Privacy & Data Protection Policy

1. General Information

Northstep Shpk respects your privacy and is committed to protecting your personal data in accordance with Albanian Law No. 124/2024 'On Personal Data Protection' and applicable international data protection standards.

This Privacy Policy explains how we collect, use, process, store, protect, and manage your personal data when you use our website or professional services.

As an IDPC-certified external Data Protection Officer and holder of the CIPP/E (Certified Information Privacy Professional/Europe) certification issued by the IAPP, Northstep applies the same high standards of compliance and transparency that we provide to our clients.

2. Data Controller

3. Data Protection Officer

For any questions regarding the processing of your personal data or to exercise your rights, you may contact our Data Protection Officer:

• Email: info@northstep-al.com
• Phone: +355 69 236 5128

4. Personal Data We Collect

• First and last name
• Email address
• Phone number
• Company information
• Information related to data privacy, compliance, audit, and advisory services
• Technical data such as IP address, cookies, and browser information

5. Purpose of Processing

• Providing Data Privacy services
• External Data Protection Officer (DPO) services
• Audit & Assurance services
• Financial Advisory services
• Communication with clients
• Management of contracts and client relationships
• Compliance with legal obligations
• Improving our website and professional services

6. Legal Basis for Processing

• Your consent
• Performance of a contract
• Legitimate business interests
• Compliance with legal obligations

7. Data Protection & Security

Northstep implements appropriate technical and organizational measures to ensure the security and confidentiality of personal data.

• Secure storage systems
• Access restricted to authorized personnel only
• Protection against unauthorized access or disclosure
• Data Protection by Design & by Default principles
• Continuous monitoring and security controls

8. Confidentiality

All client documents, information, and communications are handled with the highest level of confidentiality and professional responsibility.

9. Data Retention

Personal data is retained only for as long as necessary to fulfill legal, contractual, and professional obligations.

10. Data Sharing

Your personal data is never sold or rented.

It may only be shared:

• When required by law
• With authorized data processors under appropriate agreements
• With your explicit consent

11. International Data Processing

Where international transfers are necessary, Northstep applies appropriate safeguards in accordance with Albanian legislation and Commissioner's Decision No. 1/2025.

12. Your Rights

• Right of access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right to object
• Right to data portability
• Right to withdraw consent
• Right to lodge a complaint with the Commissioner for the Right to Information and Protection of Personal Data

13. Cookies

Our website may use cookies and similar technologies to improve your browsing experience and website functionality. You can manage or disable cookies through your browser settings.

14. Contact

Email: info@northstep-al.com

Phone: +355 69 236 5128

Address: Rruga Jordan Misja, Nd. 6/716/N15, Tirana 8330, Albania