Privacy Policy
& Cookie Policy

The controller of personal data is:

For any questions regarding the processing of your personal data, you may contact us at the email address above.

When you use our website, we may collect the following categories of data:

a) Data from the contact form:

• Full name
• Email address
• Phone number (optional)
• Subject and message content

b) Technical data (automatic):

• IP address (for technical security)
• Browser and device type
• Date and time of visit

We do not actively request sensitive data through our website. However, if you voluntarily choose to communicate such information through the contact form (e.g., information about health conditions, criminal matters, or family situations), the processing thereof shall be based on your explicit consent pursuant to Article 9, paragraph 2, letter "a" of Law 124/2024. Such data will be used solely for the purpose of assessing your legal request.

Your data is processed for the following purposes:

We apply the principle of storage limitation pursuant to Article 6, paragraph 1, letter "dh" of Law 124/2024:

• Contact data: Retained until the end of communication with you and no longer than 12 months from the last contact, unless a contractual relationship is established.
• Technical data (logs): Retained for up to 90 days, solely for technical security purposes.
• Legal/contractual documentation: Retained according to applicable legal deadlines (up to 10 years under fiscal legislation).

After the expiry of the retention period, data is deleted or anonymised.

Your personal data is not sold, traded or shared with third parties for marketing purposes.

They may only be made available to:

• Technical service providers (hosting, email) — who act as data processors under our instructions and with appropriate contractual safeguards;
• Public authorities — only when required by law or court order.

The contact form operates through an email delivery service. Data submitted through the form is sent directly to our professional email and is not stored in external databases.

As a rule, your data is processed within the territory of the Republic of Albania or in countries that provide an adequate level of protection.

If, for technical reasons (such as email service infrastructure), data is transferred to another country, we ensure that the transfer is supported by appropriate safeguards under Part II, Chapter V (Articles 37-44) of Law 124/2024, including standard contractual clauses or adequacy decisions.

Under Articles 13-20 of Law 124/2024, you have the following rights:

• Right to information (Article 13) — to be informed about data processing
• Right of access (Article 14) — to obtain a copy of your data
• Right to rectification (Article 15) — to correct inaccurate data
• Right to erasure (Article 15) — to request deletion of data
• Right to restriction (Article 16) — to restrict processing
• Right to portability (Article 18) — to receive your data in electronic format
• Right to object (Article 19) — to object to processing
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing

If you consider that your personal data protection rights have been violated, you have the right to file a complaint with:

Furthermore, under Article 88 of Law 124/2024, you have the right to an effective legal remedy before the competent court.

No. OnLaw Office does not use any automated decision-making system or profiling under Article 20 of Law 124/2024 in relation to website visitors or clients.

This policy may be updated from time to time to reflect legal changes or changes in our practice. The updated version will be published on this page with the date of update. We encourage you to review it periodically.

Current version: March 2026