Privacy Policy
In short: this site collects personal data only when you submit the contact form. There is no analytics, no advertising and no third-party tracking. Your data is used solely to answer your enquiry and is never sold or shared for marketing.
1. Data Controller
The controller of your personal data is Armando Vathkruja, acting in connection with Vathkruja UK Ltd (Company No. 14548791, 167-169 Great Portland Street, Fifth Floor, London W1W 5PF, United Kingdom) and Avelra Ltd (Company No. 14563149, 7 Bell Yard, London WC2A 2JR, United Kingdom).
Contact for all data protection matters: armando@armando.al
2. What data is collected
| Category | Data | Source |
|---|---|---|
| Contact form | Name, email address, subject, message content | Provided by you |
| Consent record | Timestamp, email address, pseudonymised (hashed) IP reference, purpose | Generated automatically on submission |
| Server logs | IP address, timestamp, requested URL, user agent | Generated automatically by the hosting server |
| Cookies | Your cookie banner choice only | Stored in your browser |
No special category data (GDPR Art. 9) is requested or intentionally processed. Please do not include sensitive personal information in the message field.
2a. Data relating to third parties published on this site
The structured data (JSON-LD) embedded in this site includes professional information about a legal contractor working with Avelra Ltd: name, professional role, educational background, professional history and links to publicly available professional profiles. This information is published for the purpose of accurately describing the professional structure of the organisation, on the basis of the consent of the person concerned (GDPR Art. 6(1)(a)).
The person concerned may withdraw that consent, or request rectification or erasure of this information, at any time by writing to armando@armando.al. Upon such a request the data will be removed from the site without undue delay and in any case within one month.
3. Purposes and legal bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Responding to your enquiry | Consent — Art. 6(1)(a) | 24 months from last contact |
| Proving consent was given | Legal obligation — Art. 6(1)(c), read with Art. 7(1) | 24 months |
| Site security, abuse prevention, server logs | Legitimate interests — Art. 6(1)(f) | Maximum 12 months |
| Strictly necessary cookies | Not consent-based (ePrivacy exemption); necessary for the service you requested | Up to 6 months |
4. Recipients and processors
Your data may be processed by the following categories of recipient, each bound by a data processing agreement under GDPR Art. 28:
- The hosting provider operating the armando.al server infrastructure;
- The email service provider used to deliver and receive messages;
- Where strictly necessary, professional advisers under a duty of confidentiality.
Personal data is never sold, rented or shared with advertisers or data brokers.
5. International transfers
Data is processed within the United Kingdom and the European Economic Area. Should any transfer to a third country become necessary, it will be carried out only on the basis of an adequacy decision or appropriate safeguards under GDPR Chapter V (typically Standard Contractual Clauses, with a UK International Data Transfer Addendum where applicable).
6. Your rights
Under the UK GDPR and Regulation (EU) 2016/679 you have the right to:
- Access (Art. 15) — obtain a copy of the personal data held about you;
- Rectification (Art. 16) — correct inaccurate or incomplete data;
- Erasure (Art. 17) — request deletion of your data;
- Restriction (Art. 18) — limit how your data is processed;
- Portability (Art. 20) — receive your data in a structured, machine-readable format;
- Object (Art. 21) — object to processing based on legitimate interests;
- Withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, write to armando@armando.al. A response will be provided within one month, extendable by two further months for complex requests (Art. 12(3)). No fee is charged unless the request is manifestly unfounded or excessive.
7. Automated decision-making
No automated decision-making or profiling producing legal or similarly significant effects (GDPR Art. 22) is carried out.
8. Security
Appropriate technical and organisational measures are in place under Art. 32, including TLS encryption in transit, HTTP security headers and a strict Content Security Policy, hardened server configuration with restricted access, rate limiting and anti-spam controls on the contact form, pseudonymisation of IP addresses in the consent record, and consent logs stored outside the public web root.
9. Right to lodge a complaint
If you believe your data has been processed unlawfully, you may lodge a complaint with a supervisory authority — in the United Kingdom the Information Commissioner's Office (ico.org.uk), or the data protection authority of your EU country of residence.
10. Changes
This policy may be updated to reflect changes in processing or legal requirements. The revision date at the top of this page always indicates the current version.