Sections 1–11

1. Introduction
2. Who We Are — The Data Controller
3. Data Protection Officer / Privacy Contact
4. Scope of This Privacy
5. Key Definitions
6. Personal Data We Collect
7. How We Collect Personal Data
8. Purposes of Processing and Legal Basis
9. Legitimate Interests We Rely On
10. Cookies and Similar Technologies
11. How We Share Your Personal Data

Sections 12–21 & Checklist

12. International Data Transfers
13. Data Retention
14. How We Protect Your Data
15. Automated Decision-Making and Profiling
16. Your Rights Under the GDPR
17. How to Exercise Your Rights / Contact Us
18. Right to Lodge a Complaint
19. Links to Third-Party Websites
20. Changes to This Privacy Notice
21. Governing Law

Introduction

LES & Partners (“LES & Partners”, “we”, “us”, or “our”) is committed to protecting the privacy and security of personal data belonging to visitors to our website at les-partners.com (the “Website”), our clients, prospective clients, and other individuals who interact with us. This Privacy Notice explains, in accordance with Regulation (EU) 2016/679 (the “General Data Protection Regulation” or “GDPR”), [and, where applicable, the UK GDPR and Data Protection Act 2018,] what personal data we collect, why and how we use it, who we share it with, how long we keep it, how we protect it, and what rights you have in relation to it.

We encourage you to read this Notice in full. If you have any questions that are not answered here, please contact us using the details in Section 17 (Contact Us).

Who We Are — The Data Controller

For the purposes of the GDPR, the data controller responsible for your personal data is LES & Partners.

• Legal (trading) name: LES & Partners
• Registered company name: LES & PARTNERS L.L.C
• Company / registration number:812401389
• Registered office address: Prishtina, Kosovo
• Country of establishment: Kosovo
• Website: https://les-partners.com
• General contact email: info@les-partners.com
• Data Officer: Diona Zhubi

LES & Partners determines the purposes for which, and the manner in which, personal data collected via the Website is processed, and is therefore a “data controller” under Article 4(7) GDPR.

Data Protection Officer / Privacy Contact

Diona Zhubi has been appointed under Article 37 GDPR as the Data Protection Officer (DPO).

• Data Protection Officer: Diona Zhubi
• Contact email: dionazhubi@gmail.com / info@les-partners.com
• Postal address: 10000, Prishtina, Kosovo

Scope of This Privacy

This Privacy applies to personal data we process:
• When you visit or browse the Website;
• When you submit an enquiry, contact form, application, or other request via the Website;
• When you subscribe to newsletters, updates, or marketing communications (where offered);
• When you communicate with us by email, telephone, or post in connection with our services;
• When you become a client, supplier, or business contact of LES & Partners; and
• Through cookies and similar tracking technologies used on the Website (see Section 10).

This Privacy does not apply to third-party websites, applications, or services that may be linked from the Website. We encourage you to review the privacy notices of any third-party sites you visit.

Key Definitions

• Personal data: Any information relating to an identified or identifiable natural person (“data subject”).
• Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or erasure.
• Controller: The entity that determines the purposes and means of processing personal data — here, LES & Partners.
• Processor: A third party that processes personal data on behalf of, and under the instructions of, the controller.
• Special category data: Data revealing racial/ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life/sexual orientation (Art. 9 GDPR).
• Data subject: The identified or identifiable living individual to whom personal data relates.
• Supervisory authority: The independent public authority responsible for monitoring GDPR compliance in an EU/EEA member state.

Personal Data We Collect

6.1 Data You Provide Directly: Identity data (full name, title, job role, company name), Contact data (email, phone, address), Enquiry/communication content, Application/engagement data (CV, credentials) .
6.2 Technical Data: IP address, browser type/version, OS, device type, referring URLs, server logs.
6.3 Usage and Analytics Data: Pages viewed, session duration, scroll depth, form engagement, pseudonymised statistics.
6.4 Cookies: See Section 10.
6.5 Special Category Data: We do not intentionally collect special category data. Do not include it unless necessary and with explicit consent.
6.6 Children's Data: The Website is not directed at individuals under 16.

How We Collect Personal Data

• Directly from you, when you fill in forms, send enquiries, or otherwise communicate with us;
• Automatically, through your use of the Website, via cookies, server logs, and similar technologies;
• From third parties, such as publicly available sources, business partners, or referral sources, where relevant to our professional engagement with you.

Purposes of Processing & Legal Basis

Under Article 6 GDPR, we process data based on:
• Enquiries: Identity, contact, content — Consent (Art. 6(1)(a)) / Pre-contract steps (Art. 6(1)(b))
• Services: Identity, contact, engagement data — Performance of contract (Art. 6(1)(b))
• Website Operation: Technical data — Legitimate interest (Art. 6(1)(f))
• Analytics: Usage data, cookies — Consent (Art. 6(1)(a)) / Legitimate interest (Art. 6(1)(f))
• Marketing: Contact data — Consent (Art. 6(1)(a)) or soft opt-in
• Fraud & IT Security: Technical data — Legitimate interest (Art. 6(1)(f)) / Legal obligation (Art. 6(1)(c))
• Legal Compliance: Identity, contact, transaction data — Legal obligation (Art. 6(1)(c))
• Legal Claims: Relevant data — Legitimate interest (Art. 6(1)(f))

Legitimate Interests We Rely On

Our legitimate interests include:
• Ensuring security, integrity, and technical functioning of the Website;
• Understanding Website usage to improve content, layout, and user experience;
• Preventing fraud, misuse, unauthorised access, and malicious activity;
• Direct marketing to existing clients regarding similar services (soft opt-in), where permitted;
• Managing, exercising, or defending legal claims and rights.

