Privacy Policy

VENETA ("Veneta Biskoteri", "we") is the controller of the personal data described here. • Registered office: Rruga Veneta 1, Durrës, Shqipëri • Business identifier (NUIS/NIPT): K62118503G • Data protection contact: info@venetabiskoteri.com • Telephone: +355 69 20 92 743 We process personal data under Albanian Law no. 9887 on the Protection of Personal Data. Because we also offer our products to customers in the European Union, we process it under the EU General Data Protection Regulation (GDPR) as well.

We collect only what a specific purpose requires. • Account — company name, email address, telephone number, and a password stored only as a cryptographic hash. We never see your password. • Orders — first and last name, email, telephone, delivery address, city, postcode, any note you add, and the payment method you choose. • Newsletter — your email address, if you subscribe. • Enquiries — whatever you choose to tell us when you write to us. • Technical — your IP address and browser details, written to our server logs when your browser requests a page. We do not ask for special category data such as health, political opinions or religious beliefs, and we do not want it. Please do not put it in an order note.

Every use of your data has a purpose and a legal basis behind it. • Fulfilling your order — performance of a contract, Art. 6(1)(b). Without this data we cannot deliver to you. • Running your account — performance of a contract, Art. 6(1)(b). • Newsletter — your consent, Art. 6(1)(a). Withdraw whenever you like; every email carries an unsubscribe link. • Optional cookies and embedded content — your consent, Art. 6(1)(a), given through the cookie banner and withdrawable at any time. • Accounting and invoicing records — a legal obligation, Art. 6(1)(c). • Keeping the site available and preventing abuse — our legitimate interest, Art. 6(1)(f). Supplying order data is a contractual requirement: if you withhold it we cannot process your purchase. Everything else on this page is optional.

We do not keep personal data indefinitely. • Order and invoice records — for the period Albanian accounting and tax law requires, counted from the end of the financial year. • Account data — while your account is open, then deleted or anonymised within 12 months of closure. • Newsletter — until you unsubscribe. • Enquiries — up to 24 months after the matter is closed. • Server logs — a short operational period, then deleted. • Your cookie choice — 12 months, after which we ask again. When a period ends the data is deleted or irreversibly anonymised.

We do not sell your personal data. Not to anyone, not for any price. We share it only where someone needs it to deliver what you asked for: • Our hosting and infrastructure providers, which serve this website and run the server holding orders. • Delivery partners, who receive the name, address and telephone number required to complete a delivery. • Our accountants, and tax or public authorities where the law requires disclosure. Each processor acts on our written instructions and may not use your data for their own purposes.

This website is served by a hosting provider whose infrastructure sits outside Albania, and the optional map described in our Cookie Policy sends data to Google in the United States. Where personal data leaves Albania or the European Economic Area, we rely on the safeguards permitted under Chapter V of the GDPR — principally the European Commission's Standard Contractual Clauses. Ask us and we will tell you which safeguard applies to a particular transfer.

• The entire site is served over HTTPS, so traffic between your browser and us is encrypted in transit. • Passwords are stored only as salted cryptographic hashes. Nobody at Veneta can read yours. • Access to order data is limited to staff who need it, through individually authenticated accounts. • Servers are patched and backed up on a routine schedule. No system is perfectly secure. If a breach ever puts your rights at risk we will notify the supervisory authority within 72 hours and tell you directly where the law requires it.

You may exercise all of the following, free of charge. • Access — obtain a copy of the data we hold about you. • Rectification — have inaccurate or incomplete data corrected. • Erasure — have your data deleted where no legal duty requires us to keep it. • Restriction — have processing paused while a dispute is resolved. • Portability — receive the data you gave us in a structured, machine-readable format. • Objection — object to processing we base on legitimate interest. • Withdraw consent — at any time, without affecting anything lawfully done beforehand. • Freedom from automated decision-making — we carry out no profiling or automated decisions producing legal effects. Write to info@venetabiskoteri.com and we will answer within one month. We may first ask you to confirm your identity, so that we never hand your data to someone else. If our answer does not satisfy you, you may complain to Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale (https://www.idp.al). If you live in the European Union you may instead complain to the supervisory authority for your country.

This site stores a small amount of information in your browser. Some is required for it to work at all; the rest is stored only with your agreement. Our Cookie Policy lists every single item, what it does and how long it lasts. You can change or withdraw your choice whenever you want through the 'Cookie settings' link in the footer.

We revise this policy when what we do with data changes. The date at the top always reflects the current version. If a change materially affects your rights we will make it prominent rather than relying on you to re-read the page.

VENETA NUIS/NIPT: K62118503G Rruga Veneta 1, Durrës, Shqipëri Email: info@venetabiskoteri.com Telephone: +355 69 20 92 743 We aim to answer every request within one month, as the law requires.