Privacy Notice

1. About this Notice

This Privacy Notice explains how GSE Security collects, uses, stores, shares and protects personal information submitted through its website quotation and contact forms.

GSE Security processes personal information in accordance with Albanian Law No. 124/2024 “On Personal Data Protection”. The EU General Data Protection Regulation (GDPR) and other national or regional privacy laws are applied where their territorial scope makes them applicable to a particular individual or processing activity.

There is no single international privacy law and this Notice does not attempt to replace mandatory local law. If an applicable law provides additional or stronger non-waivable rights, that law prevails to the extent of the conflict. Nothing in this Notice limits a right that cannot lawfully be limited.

This Notice applies to website enquiries and quotation requests. If a requested security service later requires sensitive, operational or security-related information, GSE Security will provide an appropriate channel and any additional privacy information required for that processing.

2. Who is responsible for your information

GSE Security is the controller responsible for deciding why and how personal information submitted through its website forms is processed. Contracted hosting, form, email and technology providers generally act as processors for GSE Security and may process the information only under applicable contractual and legal controls.

3. Information we collect

Depending on the form and your request, GSE Security may collect:

• Your name and business or personal contact details, such as email address and telephone number; • Your company or organisation, where relevant; • The requested service and the country or general service location; • The information you choose to include in your message; • Communication and follow-up records relating to the request; and • Limited submission and security metadata, such as date and time, notice version, submission identifier and technical security logs.

An IP address is used only where created by the system or reasonably needed for security, abuse prevention or evidence of submission.

Required fields are marked in the form and are limited to the information reasonably needed to identify you, understand the requested service and reply. Other fields are optional. If you do not provide required information, GSE Security may be unable to assess your request, prepare a quotation or contact you.

If you submit personal information about another person, you should be authorised to do so and, where appropriate, make this Notice available to that person. Do not submit sensitive or detailed security information about another person through the public form.

4. Purposes, legal bases and retention

GSE Security limits the use of form information to the purposes below.

If a request results in a contract, relevant information may become part of the customer and contractual record and will be retained under the applicable contract, legal, accounting and claims requirements.

GSE Security documents the balancing assessment for processing based on legitimate interests. You may object to that processing; GSE Security will consider your circumstances and stop unless it has compelling legitimate grounds or needs the information for legal claims.

5. Who may receive your information

Access is limited to authorised GSE Security personnel who need the information to assess and respond to the request. Where necessary, information may also be received by:

• Contracted website, hosting, email, communications, backup, cybersecurity and IT providers acting under GSE Security’s instructions; • Professional advisers, such as legal, accounting or insurance advisers, where reasonably necessary; • Carefully selected operational partners or subcontractors, but only where necessary to assess or deliver the requested service and subject to appropriate confidentiality and data-protection obligations; and • Courts, regulators, law-enforcement bodies or other public authorities where disclosure is required or permitted by law.

GSE Security does not sell, rent or trade personal information submitted through quotation or contact forms and does not provide it to third parties for their independent marketing.

6. Storage outside Albania and international transfers

GSE Security uses contracted website and communication infrastructure located outside Albania. Personal information may therefore be stored in, transferred to or accessed from another country, including countries in which GSE Security’s technology providers operate.

GSE Security remains responsible for the processing under applicable law. Before enabling a transfer, GSE Security must identify the recipient and destination, verify whether an applicable adequacy decision exists and, if not, put in place an available legally recognised safeguard. Depending on the applicable regime, safeguards may include standard data-protection clauses approved or recognised by the competent authority, binding contractual duties and supplementary technical and organisational measures.

You may request information about the transfer mechanism relevant to your data, and a copy or description of the applicable safeguards, by contacting info@gsesecurity.al. Commercially confidential information may be redacted where legally permitted without preventing you from understanding the protection provided.

7. Security

GSE Security uses risk-appropriate technical and organisational measures designed to protect personal information against unauthorised or unlawful processing and accidental loss, destruction, alteration or disclosure. Measures include access restrictions based on business need, confidentiality duties, encrypted transmission, strong authentication, backup and recovery controls, logging, periodic testing and an incident-response process.

No online system is completely secure. You should avoid submitting unnecessary sensitive or operationally critical information through a public website form.

8. Marketing and website technologies

GSE Security does not use submission of the quotation or contact form as consent for direct marketing. If GSE Security introduces marketing communications, it will request a separate optional choice where required by law and provide a clear method to unsubscribe.

Necessary website technologies may be used for security, functionality and form submission. Non-essential cookies, analytics, maps or embedded third-party services are governed separately through the website’s Cookie Notice and consent settings where required. Cookie consent must not be bundled with the quotation acknowledgement.

9. Automated decisions

GSE Security does not use quotation-form information to make decisions based solely on automated processing that produce legal or similarly significant effects. Automated tools may help detect spam, malicious activity or technical misuse, but quotation and service decisions are subject to human review.

10. Your privacy rights

Depending on the law that applies, you may have the right to:

• Request access to your personal information; • Request correction of inaccurate or incomplete information; • Request deletion or restriction of processing, subject to legal conditions; • Object to processing based on legitimate interests or to direct marketing; • Withdraw consent at any time where processing is based on consent, without affecting processing already carried out lawfully; • Request data portability where legally applicable; and • Lodge a complaint with the competent data-protection authority.

To exercise a right or raise a privacy question, contact info@gsesecurity.al. GSE Security may request only the information reasonably necessary to verify your identity and locate the relevant record. Under Albanian Law No. 124/2024, GSE Security will normally act or give a reasoned response as soon as possible and no later than 30 days, subject to any lawful extension and notice. A shorter or different mandatory local deadline will be followed where applicable.

As an organisation established in Albania, GSE Security is supervised by the Commissioner for the Right to Information and Protection of Personal Data. Visit the Commissioner’s official website for further information or to lodge a complaint.

11. Minors

The quotation form is intended for adults and authorised business representatives. GSE Security does not knowingly use the form to collect personal information directly from children. If you believe a child has submitted information, contact GSE Security so it can be reviewed and, where appropriate, deleted.

12. Changes to this Notice

GSE Security may update this Notice when its services, legal obligations, suppliers or processing practices change. The effective date and version will appear at the top of the page. Material changes will be highlighted or otherwise communicated where required by law.

13. Contact

GSE Security

Pjetër Bogdani Street 12, Office 29, 1013 Tirana, Albania

Email: info@gsesecurity.al

Telephone: +355 (0)67 600 1777