Privacy policy

Who we are and what this policy covers

Vendenis is a technology and digital engineering company with its seat in Prishtina, Republic of Kosovo. For everything described here Vendenis is the controller: we decide why and how the data is processed.

This policy covers this website and every enquiry, job application and update request you send through it. It does not cover the systems we build and operate for clients on their instructions - there the client is the controller and we act only as a processor under a separate agreement.

The personal data we collect

We collect only what a form asks for, and nothing in the background.

• Enquiry form: first and last name, email address, telephone number, company, country, the reason for the enquiry, your role and how you heard about us where you choose to tell us, your message, your language, the fact that you ticked the consent box, and whether you asked for occasional updates.
• Job applications: your name, email address, telephone number, the position, your message and the CV file you upload.
• Technical data: a keyed one-way hash of your IP address, stored with an enquiry so we can detect and block abuse of the form. The address itself is never stored and the hash cannot be turned back into it.
• Cookies and similar browser storage: itemised in full on our Cookie Policy page.

We do not ask for special categories of data and we ask you not to send them. We run no analytics, no profiling and no advertising.

Why we use your data, and on what legal basis

• To answer your enquiry and to take steps at your request before entering into a contract - Article 6(1)(b) GDPR.
• To assess your job application - Article 6(1)(b); and your consent where you ask us to keep your details on file for future openings.
• To send occasional updates - your consent under Article 6(1)(a), which you can withdraw at any time.
• To keep the website and our systems secure, to stop abuse of the forms and to keep an audit trail of staff actions - our legitimate interest in a secure service, Article 6(1)(f).
• To comply with legal obligations where they apply - Article 6(1)(c).

For visitors in Kosovo the corresponding grounds in Article 5 of Law No. 06/L-082 apply.

Cookies and similar technologies

This site stores only what it needs to work, plus two preferences you set yourself: the language you read it in and whether you prefer the light or the dark appearance. There are no analytics cookies and no advertising cookies.

Nothing that is not strictly necessary is stored before you have agreed to it. You can change or withdraw your choice at any time through the Cookie settings link in the footer. The complete, itemised list is on our Cookie Policy page.

Who we share your data with

We do not sell personal data and we never share it for advertising. Data reaches only the service providers that make this website run, each of them bound by a data processing agreement:

• Hetzner Online GmbH, Germany - hosting of the application, the database and the encrypted backups.
• Cloudflare, Inc. - domain name resolution, TLS termination and protection against attacks and automated abuse for traffic on its way to us.
• Our email provider - delivery of the notification we send to ourselves when you submit a form, and of the reply we send you.

Beyond that we disclose data only where the law obliges us to, or where it is necessary to establish, exercise or defend a legal claim.

Where your data is processed and international transfers

The application, the database and the backups are located in the European Union, in Germany. Cloudflare operates a global network, so a request may pass through servers outside the European Union on its way to us.

Where a transfer outside the EU or EEA takes place, we rely on the European Commission's standard contractual clauses together with the additional safeguards our providers publish. Transfers from Kosovo follow the corresponding requirements of Law No. 06/L-082.

How long we keep your data

• Enquiries: up to 24 months after our last exchange, so that we can follow up and evidence what was discussed.
• Job applications and the CV you upload: up to 12 months after the process closes, unless you ask us to keep them on file for longer or to delete them sooner. CV files are stored outside the public web root and can be downloaded only by authorised staff over an authenticated route.
• Consent to receive updates: until you withdraw it.
• Security and audit records, including hashed IP addresses: up to 12 months.

When a retention period ends the record is deleted.

How we protect your data

Access to the administration area requires a password and a second factor, and passwords are stored only as argon2id hashes. All traffic is encrypted in transit. Sign-in attempts and form submissions are rate limited, every staff action is written to an audit log, uploaded CVs are kept outside the public web root, and backups are encrypted and stored in a separate location.

No system is perfectly secure, but ours is designed to fail closed: when a check cannot be completed, access is refused rather than granted.

Your rights

Under the GDPR and Law No. 06/L-082 you have the right to ask us for a copy of the data we hold about you, to have inaccurate data corrected, to have data erased, to restrict or object to a particular use, to receive the data you gave us in a portable format, and to withdraw consent at any time without affecting the lawfulness of what was done before.

Write to [email protected] and we will answer within one month. We may ask you to confirm your identity before we act, so that we do not disclose your data to someone else.

How to complain

If our answer does not satisfy you, you can lodge a complaint with the Information and Privacy Agency of the Republic of Kosovo, the supervisory authority under Law No. 06/L-082. If you are in the European Union you may instead complain to the supervisory authority of the country where you live or work, or where you believe the issue arose.

Children, profiling and automated decisions

This website addresses businesses and professionals, not children, and we do not knowingly collect data from anyone under the age of 16. We take no decision about you by automated means alone, and we build no profiles of visitors.

Changes to this policy and how to reach us

We update this policy whenever what we actually do changes. The version published on this page is the one that applies, and we announce material changes here.

For any question about this policy, or to exercise any of the rights above, write to [email protected] or use the contact page. Postal enquiries reach us at Vendenis, Prishtina, Republic of Kosovo.