Website privacy notice

Who is responsible

ThelbWise Tech, a remote-first technology team based in Tirana, Albania, is responsible for personal information processed through this website.

For privacy or data-protection requests, email security@thelbwise.com.

Information we process

• Enquiries: your name, contact email, optional company, chosen team member, message, privacy-notice acknowledgement, submission time, status, assignment, and authorized internal follow-up notes.
• Client reviews: invitation recipient details, review text, name, professional role, company, optional HTTPS profile or company link, authenticity confirmation, publication consent, moderation state, and related timestamps.
• Security and delivery data: IP address, user-agent and browser or device signals, request metadata, rate-limit results, Turnstile verification results, email-delivery status, and limited error or audit information.
• Administration: the authenticated company email address and actions of approved administrators.

Please do not put passwords, payment-card data, health information, identity documents, or other unnecessary sensitive information in an enquiry or review.

Purposes and legal bases

• We process enquiries to take steps you request before a possible contract and for our legitimate interests in answering requests, routing work, keeping a limited business record, and protecting the service.
• We process technical and administrative information for our legitimate interests in preventing abuse, maintaining security, diagnosing delivery problems, and keeping accountable records.
• We publish a client review only with the reviewer’s explicit permission. That permission can be withdrawn for future publication at any time.
• We may retain or use limited information when necessary to comply with law or establish, exercise, or defend legal claims.

We do not use website submissions for automated decisions, profiling, advertising, or mailing-list marketing.

What you need to provide

The contact form requires a name, working email address, message, and acknowledgement that this notice was presented. Without them, we cannot reliably receive and answer the enquiry. Company name and selection of a particular team member are optional. Review information is required only when a person chooses to use a private review invitation.

Who receives the information

Cloudflare provides website delivery, security, Turnstile, rate limiting, Access authentication, logs, and the D1 database. Zoho provides transactional email and company mailboxes. A general enquiry goes to approved administrators and the company contact group; an enquiry directed to a team member is sent to that member. Review invitation and moderation data is available only to approved administrators until a review is published.

We do not sell personal information. We disclose it to another party only when needed to operate these services, when you ask us to, or when law requires it.

International processing

Cloudflare operates a global network. The website uses Zoho’s European service endpoints, although limited support or sub-processor access may occur from other countries. Where personal information is transferred internationally and applicable law requires safeguards, we rely on an adequacy decision, binding contractual protection, or another permitted transfer mechanism. You may contact us for information about the safeguards relevant to your information.

Cookies and similar technology

We have not configured advertising or audience-analytics cookies. Cloudflare security and Turnstile may process strictly necessary browser or device signals and may use necessary cookies or local storage to distinguish people from automated traffic and protect the forms. Turnstile does not receive the content entered in the form. See Cloudflare’s Turnstile privacy information.

Retention

• An enquiry remains in the active website database for no more than 365 days after submission or the latest documented contact. A daily automated job deletes expired active records.
• Pending reviews are deleted after 180 days, rejected reviews after 90 days, and withdrawn reviews after 30 days.
• Published reviews remain visible while publication permission applies. Invitation-recipient contact details are anonymized 90 days after publication.
• Unused, revoked, and otherwise inactive review invitations are deleted after 90 days. Administrative audit events are deleted or de-identified after 365 days.
• Authorized mailbox copies are subject to the same 365-day operational limit unless a longer period is necessary for a contract, legal obligation, dispute, or legal claim. Security logs, delivery logs, and recoverable provider backups follow the provider’s configured schedule and are kept only as long as needed for delivery, security, recovery, or legal compliance.

Your rights

Subject to the conditions and exceptions in applicable law, you may request access to your personal information, correction, completion, deletion, restriction, or portability, and may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent at any time without affecting earlier lawful processing.

Email security@thelbwise.com from the address connected with the record and describe your request. We may request only the additional information reasonably needed to verify identity. We normally respond within 30 days and will explain any lawful extension or refusal.

Complaints

Please contact us first so we can investigate. You also have the right to complain to Albania’s Commissioner for the Right to Information and Protection of Personal Data through its official complaint channel, and may have the right to seek a judicial remedy.

Security and changes

We use access controls, encrypted transport, restricted administrator access, anti-abuse controls, bounded retention, and audit records appropriate to this service. No internet service can guarantee absolute security. If this notice or the website’s processing changes materially, we will update this page and its date before the new processing begins where required.