Privacy Policy
Last updated: July 22, 2026
This policy explains clearly what personal data PunoTani.com collects, why, how it is used, where it is stored, and what your rights are. We wrote it to be understood, not to hide behind legal language.
1. Who is responsible for your data
The data controller is:
- Ermald Billa, natural person, Albania
- Email: privacy@punotani.com
PunoTani.com is not registered as a legal company — it is operated as an individual project by Ermald Billa, who holds full responsibility for the processing of your data.
2. Which legal framework applies
Data processing is primarily governed by Law No. 9887/2008 "On the Protection of Personal Data" of the Republic of Albania, as amended, which is modeled on European standards. In addition, PunoTani.com voluntarily applies the principles of the General Data Protection Regulation (GDPR, EU 2016/679) as an additional safety standard, even though the platform is not registered in the European Union. This means we handle your data with the same level of care required by European law, even where we are not strictly legally obligated to do so.
3. What data we collect
We only collect data that is genuinely necessary for the platform to function. No data is collected "just in case" or for undisclosed purposes.
3.1 When you apply for a job
- First and last name
- Email address
- The message/motivation you write in the application form
This data is sent directly to the company that posted the job listing, at the email address they registered.
3.2 When you create a candidacy profile (self-application)
- Name, email, phone number (optional)
- Professional title and bio (Albanian/English)
- Skills
- Profile photo (optional)
- CV in PDF/document format (optional)
- Location — city and, if specified, geographic coordinates
3.3 When you post a job as a company
- Company name and contact email
- Job details (title, description, salary, location, etc.)
- Company logo (optional)
3.4 When you contact us
- Name, email and the content of the message you send us via the contact form
3.5 Technical data collected automatically
- IP address — for security purposes (spam and abuse prevention) and in standard server logs
- Browser type and device — same technical logs
- Pages visited — only within server logs, not as an individual profile
Server logs are kept for a limited period, necessary only for security and technical diagnostic purposes, after which they are automatically deleted.
4. What we do NOT collect
For full transparency, this is just as important as the list above:
- We do not use tracking cookies of any kind.
- We do not use Google Analytics or any other third-party analytics tools.
- We do not display ads and do not share data with ad networks.
- We do not sell, rent or transfer your data to any third party for marketing purposes.
- We do not build behavioral profiles of visitors.
5. How we use your data
| Purpose | Legal basis |
|---|---|
| Sending your application to the company | Performance of your request (you initiated the application) |
| Public display of your candidacy profile (if approved) | Your consent, given at the time of submission |
| Sending confirmation emails and notifications | Performance of the requested service |
| Preventing spam and abuse (rate limiting) | Legitimate interest in platform security |
| Responding to contact messages | Performance of your request |
6. Who we share your data with
Your data is never used outside the purpose of the platform. We only share data with the minimal technical services necessary for the site to function:
- Hetzner Online GmbH (Germany) — our server hosting provider. Servers are physically located in Germany (Falkenstein/Nuremberg), within the European Union, protected by high GDPR-grade standards.
- Aruba S.p.A. (Italy) — our email delivery provider for automated notifications (SMTP). Email servers are located in Italy, within the EU.
- OpenStreetMap Foundation — when you or a company provide an address, it is sent to their map service (Nominatim) only to convert the address into geographic coordinates for map display. No other personal data is transmitted.
None of these providers is permitted to use your data for any purpose other than delivering the technical service they are contracted for.
7. How long we keep your data
We do not set an automatic deletion deadline — your data remains stored until you request its deletion. This gives you full control over timing: you may request deletion at any time, without providing a reason, and we will act on it as quickly as possible.
We periodically review data to remove records that no longer serve any purpose (e.g. very old applications for job listings closed long ago).
8. Your rights
In line with data protection principles, you have the right to:
- Access your data — request a full copy of what we store about you.
- Correct inaccurate or incomplete data.
- Erase your data ("right to be forgotten") — unconditionally, at any time.
- Restrict processing of your data in specific cases.
- Port your data (portability) in a readable format.
- Object to processing if you believe there is insufficient legal basis.
- Withdraw consent at any time, where processing is based on consent (e.g. public candidacy profile).
To exercise any of the above rights, write to us at privacy@punotani.com. We will respond within 30 days.
9. Data security
We take serious technical measures to protect your data:
- Passwords are stored encrypted (hashed), never in plain text.
- The connection to the site is encrypted via HTTPS/SSL.
- Forms are protected against CSRF attacks and rate-limited against spam.
- Access to the admin panel is restricted and protected by an encrypted password.
- Servers are located in the European Union, on infrastructure with certified security standards.
10. Cookies
We only use one technically necessary session cookie, required for the site's basic functioning (such as keeping your login session in the panel, if you are an administrator). For full details, see our Cookie Policy.
11. Minors
PunoTani.com is intended for users over 16 years of age. We do not knowingly collect data from individuals below this age. If you are a parent or guardian and believe a minor has provided us with data, please contact us immediately so we can delete it.
12. Changes to this policy
If we change how we handle your data, we will update this page and note the new update date at the top. Substantial changes will be prominently announced on the site.
13. Contact
For any questions about this policy or your personal data:
Ermald Billa
Email: privacy@punotani.com