1. Who the data controller is
The data controller is Autoshkolla Pepa, a trader registered with the National Business Centre under NIPT L52226005M, owned by Lumturi Pepa, at Rruga Aleksandër Moisiu, Stacioni i fundit i Porcelanit, Godina 1, Tiranë.
For any question or request about your data, contact us by the phone / WhatsApp or email shown on the Contact page, or at the office.
2. What data we collect
Only the data you give us and that we need:
- Contact form: name, phone number, the category you are interested in and your message.
- Registration request on the homepage: first and last name, phone, email (optional), category, transmission and preferred time.
- Full registration: first and last name, date of birth, phone, email, password (stored only hashed, never as text), category / package and the documents you upload (e.g. ID card, first-aid certificate / medical documents required for the licence procedure).
- During the course (student portal): theory and practice sessions, instructor assessments, payments and exam results.
- Technical data: your IP address is used temporarily to limit abusive attempts on forms and login (security); technical server logs are kept by the hosting provider.
3. Why we use it and on what legal basis
- To contact you and inform you about the course you asked about: steps prior to a contract, at your request.
- For registration, running the course, scheduling lessons and payments: performance of the contract.
- For registering the candidate with DPSHTRR and for tax / accounting duties: legal obligation.
- For site security, abuse prevention and the system audit trail: legitimate interest.
- Where we ask for consent (e.g. the consent box on a form), you may withdraw it at any time without affecting earlier processing.
4. Who receives the data
We do not sell your data or share it for third-party marketing. We share it only with:
- DPSHTRR (General Directorate of Road Transport Services), for licence registration and exams.
- Providers acting as our processors under contract and only on our instructions: Vercel (website hosting, servers in Frankfurt, EU), Supabase (database and document storage), Upstash (form abuse protection).
- Public authorities, where the law requires it.
5. Transfers outside Albania
Some of these providers may process data in or outside the European Union. Such transfers take place only under the conditions of Law no. 124/2024, with appropriate safeguards (e.g. countries with an adequate level of protection or standard contractual clauses).
6. How long we keep it
- Contact messages and registration requests: deleted automatically after 24 months.
- Documents uploaded in a registration that was never completed: deleted after 24 hours.
- Documents of a rejected registration: the file is deleted after 90 days.
- Student and course records: for the duration of the course and then for the periods required by law (e.g. financial records under accounting legislation).
- System audit trail: 3 years. Read notifications: 1 year.
7. Your rights
Under Law no. 124/2024 you have the right to:
- be informed and get a copy of your data (access);
- correct inaccurate data;
- ask for erasure where there is no longer a legal basis to keep it;
- restrict processing, or object to processing based on legitimate interest;
- receive your data in a machine-readable format (portability);
- withdraw consent at any time.
8. How to exercise your rights and where to complain
Send your request by phone / WhatsApp, email or at the office. We may ask you to confirm your identity. We reply without delay and within the legal deadline (as a rule, one month).
If you believe your rights have been breached, you may complain to the Commissioner for the Right to Information and Personal Data Protection (IDP), Tirana, www.idp.al.
9. Minors
Candidates under 18 (where the category allows) register with the knowledge and consent of a parent or legal guardian, who may exercise the rights above on their behalf.
10. Security
The site uses encrypted connections (HTTPS). Passwords are stored only hashed. Documents are kept in private storage accessible only to authorised staff. Access is limited by role (administrator, instructor, student) and important actions are logged.
11. Changes
This policy may be updated. The date of the latest version is shown at the top. We will announce important changes in the portal or on the site.