Privacy and Data Protection Policy

1

Purpose of this Policy

Roma Versitas Albania (“RVA”, “we”, “us” or “our”) is committed to respecting the privacy, dignity and fundamental rights of every person whose personal data we process.

This Privacy and Data Protection Policy explains how RVA collects, uses, stores, shares and protects personal data in connection with its programmes, projects, educational activities, employment and procurement processes, events, research, communications, website and organisational operations.

This Policy applies to personal data relating to, among others

• students and programme beneficiaries;
• parents and legal guardians;
• applicants for scholarships, programmes, training or other opportunities;
• job applicants, employees, consultants and volunteers;
• trainers, mentors and experts;
• suppliers and contractors;
• donors, partners and representatives of other organisations;
• event participants;
• research participants;
• newsletter subscribers and people who contact RVA;
• visitors to the RVA website.

RVA processes personal data in accordance with applicable Albanian legislation, particularly Law No. 124/2024 “On Personal Data Protection”, and, where applicable, relevant European data-protection standards including the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

2

Data Controller

The controller responsible for the processing of personal data described in this Policy is:

RVA determines the purposes and means by which personal data under its responsibility are processed.

Questions regarding privacy, personal data or the exercise of data-protection rights may be sent to rva@rvalb.org.

Where RVA formally designates a Data Protection Officer, the relevant contact details will be published on this website and communicated as required by law.

3

Data Protection Principles

RVA processes personal data according to the following principles:

Lawfulness, fairness and transparency

Personal data must be processed lawfully, fairly and in a transparent manner.

Purpose limitation

Personal data are collected for specified, explicit and legitimate purposes and are not used incompatibly with those purposes.

Data minimisation

RVA seeks to collect only the information that is necessary for the relevant activity.

Accuracy

Reasonable steps are taken to ensure that personal data are accurate and, where necessary, kept up to date.

Storage limitation

Personal data are retained only for as long as necessary for the purposes for which they were collected or as required by law, contracts, donor obligations or legitimate organisational requirements.

Integrity and confidentiality

Personal data are protected against unauthorised or unlawful processing and against accidental loss, destruction, alteration or damage.

Accountability

RVA is responsible for its personal-data processing activities and for demonstrating compliance with applicable data-protection requirements.

4

Personal Data We May Process

Depending on the relationship between an individual and RVA, we may process the following categories of data.

Identification and contact information

This may include:

• name and surname;
• date of birth;
• postal address;
• email address;
• telephone number;
• identification details where legally or operationally required;
• emergency contact information.

Education and programme information

This may include:

• school or university attended;
• course of study;
• academic level;
• academic results;
• enrolment or attendance information;
• scholarship information;
• training participation;
• mentoring and tutoring records;
• programme progress and outcomes.

Employment and professional information

This may include:

• curriculum vitae;
• education and qualifications;
• professional experience;
• references;
• employment history;
• application and interview information;
• contractual information;
• attendance and performance information where applicable.

Financial and administrative information

This may include information necessary for:

• scholarships;
• reimbursements;
• payments;
• employment;
• procurement;
• contracts;
• accounting;
• financial reporting;
• donor or audit requirements.

This may include bank-account information where necessary.

Programme and event participation information

We may record information about participation in:

• workshops;
• conferences;
• training;
• mentoring;
• educational activities;
• advocacy initiatives;
• community activities;
• project events.

Photographs, video and audio

RVA may collect or create photographs, video recordings, interviews or other media in connection with its activities.

Where required, RVA will obtain appropriate consent or another valid legal basis before publishing identifiable individuals.

Additional safeguards apply when children or vulnerable individuals are involved.

Communications

We may process correspondence sent through:

• email;
• website forms;
• applications;
• surveys;
• enquiries;
• complaints;
• social-media communications where relevant.

Website and technical information

When someone visits the RVA website, limited technical information may be generated automatically, such as:

• IP address;
• browser type;
• device type;
• operating system;
• date and time of access;
• requested pages;
• security and server logs.

The exact information collected depends on the technical services active on the website at the relevant time.

5

Sensitive Personal Data

Some of RVA’s activities may involve information that receives additional legal protection.

Sensitive personal data may include information revealing or relating to:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade-union membership;
• health;
• genetic or biometric information;
• sexual orientation;
• other categories treated as sensitive under applicable law.

Because RVA’s mission includes programmes supporting Roma and Egyptian communities, information concerning Roma or Egyptian ethnic origin may constitute sensitive personal data.

