Privacy Policy
This Privacy Policy explains how Spontan Creative Media Sh.p.k. (“SCM”, “we”, “us”) collects, uses, shares and protects personal data when you visit spontan.agency, contact us, submit one of our forms, subscribe to our newsletter, use our client portal or otherwise interact with us. It also explains your rights and how to exercise them.
We process personal data in accordance with Albanian Law No. 124/2024 “On Personal Data Protection” and, where it applies to our activities, the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).
1. Who is responsible for your data
The controller of your personal data is:
Spontan Creative Media Sh.p.k.
NUIS: L82322017V
Str. Besim Imami, No. 62, Tirana, Albania
Email: [email protected]
SCM operates a management system certified to ISO/IEC 27001:2022 for information security. Our internal rules for handling personal data are set out in our Data Privacy and Protection Policy (SCM-DP-03), available on request.
2. What data we collect and why
We collect only the data we need for the purposes below. Fields marked as required in our forms are necessary to respond to your request; other fields are optional.
| Activity | Data we collect | Purpose | Legal basis |
|---|---|---|---|
| Submit a ToR / RFP / RFQ form | Organization, email, project title, contact person, country, organization type, preferred response format, submission deadline and expected start date, whether an NDA is required, any documents you upload and your message | To assess your request, prepare a proposal or quotation and communicate with you about it | Steps taken at your request before entering into a contract; our legitimate interest in responding to business enquiries |
| Consortium partnership form | Organization, email, tender or project title, the role expected for Spontan, contact person, country, website, target country or region, required expertise, consortium status, any documents you upload and your message | To evaluate potential partnerships for tenders and projects and to contact you about specific opportunities | Our legitimate interest in building partnerships; steps taken at your request before entering into an agreement |
| Credentials and company profile requests | Name, organization, professional email, country, website, whether an NDA is required, the purpose of the request, tender or project title, deadline, the documents you need and your message | To review the request and provide the appropriate company, technical or procurement documentation | Our legitimate interest in responding to due diligence and procurement requests; steps taken at your request before entering into a contract |
| Policy and certificate requests | Name, company or institution, company email and the documents you select | To review the request and send you the requested policies or certificates | Our legitimate interest in responding to enquiries; your request |
| Media kit requests | Name, organization or outlet, email, role, country, deadline, where and how the materials will be used and your message | To review the request and send you the appropriate media materials | Our legitimate interest in responding to media and partnership enquiries; your request |
| Contact form | Name, email, the reason for contacting us, organization, role, country, website, phone and your message | To respond to you | Our legitimate interest in responding to communications; steps before a contract where relevant |
| Job and internship applications | Name, email, phone, CV, cover letter and any other information you choose to provide | To assess your application and manage our recruitment process | Steps taken at your request before entering into an employment contract; your consent if you ask us to keep your application for future opportunities |
| Expert network registration | Name, email, primary area of expertise, country or location, years of experience, sectors, languages, website or LinkedIn profile, CV or portfolio and your message | To include you in our pool of experts and contact you about relevant assignments and tenders | Your consent, which you can withdraw at any time |
| Newsletter | Email address, first name (optional), subscription preferences and engagement data such as opens and clicks | To send you news about our work, insights and events | Your consent, which you can withdraw at any time using the unsubscribe link in every email |
| Client portal | Name, email and login details of the people a client organization gives access, and the comments, approvals and files exchanged through the portal | To give clients access to their projects, share deliverables and record feedback and approvals | Performance of our contract with the client organization; our legitimate interest in keeping project communication secure and on record |
| Contact by email or phone | Your contact details and the content of your message | To respond to you | Our legitimate interest in responding to communications; steps before a contract where relevant |
| Website visits | Technical data such as IP address, browser, device, pages visited and referring website, collected through server logs, the form protection service and, with your consent, analytics and advertising tools | To operate and secure the website, protect our forms against spam and abuse and, with your consent, to understand how the website is used and measure our advertising | Our legitimate interest in operating a secure website (server logs, form protection); your consent (analytics and advertising cookies) |
When you submit a CV or profile, please do not include sensitive information such as health data, religious or political beliefs, or identity document numbers unless we specifically ask for it and it is required by law. If you share information about other people, for example team members in a consortium proposal, please make sure they are aware and agree.
When we apply to tenders together with consortium partners or experts, we share your information with the contracting authority only with your agreement and only to the extent needed for that procedure.
We do not sell your personal data and we do not use it to make decisions about you based solely on automated processing.
3. Business contacts from public sources
Not all the data we hold comes from you directly. To find organizations that may need our services or be suitable partners, we may collect the business contact details of professionals, such as name, role, organization, business email and phone, from public sources: official company and institution websites, public registers and published tender and procurement documents.
We use these details only to contact organizations about relevant services, tenders and partnerships, on the basis of our legitimate interest in business-to-business communication. When we first contact you, we tell you where your details came from. Every message includes a simple way to object, and if you do, we stop contacting you and keep only what is needed to respect your objection.
4. Analytics, advertising, embedded content and cookies
We use the following tools to understand how our website is used and to measure and improve our advertising:
- Google Analytics (Google LLC / Google Ireland Limited): statistics about visits, pages viewed, traffic sources and general location derived from IP address.
