Privacy Policy

This policy explains how Apex Frames SHPK (Tax ID M62116046U), registered at Innovation Hub, Pyramid of Tirana, "Dëshmorët e Kombit" Blvd. 5, Tirana, Albania ("we"), processes personal data when you visit www.apexframes.co or contact us. Processing complies with Albanian Law No. 124/2024 on Personal Data Protection and, where applicable, the EU GDPR.

1. Data controller

The controller is Apex Frames SHPK. Questions: info@apexframes.co · +355 69 888 1333.

2. Data we collect

• Data you give us by email, phone, WhatsApp or the contact form: name, company, email, phone, project description and site address.
• Contract data once you become a client: billing details, measurements, specifications, contracts and correspondence.
• Warranty certificate requests (the Warranty certificate page): no personal field is mandatory. You may give your first name, last name, email, phone, product, purchase date and contract or invoice reference; you only need to give at least one detail so we can verify the purchase. We store only what you give. After approval we also keep the certificate number and warranty dates.

This website uses no tracking cookies, analytics or advertising. The contact form does not store data on our server: it simply prepares an email in your own mail app, which you choose whether to send. Unlike it, the warranty certificate form stores the details you fill in in our system (hosted on Netlify) in order to review the request and issue the certificate. To protect against abuse we use a hash of the IP address, not the IP itself, and keep it only for a short time. The request code you receive contains no personal data.

The public certificate check (by AF-… number) shows only the holder’s initials, the dates and the status; the full name, email and phone are never shown.

3. Purposes and legal basis

• To answer your request and prepare a quote — pre-contractual steps at your request.
• Your consent for the details you voluntarily fill in on the warranty certificate request. You can withdraw consent at any time (info@apexframes.co), without affecting the lawfulness of earlier processing; after approval, keeping the certificate relies on performing our warranty obligation to you.
• To perform the contract: survey, manufacturing, installation, handover and warranty, including reviewing the request and issuing the warranty certificate.
• To meet legal obligations such as fiscalised invoicing and retention of financial records.
• Legitimate interest: protecting our rights and handling complaints.

4. Who we share it with

We never sell your data. We share it only as needed with suppliers and carriers to fulfil your order, with email and hosting providers, with our accountant, or with authorities where required by law. All act under written agreements and confidentiality obligations.

Transfers outside Albania. The certificate system is hosted by Netlify, Inc. (USA), and automatic emails (if enabled) are sent through an email provider. Data may be stored or processed outside Albania. These transfers rely on the provider’s data processing agreement and the standard contractual clauses it includes. The website does not transfer data to social networks without your action.

5. Retention

Enquiries that do not lead to a contract are kept for up to 12 months. Certificate requests that are not approved (pending or rejected) are deleted automatically after 12 months. Issued certificates are kept during the warranty (5 years); 12 months after expiry the personal data is deleted or anonymised and only the number, dates and status remain, with no personal data. You can ask for earlier erasure. Contract and financial documents are kept for at least 5 years under Albanian tax law.

6. Your rights

You may request access, rectification, erasure, restriction, data portability, object to processing, and withdraw consent you have given. Write to info@apexframes.co; we reply within 30 days. You may also lodge a complaint with the Albanian Commissioner for the Right to Information and Personal Data Protection (idp.al).

7. Security

We apply reasonable technical and organisational measures: access limited to authorised staff, communication from official company addresses and structured document archiving. The internal certificate panel is password-protected and access is limited to authorised staff. In case of a personal data breach that poses a risk, we notify the Commissioner within 72 hours and, where the risk is high, the affected individuals.

8. Changes

We may update this policy. The version in force is always the one published on this page, with its update date.