A record of our Legitimate Interests Assessments (LIAs) is maintained internally and is available on request.

Cookies and Similar Technologies

We use cookies and tracking technologies (pixels, tags, local storage

Strictly Necessary:

wordpress_test_cookie

wordpress_logged_in_*

wordpress_sec_*

wp-settings-*

wp-settings-time-*

cookieyes-consent (or your cookie banner cookie)

Consent: Yes

Functional / Preference:

• cookieyes-consent
• pll_language (if using Polylang)
• wp_lang

Consent: Yes

• Analytics / Performance: Usage analysis Google Analytics)
Consent: Yes
• Marketing / Advertising: Not currently used.

Future consent: Yes

Manage or withdraw consent anytime via our cookie banner/footer link or browser settings.

How We Share Your Personal Data

We do not sell personal data. We share data with:
• Hosting & IT infrastructure providers such as: WordPress
• Analytics providers Google Analytics 4
• Email / communication service providers Google Workspace (Gmail)
• Professional advisers: External lawyers, auditors, accountants, insurers and other professional advisers where necessary


All processors are bound by Article 28 GDPR Data Processing Agreements (DPAs).

International Data Transfers

Some third-party providers may process data outside the EEA

• Google LLC (United States), where Google Workspace and/or Google Analytics services are used.

• Cloudflare, Inc. (United States), where Cloudflare services are used to provide website security, DNS management and content delivery.


Where applicable, depending on the location of the hosting infrastructure used to provide our website and related services.


Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR. Depending on the circumstances, these safeguards may include:

• An adequacy decision adopted by the European Commission pursuant to Article 45 GDPR.

• The European Commission's Standard Contractual Clauses (SCCs), supplemented where necessary by Transfer Impact Assessments (TIAs), in accordance with Article 46(2)(c) GDPR.

• Other appropriate safeguards permitted under Article 46 GDPR, including Binding Corporate Rules (BCRs), where applicable.

We regularly assess international data transfers to ensure that an essentially equivalent level of protection is afforded to personal data. Further information regarding the safeguards applicable to specific transfers, including copies of relevant transfer mechanisms where legally appropriate, is available upon request by contacting us.

Data Retention Policy

Data is retained only as long as necessary:
• Contact Form Submissions: 24 months from the date of the last correspondence, unless they result in a client engagement.
• Client / Engagement Records: For the duration of the client relationship and for 6 years following its termination, or longer where required by applicable law, regulatory obligations, or the establishment, exercise or defence of legal claims.
• Marketing Consent Records: Until consent is withdrawn, plus 3 years thereafter to demonstrate compliance with consent requirements and legal obligations.
• Technical / Server Logs: Between 6 and 12 months, unless a longer retention period is necessary for security investigations, incident response, or legal compliance.
• Analytics Data: 14 months (or the retention period configured within the analytics platform), after which the data is automatically deleted or anonymised.
• Financial Records: 10 years, or such longer period as required under applicable tax, accounting, anti-money laundering, or other statutory record-keeping obligations.

At the end of retention, data is securely deleted, anonymised, or archived.

How We Protect Your Data

Technical and organisational safeguards under Article 32 GDPR include:
• TLS/SSL encryption in transit and encryption at rest;
• Access controls and role-based permissions;
• Regular security assessments and vulnerability management;
• Secure hosting infrastructure with physical/network controls;
• Staff training on confidentiality;
• Data backup and disaster recovery procedures;
• Documented breach notification procedures (notifying authority within 72h under Art. 33 GDPR and individuals under Art. 34 GDPR).

Automated Decision-Making & Profiling

We do not currently use personal data for automated decision-making or profiling that produces legal effects or significantly affects you under Article 22 GDPR.

[IF THIS CHANGES — e.g. automated lead scoring or eligibility screening — this section must be updated to describe the logic involved, significance, envisaged consequences, and your right to obtain human intervention and contest decisions.]

Your Rights Under the GDPR

• Access (Art. 15): Obtain confirmation & copy of data.
• Rectification (Art. 16): Correct inaccurate data.
• Erasure (Art. 17): Request deletion ("Right to be forgotten").
• Restriction (Art. 18): Limit processing.
• Portability (Art. 20): Receive data in structured format.
• Object (Art. 21): Object to legitimate interest / direct marketing.
• Withdraw Consent (Art. 7(3)): Withdraw consent at any time.
• Automated Decisions (Art. 22): Right not to be subject to automated decisions.
• Lodge Complaint (Art. 77): Right to complain to supervisory authority.

We respond within 1 month (extendable by 2 months for complex requests).

How to Exercise Rights / Contact Us

To exercise rights or ask privacy questions, contact us:

• Email: info@les-partners.com | dionazhubi@gmail.com
• DPO / Privacy Lead: See Section 3

No fee is charged unless requests are manifestly unfounded, excessive, or repetitive (Art. 12(5) GDPR).

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority in your EU/EEA member state of residence, workplace, or place of alleged infringement.

We appreciate the opportunity to address concerns directly before contacting a regulator — please reach out to us first.

Links to Third Parties & Changes

19. Third-Party Links: The Website may contain links to third-party sites/plugins. We do not control third-party websites and are not responsible for their privacy practices. We encourage reading their notices.

20. Changes to Notice: Updates will be posted here with a revised "Last Reviewed" date. Material changes will be communicated via notice on the Website or direct contact.

Governing Law

21. Governing Law: Governed by LAW NO.03/L – 172 ON THE PROTECTION OF PERSONAL DATA of the Republic of Kosovo without prejudice to mandatory data protection rights in your country of residence.