- Google Ads (Google LLC / Google Ireland Limited): measurement of the effectiveness of our advertising campaigns and, where you consent, remarketing.
- Microsoft Clarity (Microsoft Corporation / Microsoft Ireland Operations Limited): heatmaps and session replays that show how visitors interact with pages, such as clicks and scrolling. Clarity is configured to mask text you type into form fields.
Google Analytics and Google Ads run in Google Consent Mode: without your consent they set no cookies and send only cookieless, aggregated signals; analytics and advertising cookies are used only after you accept them through our cookie banner. Microsoft Clarity is loaded only after you accept analytics cookies. You can change your choice at any time.
We also use Google Search Console, which provides aggregated data about how our site appears in Google Search. It does not place cookies on your device.
Embedded video. Some pages show videos hosted on YouTube (Google), embedded through its privacy-enhanced mode (youtube-nocookie.com). Loading such a video connects your browser to Google, which receives technical data such as your IP address. In this mode Google does not use the visit to personalize YouTube or its advertising, but the player may store technical information on your device so that it can work.
For details of the cookies used, see our Cookie Notice.
5. Who we share data with
We share personal data only where necessary and with appropriate safeguards:
- Service providers who process data on our behalf under contract, including our website hosting provider (Hetzner Online GmbH), Cloudflare (Turnstile), which protects our forms against spam and abuse, email and newsletter service providers, cloud storage and productivity tools, and the analytics, advertising and video providers listed above.
- Clients and contracting authorities, when you are part of a proposal or project and you have agreed to your details being included.
- Consortium partners, where needed to prepare a joint proposal you are part of.
- Professional advisers, such as lawyers, accountants and auditors, under duties of confidentiality.
- Public authorities, when we are required to do so by law or to establish, exercise or defend legal claims.
A list of our main service providers is available on request.
6. Where your data is stored and international transfers
Our website and the data submitted through it are hosted by Hetzner Online GmbH in its data centre in Helsinki, Finland, within the European Union.
Some of our service providers, including Google, Microsoft and Cloudflare, may process data outside Albania and the European Economic Area, including in the United States. Where this happens, we rely on the safeguards required by law, such as the EU–U.S. Data Privacy Framework where the provider is certified, standard contractual clauses or other approved transfer mechanisms. You may contact us for more information about these safeguards.
7. How long we keep your data
| Data | Retention period |
|---|---|
| RFP, consortium, credentials and other business enquiries that do not lead to a contract | 2 years from our last contact |
| Data relating to contracts we enter into | For the duration of the contract and afterwards for the period required by accounting, tax and contractual obligations |
| Client portal accounts | For as long as the client organization has access, and then for the period required by our contract and legal obligations |
| Job and internship applications | 12 months after the end of the recruitment process, or up to 24 months if you agree that we keep your application for future opportunities |
| Consortium partnership and expert network profiles | Until you ask us to remove them, and in any case we review profiles with no contact for 3 years and delete them unless you confirm you wish to stay |
| Business contacts from public sources | 2 years from our last interaction, or earlier if you object |
| Media kit, policy requests and general enquiries | 2 years from our last contact |
| Newsletter | Until you unsubscribe; we may keep a record of your unsubscribe request to make sure we do not contact you again |
| Analytics data | According to the retention settings of each tool, which we keep to the minimum needed, and in any case no longer than 14 months for Google Analytics |
| Server security logs | Up to 90 days, unless needed to investigate a security incident |
When data is no longer needed, we delete or anonymize it securely.
8. How we protect your data
We apply technical and organizational measures appropriate to the risk, under our ISO/IEC 27001 information security management system. These include encrypted connections (HTTPS), access controls and multi-factor authentication, restriction of access to staff who need the data, encrypted backups, supplier security reviews and staff training. No method of transmission over the internet is completely secure, but we work to protect your data and to respond promptly to any incident, including notifying the authorities and affected people where required by law.
9. Your rights
Subject to the conditions set by law, you have the right to:
- Access the personal data we hold about you and receive a copy;
- Rectify inaccurate or incomplete data;
- Erase your data where there is no longer a valid reason for us to keep it;
- Restrict the processing of your data in certain circumstances;
- Object to processing based on our legitimate interests, and to direct marketing at any time;
- Data portability, to receive data you provided to us in a structured, commonly used format;
- Withdraw consent at any time, without affecting processing carried out before withdrawal;
- Not be subject to decisions based solely on automated processing that significantly affect you.
To exercise your rights, email [email protected]. We may ask you to verify your identity. We respond within one month of receiving your request; this period may be extended where the law allows, in which case we will tell you why.
You also have the right to lodge a complaint with the Commissioner for the Right to Information and Personal Data Protection (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale), Tirana, Albania, www.idp.al. If you are in the European Union, you may also contact the data protection authority in the country where you live or work. We would appreciate the chance to address your concern first.
10. Children
Our website and services are intended for professionals and organizations. We do not knowingly collect personal data from children under 16 through this website. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Changes to this policy
We may update this Privacy Policy when our activities, tools or legal obligations change. The date at the top of this page shows when it was last updated. Where changes are significant, we will make this clear on our website.
12. Contact us
For any question about this policy or about how we handle your personal data, contact:
Spontan Creative Media Sh.p.k.
Str. Besim Imami, No. 62, Tirana, Albania
Email: [email protected]