Privacybeleid

This policy explains what personal data Kinetic Labs collects, why, how long we keep it, and what rights you have. We wrote it in plain words. If anything is unclear, write to privacy@kineticlabs.al and a person will answer.

1. Who we are

Kinetic Labs is a web design studio in Tirana, Albania. "Kinetic Labs" is the trading name of Lorin & Co sh.p.k., NIPT K31910024A, registered at Rruga Ibrahim Rugova, Tirana, Albania ("we", "us").

We are the controller of the personal data described here, except where section 9 says we act as a processor for our clients.

• Contact for privacy questions: privacy@kineticlabs.al
• Postal address: Rruga Ibrahim Rugova, Tirana, Albania
• EU and UK representatives: Our EU and UK representatives will be listed here before we contact anyone in the EU or UK. Until then, write to privacy@kineticlabs.al.
• Data protection officer: we have not appointed a DPO because the law does not require one for a business of our size and activity. Privacy questions go to the address above.

2. The short version

• We write to businesses about their websites. To do that we use business contact details that the business itself has made public (its website, its Google listing, public directories).
• If we write to you, we make a private page about your business's website. Only someone with the link can see it.
• We do not use advertising cookies, tracking pixels in emails, or sell data. Ever.
• If you tell us to stop, we stop, across every mailbox we use, usually within minutes.
• You can ask us what we hold about you, and ask us to delete it, at any time.

3. What data we collect, where it comes from, and why

3.1 Businesses we may contact (prospects)

We do not collect sensitive data (health, religion, political views, etc.) and we do not target individuals as consumers. We contact businesses about their business.

3.2 People who visit our website

See our Cookie Policy.

3.3 People who request a free preview or contact us

3.4 Clients

3.5 How we use AI

We use AI models to help analyse public websites, draft messages and build websites. AI is never used to make decisions that have legal or similarly significant effects on you. A human (Henri) reviews anything sensitive: complaints, refunds, legal questions, and anything the system is unsure about. Data we give AI tools is limited to what is needed for the task.

4. Why we think contacting businesses is fair (legitimate interests)

We believe a business that publishes a business email address can reasonably expect a short, relevant, one-to-one business proposal about its own website, as long as:

• the message is about the business, not about the person's private life;
• it clearly says who we are and how to stop further messages;
• we stop immediately when asked and never contact that address again;
• we send at most one first message and three short follow-ups, then stop;
• we do not contact businesses in countries where the law requires prior consent for this kind of email.

We have written down this balance in a Legitimate Interests Assessment. You can ask for a summary at privacy@kineticlabs.al. You have the right to object at any time (see section 8), and if you object we stop, with no questions.

5. Your private page

If we contact you, we may create a private web page for your business (for example kineticlabs.al/p/…). It shows our analysis of your public website and a sample of what we could build.

• It has a long, unguessable link and is marked "do not index", so search engines do not list it.
• It contains only information that is already public about your business, plus our own analysis.
• It records when the link is used and which sections are viewed (see 3.1). It does not set advertising cookies or use fingerprinting.
• We switch it off 90 days after our last message to you, or immediately if you ask.

6. How long we keep data

7. Who we share data with

We do not sell or rent personal data, and we do not "share" it for cross-context advertising. We use these service providers (processors), who may only use the data to provide their service to us:

We may disclose data if the law requires it, or to protect our rights in a legal dispute.

International transfers

We are based in Albania. Our main servers are in Germany. Where data moves outside the EU/UK/Albania, we rely on an adequacy decision (such as the EU–US Data Privacy Framework) or on Standard Contractual Clauses (and the UK Addendum). Albanian Law 124/2024 transfer rules also apply. You can ask us for a copy of the safeguards.

8. Your rights

Depending on where you live, you have the right to:

• access the data we hold about you, and get a copy;
• correct it;
• delete it;
• object to our use of it based on legitimate interests, including all direct marketing (we will always stop direct marketing when asked);
• restrict how we use it;
• data portability (data you gave us, in a common format);
• withdraw consent where we rely on consent (for example portfolio use), without affecting what we did before;
• complain to a supervisory authority.

To use any right, write to privacy@kineticlabs.al, or simply reply "no" or "unsubscribe" to any email from us to stop all messages. We reply within one month (we may extend by two months for complex requests, and will tell you). We may ask you to confirm you control the email address involved. It is free.

Supervisory authorities:

• Albania: Information and Data Protection Commissioner (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale), idp.al
• UK: Information Commissioner's Office, ico.org.uk
• EU: the data protection authority in your country (list at edpb.europa.eu)
• Ireland: Data Protection Commission, dataprotection.ie
• Australia: Office of the Australian Information Commissioner, oaic.gov.au

US residents (including California)

We do not sell personal information or share it for cross-context behavioural advertising, and we do not use sensitive personal information. The categories we collect are described in section 3 (identifiers and professional information from public business sources, internet activity on our pages, commercial information for clients). Whatever US state you live in, you can ask to know, correct or delete your information using the contact above, and we will not treat you differently for doing so.

9. When we act for our clients (processor)

When we host a client's website, the client decides what data its site collects (for example, contact-form messages from its visitors). For that data the client is the controller and we are its processor. We process it only on the client's instructions under the data processing terms in our Client Service Agreement. Visitors of a client's site should contact that business first.

10. Security

Encrypted connections (HTTPS/TLS), access limited to the people who need it, strong authentication, server hardening, regular updates and backups. Card data is handled by Stripe and never touches our servers. No system is perfectly secure; if a breach is likely to put you at risk we will tell you and the authorities as the law requires.

11. Children

Our services are for businesses. We do not knowingly collect data from children under 16.

12. Changes

We may update this policy. The date at the top shows the latest version. For significant changes affecting clients, we will email them.

13. Language

This policy is available in several languages. If versions differ, the English version applies, unless the law of your country requires otherwise.