Privacy Policy

1. Data controller

The controller of your personal data is Pajaj Holding & CO SHPK, NUIS (tax ID) M61319059B, registered at: Papa Kristo Negovani Street, Lim-Em Building, Entrance A, Floor 3, Apt. 10, Tirana, Albania.

For any question or request regarding your data, contact us at: info@opsssbusiness.com.

2. Data we collect

We collect only the data needed to provide the service:

• Account data: name, email address, password (encrypted) or your Google identity when you sign in with Google.
• Your company data: business name, tax ID, address, base currency and the data you enter into the platform (contacts, invoices, products, etc.).
• Technical data: IP address, browser type, language, pages visited and usage times.
• Cookies and similar technologies, as described in the Cookie Policy.

3. Purposes and legal bases

• Providing the CRM + ERP service and operating your account (performance of contract).
• Billing and subscription management (performance of contract and legal obligations).
• Platform security, abuse prevention and audit logs (legitimate interest).
• Improving the service through anonymous usage statistics (your consent — only if you accept analytics cookies).
• Service communications such as email verification and security notices (performance of contract).

4. Your customers' data

When you enter data about your own customers, suppliers or employees (contacts, invoices, payments, etc.), you are the controller of that data and Pajaj Holding & CO SHPK acts as a processor on your behalf. We process it only on your instructions and to provide the service, and never use it for any other purpose.

5. Processors and international transfers

We use these sub-processors with recognized security standards:

• Google Firebase / Google Cloud (data storage, authentication) — Google LLC, under EU Standard Contractual Clauses.
• Vercel Inc. (application hosting) — under EU Standard Contractual Clauses.
• Stripe (card payment processing, only if you pay by card) — PCI-DSS certified.

6. Data retention

Account data is kept for as long as your account is active. After account closure, data is deleted or anonymized within 90 days, except data we are legally required to keep longer (e.g. tax documents).

7. Your rights

Under Albanian law and the GDPR, you have the right to request:

• Access to your personal data and a copy of it.
• Rectification of inaccurate data.
• Erasure of your data ("right to be forgotten").
• Restriction of, or objection to, processing.
• Data portability in a machine-readable format.
• Withdrawal of consent at any time, without affecting prior lawful processing.

8. Complaints

To exercise your rights, write to info@opsssbusiness.com. We respond within 30 days. You also have the right to lodge a complaint with the Albanian Information and Data Protection Commissioner (www.idp.al).

9. Security

We apply appropriate technical and organizational measures: encryption in transit (TLS) and at rest, full isolation of each company's data, role-based access control, secure sessions and audit logs for every action.

10. Children

The service is aimed at businesses and is not intended for persons under 16. We do not knowingly collect data from minors.

11. Changes to this policy

We may update this policy from time to time. For material changes we will notify you by email or in-app notice. The last-updated date is shown at the top of this page.