given the high open rate of SMS messages.
- Push Notification Campaigns: Advertising campaigns sent via app-based messages directly to the user’s device (phone, desktop, etc.), even when the app is not in active use. This channel allows you to send real-time updates to users regarding significant promotions or events.
- SOURCE OF PERSONAL DATA
Only data provided in accordance with this Privacy Notice following the data subject’s explicit consent to the described purpose will be processed. No personal data from publicly accessible sources will be used. - RECIPIENTS AND CATEGORIES OF RECIPIENTS OF PERSONAL DATA
The data subject’s personal data will never be disseminated to unspecified parties. The personal data of data subjects will be shared only with specific third parties with whom the Controller has entered into contractual agreements. The names of these third parties may be requested from the Controller by sending a simple email request to the address indicated above.By way of example, the following may receive personal data:- Communication companies and/or client companies with or for whom the Controller carries out commercial communication activities, based on the consent given by the data subject;
- Companies offering information technology services, including (in particular) hosting and bulk-emailing services;
- Companies providing cloud-based software;
- Auditing firms;
- The Controller’s partner companies.
- CATEGORIES OF DATA
The personal data to be processed (acquired following the data subject’s express consent by ticking the relevant checkbox in the pop-up) include: first name, last name, company name, tax code, address, email, city, phone number, postcode, IP address, date of opt-in, opt-in country, category of interest, GDPR data (consent to profiling, consent to data transfer, date of transfer, URL of collection, IP of collection). - DATA TRANSFER
The Controller intends to transfer personal data to a third country or an international organization. Such entities may include, by way of example:- Communication companies that perform communication activities on behalf of the Controller;
- Client-companies commissioning certain advertising campaigns;
- Providers of information society services;
- Controlled and/or controlling organizations.
The transfer of personal data to such entities—if located in a third country or an international organization—occurs in the presence of an adequacy decision by the European Commission, confirming that the third country, territory, or one or more specific sectors within it, or the relevant international organization, ensures an adequate level of protection of rights. In cases where there is no adequacy decision, in the event of data transfer abroad, the Data Controller, in compliance with the principles established by Articles 46 and following of the GDPR and in particular Article 47 on binding corporate rules and standard contractual clauses, undertakes to conclude specific separate agreements that oblige such subjects to adopt adequate security measures, including organizational ones, aimed at offering appropriate guarantees regarding rights. The data may thus be transferred to the following countries: United States of America, Albania, Kosovo. To obtain a copy of such data or the place where they have been made available, simply send the relevant request to the Data Controller, to the addresses above.
- PERIOD OF PERSONAL DATA RETENTION
Personal data processed for the purposes referred to in point 3(1) of this Privacy Notice (marketing purposes) are processed and stored as long as the personal data remains relevant for the specific marketing purpose for which it was collected; in any event, personal data will not be stored beyond two (2) years from the data subject’s granting of express consent. After two years, the personal data will be permanently deleted.The Data Controller reserves the right to delete collected personal data before the specified period if it is in the legitimate interest to do so. - OPTIONALITY OF CONSENT AND CONSEQUENCES OF WITHHOLDING CONSENT
With regard to personal data processed for the purposes referred to in point 3(1) of this Privacy Notice (marketing purposes), the provision of personal data by the data subject is not a contractual obligation. The data subject may choose whether to provide personal data; however, if no personal data are provided, it will not be possible to carry out any marketing activities. - RIGHT TO OBJECT
The data subject has the right to object under the following conditions:The right to object at any time, for reasons related to their particular situation, to the processing of personal data concerning them carried out under Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions. In such cases, the Controller will refrain from processing personal data further unless it demonstrates compelling legitimate grounds for processing that override the data subject’s interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.If personal data is processed for direct or indirect marketing purposes, the data subject has the right to object at any time to such processing.If the data subject objects to processing for direct and/or indirect marketing purposes, personal data will no longer be processed for those purposes. Please note that the data subject may exercise the right to object to processing of their personal data for the above purposes partially, for instance by objecting solely to the sending of promotional communications via automated and/or digital channels, or to the sending of paper communications. - OTHER RIGHTS
The Controller also wishes to inform the data subject of the following rights:- Right of access: The data subject has the right to obtain confirmation from the Controller as to whether or not personal data concerning them is being processed and, if so, to gain access to the personal data and specific information, in accordance with Article 15 of the GDPR.
- Right to rectification: The data subject has the right to obtain from the Controller the rectification of any inaccurate personal data concerning them without undue delay. Considering the purposes of the processing, the data subject also has the right to have incomplete personal data completed, including by providing a supplementary statement, in accordance with Article 16 of the GDPR.
- Right to erasure of data, including the right to withdraw consent: The data subject has the right to obtain from the Controller the erasure of personal data concerning them without undue delay, and the Controller is obliged to erase the personal data without undue delay or to withdraw consent if the conditions set forth in Article 17 of the GDPR are met. Regarding the right to withdraw consent, the data subject may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
- Right to restriction of processing: The data subject has the right to obtain restriction of processing from the Controller where the conditions of Article 18 of the GDPR are met.
- Right to data portability: The data subject has the right to receive the personal data concerning them, which they have provided to the Controller, in a structured, commonly used, and machine-readable format, and has the right to transmit such data to another controller without hindrance from the Controller, under the circumstances and according to the conditions set out in Article 20 of the GDPR.
- Right of the contracting party to object to commercial communications: The contracting party has the right to object at any time, free of charge, to receiving commercial communications.
- EXERCISE OF RIGHTS
Requests to exercise the rights mentioned in this Privacy Notice, including specifically the right to erasure and the right to withdraw previously given consent, must be addressed directly to the Controller at the following email address:
privacy@media-prospect.com.Alternatively, the data subject may exercise their rights by sending the relevant request via registered mail with return receipt to the Controller’s address indicated above.
