Privacy Policy

1. Who is responsible for your data

The data controller for the onespot4u service is Connection SHPK, a limited liability company registered in the Republic of Albania (registered office: Lagjia Mark Lula, Rruga Dede Gjon Luli, Zona Kadastrale 8594, Nr. 324, Shkodër, Albania; NUIS/NIPT: M66819004U). We process personal data in accordance with Albanian Law No. 124/2024 “On Personal Data Protection” and, where it applies to customers in the European Union, Regulation (EU) 2016/679 (GDPR).

2. Information we collect

Information you provide

• Contact details, such as your name, email address, telephone number, and billing address.
• Transaction details, including the plan, coverage region, purchase amount, processor response, and transaction reference.
• Order and device details needed to deliver your eSIM, confirm compatibility, or provide support.
• Messages, attachments, and other information you submit through our contact form or support channels.

Information collected automatically

Our website and hosting providers may collect device and usage data such as IP address, browser type, operating system, pages visited, referring URL, timestamps, and diagnostic logs.

Information from service delivery

Our eSIM and roaming partners generate technical records needed to provide service, such as eSIM profile status, activation events, and aggregate data usage against your plan allowance. We do not receive the content of your communications, and we do not sell browsing data.

3. Purposes and legal bases

• Performing our contract with you: processing orders, delivering and activating eSIMs, providing support, and sending service and receipt emails.
• Legal obligations: accounting, tax, consumer-protection, and other regulatory requirements under Albanian and applicable foreign law.
• Legitimate interests: preventing fraud and abuse, securing our systems, and improving our website and plans, balanced against your rights.
• Consent: optional communications such as marketing, where required. You can withdraw consent at any time without affecting prior processing.

4. How we share information

We may disclose information to eSIM and roaming service partners, payment processors, fraud-prevention providers, website hosts, email and contact-form providers, and other vendors that perform services for us under appropriate data-processing terms. We may also disclose information when required by law, to protect rights or safety, or in connection with a merger, financing, acquisition, or sale of business assets.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising unless we provide any legally required notice and choice.

5. International transfers

Our service is international by nature: eSIM fulfillment partners, payment processors, and hosting providers may process data outside Albania and outside the European Economic Area. Where personal data is transferred internationally, we rely on safeguards recognized by Albanian law and the GDPR, such as adequacy decisions or standard contractual clauses, and require recipients to protect the data to an equivalent standard.

6. Security and retention

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit. No internet transmission or storage system can be guaranteed to be completely secure. We retain information only as long as reasonably necessary for the purposes described here, including service delivery, dispute resolution, fraud prevention, and legal or accounting requirements (Albanian tax law generally requires retention of accounting records for at least 5 years), and then delete or anonymize it.

7. Your rights

Subject to the conditions in applicable law, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Rectify inaccurate or incomplete data.
• Erase data (“right to be forgotten”) where there is no overriding ground to keep it.
• Restrict or object to processing, including processing based on legitimate interests.
• Receive your data in a portable format.
• Withdraw consent at any time, where processing is based on consent.

To exercise a right, use our contact form and select “Privacy request,” or email privacy@onespot4u.com. We may need to verify your identity, and we respond within the deadlines set by applicable law.

If you believe your rights have been infringed, you may lodge a complaint with the Albanian Information and Data Protection Commissioner (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale, idp.al) or, if you are in the EU, with your local supervisory authority.

8. Cookies

We use cookies and similar technologies that are necessary for security, checkout, preferences, and site performance. Nonessential technologies such as analytics are used only with your consent, which you can give or withdraw at any time through the cookie banner or our Cookie Policy page. Blocking necessary cookies may prevent parts of checkout from working.

9. Children’s privacy

Our services are intended for adults and are not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided information to us, please contact us so we can review and, where appropriate, delete it.

10. Changes to this policy

We may update this policy as our services or legal obligations change. We will post the revised policy here and update the effective date. Material changes may also be communicated through another appropriate channel.

11. Contact us

Questions or privacy requests can be submitted through our Contact Us page or emailed to privacy@onespot4u.com.

Before launch, confirm with Albanian counsel whether notification to or registration with the Information and Data Protection Commissioner is required for your processing activities.