Sends faxes, in Kosovo

Law No. 06/L-082 on Protection of Personal Data (Albanian: Ligji Nr. 06/L-082 per Mbrojtjen e te Dhenave Personale), arts. 1-6, 10, 23-32, 35-43, 73, 75-90 (general provisions, lawful basis, controller and processor obligations, DPIA, the Data Protection Officer, direct marketing lawful basis, and other sector-specific processing rules) · Read the law's page

• Establish a lawful basis under Article 5 before processing personal data of a person in Kosovo, and apply the Article 4 principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability throughout.
• Appoint a registered representative in Kosovo if you are a controller or processor not established there but use automatic or other equipment in Kosovo to process personal data, unless that equipment is used only for transit through Kosovo.
• Apply data protection by design and by default, keep a written record of your processing activities unless you employ fewer than two hundred and fifty people and none of the high-risk, non-occasional or special-category exceptions apply, and cooperate with the Agency for Information and Privacy on request.
• Carry out a data protection impact assessment before high-risk processing such as systematic automated evaluation with legal effects, large-scale special-category processing, or large-scale systematic monitoring of a publicly accessible area, and consult the Agency first where the assessment shows a risk you cannot mitigate.
• Appoint a Data Protection Officer if you are a public authority, or if your core activities require regular and systematic large-scale monitoring of data subjects or large-scale processing of special categories of data or criminal-offence data, and publish that officer's contact details to the Agency.
• Put appropriate technical and organisational security measures in place, proportionate to the risk, before and during processing.
• Use personal data collected from public sources for direct marketing only as Article 73 allows, limited to name, address, telephone number and email address unless the data subject has separately consented, and obtain written consent before using sensitive personal data for marketing.

Law No. 06/L-082 on Protection of Personal Data, arts. 11-20, 22, 74 (rights of the data subject) · Read the law's page

• Answer an access, rectification, erasure, restriction, portability or objection request within one month of receipt, extendable by two further months for complex or numerous requests, and tell the data subject about any extension within the first month.
• Tell a data subject, at the point you collect or first obtain their personal data, your identity, the purposes and legal basis of processing, the recipients, any transfer to a third country, the storage period, and their rights, within one month where the data came from elsewhere.
• Give a data subject a copy of their personal data on request, along with the purposes, categories, recipients, storage period and other Article 14 information, free of charge for the first copy.
• Correct inaccurate or incomplete personal data on request without undue delay.
• Erase personal data on request without undue delay where it is no longer necessary, consent is withdrawn with no other lawful basis, the data subject objects with no overriding ground, it was processed unlawfully, a legal obligation requires erasure, or it was collected under the child information-society-service consent rule.
• Restrict processing on request while accuracy is contested, in place of erasure where the data subject prefers restriction, where you no longer need the data but the data subject does for legal claims, or while an objection is being verified, and tell the data subject before lifting the restriction.
• Pass on any rectification, erasure or restriction to every recipient the data were disclosed to, unless that is impossible or disproportionately difficult, and tell the data subject who those recipients are on request.
• Give a data subject their data in a structured, commonly used, machine-readable format and transmit it to another controller on request where processing rests on consent or a contract and is automated.
• Stop processing personal data for direct marketing, including related profiling, as soon as a data subject objects, and bring that right to their attention explicitly and separately no later than the first communication with them.
• Where you rely on Article 74's specific direct-marketing procedure, stop the marketing use within eight days of receiving a written objection and confirm that in writing to the data subject within a further five days.