Privacy notice.

1. Who we are (data controller)

The data controller responsible for the personal data collected through this website is:

APIS sh.p.k.
Rruga Prishtinë–Lipjan, km 10
Livagjë, 10500 Graçanica, Kosovo
Email: [email protected]
Phone: +383 49 787 233

For matters arising in North Macedonia, Albania, Croatia or Montenegro, the local APIS entity may act as joint or independent controller depending on the nature of the processing. The contact details for each office are listed on the Contact page.

2. Personal data we collect

We collect personal data when you choose to provide it through this website. Specifically:

Through forms on this website

• Contact form — name, email, phone, company, role, country, message content, and topic of inquiry.
• Career applications — name, contact details, CV/resume, motivation letter, professional history, certifications and any additional information you submit.
• Subcontractor registration — company information, contact persons, business activity, references, certifications, financial documents and supporting attachments.
• Newsletter sign-up — name (optional) and email address.

Automatically when you visit

• Technical data such as IP address, browser type, device type, pages visited, time spent and referring URL.
• Cookie data — see the Cookies notice for details.

From third parties

• Where you reach us through a third-party platform (LinkedIn, partner referral) we may receive limited contact and professional information from that source.

3. Purposes and lawful basis for processing

We process personal data for the following purposes, on the lawful bases indicated:

Purpose	Lawful basis
Responding to inquiries and providing requested information	Performance of a contract / pre-contractual steps; legitimate interest
Evaluating job applications and managing recruitment	Pre-contractual steps; consent for retention beyond a single role
Pre-qualifying subcontractors and managing supplier relationships	Performance of a contract; legitimate interest
Sending the monthly newsletter	Consent
Improving our website and services	Legitimate interest
Complying with legal, regulatory and tax obligations	Legal obligation
Establishing, exercising or defending legal claims	Legitimate interest

4. Sharing & international transfers

We do not sell personal data. We share personal data only as follows:

• Within the APIS — between APIS sh.p.k. (Kosovo), APIS NORTH MACEDONIA d.o.o., APIS ALBANIA sh.p.k., APIS CROATIA d.o.o. and APIS MONTENEGRO d.o.o., where necessary to respond to your inquiry or perform a contract.
• With service providers — IT, hosting, email, analytics and professional advisors who act under contract as data processors and are bound to confidentiality and data-protection obligations.
• With public authorities — where required by law, regulation, court order or to protect our legal rights.
• In connection with corporate transactions — where APIS undergoes a merger, acquisition or sale of assets, with appropriate safeguards.

Where transfers of personal data take place outside the European Economic Area, we apply appropriate safeguards (such as Standard Contractual Clauses or equivalent measures recognised under applicable law).

5. Retention periods

We retain personal data only as long as necessary for the purposes for which it was collected, and to comply with legal and regulatory obligations:

• General inquiries — up to 24 months from last contact, unless an active business relationship exists.
• Career applications — up to 12 months from receipt, unless extended consent is given to retain the profile longer.
• Subcontractor records — for the duration of an active relationship and 10 years thereafter, in line with commercial-record obligations.
• Newsletter subscribers — until you unsubscribe.
• Contractual records — as required by applicable tax, accounting, commercial-law and dispute-defence requirements.

6. Your rights

Subject to applicable law, you have the following rights in relation to personal data we hold about you:

• Right of access — to obtain confirmation of whether we process your data and a copy of it.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure ("right to be forgotten") — to have data deleted in certain circumstances.
• Right to restriction — to limit processing in certain circumstances.
• Right to data portability — to receive your data in a structured, machine-readable format.
• Right to object — to processing based on legitimate interest, including profiling.
• Right to withdraw consent — at any time, where processing is based on consent.
• Right to lodge a complaint — with the competent data-protection supervisory authority in your jurisdiction.

To exercise any of these rights, please contact us at [email protected]. We will respond within the timeframes required by applicable law (typically within one month).

7. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These include access controls, encryption in transit, secure backups and staff training. No system is 100% secure; in the event of a personal-data breach affecting your rights, we will notify you and the competent authority as required by law.

8. Cookies

This website uses cookies and similar technologies. For details on what cookies are used, why, and how to manage your preferences, see the Cookies notice.

9. Updates to this notice

We may update this notice from time to time to reflect changes in our practices, technology, legal requirements or other operational factors. The "effective date" at the top of this notice indicates when it was last revised. Material changes will be communicated through the website and, where appropriate, by direct notice.

10. How to contact us

For any privacy-related questions, requests or concerns, please contact:

Privacy contact
APIS sh.p.k.
Rruga Prishtinë–Lipjan, km 10, Livagjë, 10500 Graçanica, Kosovo
Email: [email protected]
Phone: +383 49 787 233

If you are dissatisfied with our response, you have the right to lodge a complaint with the competent data-protection authority in your jurisdiction.