Privacy Policy

1. Two Different Roles

The way we handle personal data depends on why we hold it, so it is worth separating the two cases at the start.

As a controller

When you contact us, subscribe to our updates, attend one of our events, apply for a job or simply browse this website, we decide why and how your data is used. This policy describes that processing.

As a processor

When we run campaigns, media buying, CRM work or events on behalf of a client, we handle personal data under that client's instructions and for their purposes. In those cases the client is the controller and their own privacy notice applies.

If you want your data removed from a campaign we operate for a brand, tell us and we will pass the request to that client, or point you to them directly.

2. Information We Collect

2.1 Information You Give Us

• Name and surname
• Email address and phone number
• Company, job title and business contact details
• The content of your enquiry, brief or message
• Event registration details, including dietary or accessibility requirements you choose to share
• CVs, portfolios and application materials, if you apply for a role or a collaboration
• Billing and invoicing details for clients and suppliers

2.2 Information We Collect Automatically

• IP address and approximate location
• Browser type, language and device information
• Pages visited, time on page, referring source and exit points
• Cookie and pixel identifiers
• Interaction data from our emails, such as opens and clicks

2.3 Information From Other Sources

We may receive limited business contact information from public professional sources, referrals, event partners and advertising platforms, and combine it with what we already hold about a prospective client relationship.

3. How We Use Your Information

• To answer enquiries, prepare proposals and scope work
• To deliver services under a contract with your organisation
• To manage event registration, attendance and follow-up
• To send marketing communications, newsletters and case studies where you have consented or where we have a legitimate interest in contacting a business audience
• To measure and improve our website, our campaigns and our own marketing
• To review job and collaboration applications
• To issue invoices, keep accounting records and meet tax obligations
• To protect our systems and prevent fraud or misuse
• To comply with legal obligations

We do not make decisions about you using automated processing alone that would produce legal or similarly significant effects.

4. Legal Basis for Processing

Where Albanian data protection law or the GDPR applies, we rely on:

• Contract, where processing is necessary to deliver services you or your organisation have requested
• Consent, for marketing emails, non-essential cookies and any optional information you volunteer
• Legitimate interests, for business development, website analytics, security and day-to-day operation of the agency, balanced against your rights
• Legal obligation, for accounting, tax and regulatory record-keeping

You can withdraw consent at any time. This does not affect processing carried out before the withdrawal.

5. How We Share Your Information

We do not sell, rent or trade personal information. We share it only with:

• Service providers who support our operations, including hosting, email delivery, analytics, CRM, cloud storage, advertising platforms and payment processing
• Clients, where the data was collected as part of a campaign or event we run on their behalf
• Partners and suppliers engaged on a specific project, such as production crews, venues or media owners, limited to what the project requires
• Professional advisers, including accountants and lawyers
• Public authorities, where disclosure is required by law or necessary to defend our legal rights
• A successor entity, in the event of a merger, acquisition or sale of assets

Everyone we share data with is bound by confidentiality and data protection obligations.

6. International Transfers

Some of the tools we use, including advertising, analytics and cloud services, are operated by providers based outside Albania and the European Economic Area. Where we transfer personal data internationally, we rely on adequacy decisions, standard contractual clauses or other lawful transfer mechanisms.

7. Cookies and Tracking

Our website uses cookies and similar technologies to keep the site working, understand how it is used and measure advertising.

• Necessary cookies are required for basic functionality and cannot be switched off.
• Analytics cookies help us see which pages and campaigns perform, through tools such as Google Analytics.
• Marketing cookies support advertising and measurement, through tools such as Meta Pixel, Google Ads and LinkedIn Insight Tag.

You can accept or refuse non-essential cookies in the consent banner shown on your first visit, and you can reopen your choices at any time through the cookie settings link in our website footer.

You can also block or delete cookies through your browser settings, though some parts of the site may then stop working properly.

8. Data Retention

We keep personal data only as long as we need it:

• Enquiries that do not become projects: up to 24 months
• Client and supplier records: for the length of the relationship, plus the period required by Albanian accounting and tax law
• Marketing contacts: until you unsubscribe or ask us to delete your details
• Event data: up to 12 months after the event
• Job applications: up to 12 months, unless you ask us to keep your details on file for longer

Data we hold for a client is retained according to that client's instructions.

9. Data Security

We apply appropriate technical and organisational measures, including access controls, encryption in transit, restricted internal permissions and vetting of the providers we work with.

No transmission over the internet is completely secure, so we cannot guarantee absolute security, but we take the protection of your data seriously and act quickly if something goes wrong.

10. Your Rights

Subject to the law that applies to you, you may:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent for marketing at any time
• Complain to the Albanian Commissioner for the Right to Information and Protection of Personal Data, or to your local supervisory authority

To exercise any of these, write to info@mslalbania.com . We respond within 30 days and may ask you to confirm your identity first.

11. Marketing Communications

Every marketing email we send includes an unsubscribe link. You can also email us to opt out.

Unsubscribing from marketing does not stop service or administrative messages relating to work in progress.

12. Third-Party Links

Our website and our campaign materials may link to sites we do not control. We are not responsible for their privacy practices, and we recommend reading their policies before sharing personal information.

13. Children's Privacy

Our website and services are directed at businesses and professionals and are not intended for anyone under 18. We do not knowingly collect data from minors. If we learn that we have, we will delete it.

14. Changes to This Policy

We may update this policy from time to time. The revised version will be posted on this page with a new “Last Updated” date. Where changes are significant, we will make that clear.

15. Contact Us

Thank you for trusting MSL with your information.