RVA will process sensitive personal data only where there is an appropriate legal basis and the additional requirements applicable to sensitive data are satisfied. Depending on the circumstances, this may include explicit consent or another basis expressly permitted by law.

RVA will not request sensitive information merely because it may be useful.

Such information should be collected only where it is necessary for a legitimate and defined purpose, including eligibility, monitoring of inclusion objectives, delivery of appropriate support, fulfilment of programme requirements, research, safeguarding or reporting obligations.

Where possible, sensitive information used for statistical or donor reporting will be aggregated, anonymised or pseudonymised.

6

Children and Young People

RVA works with students and young people and therefore gives particular importance to the protection of children’s personal data.

Information directed to children should be written and communicated in clear and understandable language.

Where processing relies on consent and the individual is below the age at which they may legally provide that consent independently, RVA will obtain consent or authorisation from a parent or legal guardian as required by applicable law.

Heightened safeguards apply in relation to

• photographs and video;
• online publication;
• educational records;
• programme assessments;
• ethnicity;
• health or social circumstances;
• safeguarding information.

RVA will not publicly identify a child in photographs, stories, case studies or other communications where doing so would be unlawful or would create an unreasonable risk to the child.

The best interests, dignity and safety of children must take priority over communications, reporting or promotional objectives.

7

Why We Process Personal Data

RVA may process personal data for purposes including:

• administering educational and scholarship programmes;
• assessing applications and eligibility;
• providing mentoring, tutoring, training and professional-development activities;
• organising events and workshops;
• communicating with participants and applicants;
• managing employment and recruitment;
• engaging consultants, trainers and suppliers;
• fulfilling contractual obligations;
• making payments and reimbursements;
• maintaining accounting and financial records;
• monitoring programme implementation;
• evaluating programme outcomes;
• preparing project reports;
• fulfilling donor and audit requirements;
• conducting research and statistical analysis;
• producing publications and impact reports;
• protecting participants and ensuring safeguarding;
• managing complaints and enquiries;
• operating and securing the RVA website;
• maintaining organisational records;
• complying with legal and regulatory obligations;
• communicating RVA activities where legally permitted.

Personal data will not be used for a materially incompatible purpose without an appropriate legal basis and, where required, further information being provided to the individual.

8

Legal Bases for Processing

Depending on the activity, RVA may rely on one or more lawful bases.

Consent

We may process information where an individual has freely given specific and informed consent.

Where consent is used, it may be withdrawn at any time. Withdrawal does not affect the legality of processing carried out before consent was withdrawn.

Contractual necessity

Processing may be necessary to enter into or perform a contract, including employment, consultancy, service, scholarship or other agreements.

Legal obligation

RVA may process information where required to comply with Albanian law or another legal obligation applicable to the organisation.

Legitimate interests

RVA may process information where necessary for legitimate organisational interests, provided those interests are not overridden by the fundamental rights and freedoms of the individual. Examples may include:

• organisational administration;
• network and website security;
• fraud prevention;
• appropriate communications with existing partners;
• management of organisational records.

Additional care is applied when the individual is a child.

Vital interests

In exceptional circumstances, information may be processed when necessary to protect the life, health or vital interests of an individual or another person.

Public-interest or other legally authorised processing

Where applicable, RVA may process personal data when necessary for a task carried out in the public interest or under another basis expressly provided by applicable legislation.

Sensitive personal data are processed only where the additional legal requirements applicable to such information are satisfied.

9

How We Obtain Personal Data

RVA may obtain information:

• directly from the individual;
• from a parent or legal guardian;
• through programme applications;
• through employment or procurement applications;
• through partner organisations involved in joint programmes;
• from schools, universities or institutions where authorised and necessary;
• from donors or programme administrators;
• from publicly available sources where lawful;
• through the RVA website;
• during RVA events and programme activities.

Where personal data are obtained indirectly, RVA will provide the required information to the individual where legally required.

10

Data Sharing

RVA does not sell personal data.

Personal data may be shared only where necessary and lawful. Recipients may include:

• project partners;
• donors or funding organisations;
• auditors;
• accountants;
• legal or professional advisers;
• IT and hosting providers;
• cloud and communications providers;
• payment or banking providers;
• trainers, mentors or consultants involved in programme delivery;
• government or public authorities where required by law;
• other service providers acting on RVA’s behalf.

RVA seeks to disclose only the minimum information required for the relevant purpose.

Where a third party processes personal data on behalf of RVA, appropriate contractual and organisational safeguards should be used.

Donor or partner reporting should use aggregated or anonymised information wherever individual identification is unnecessary.

11

International Data Transfers

Some service providers, donors, partners or technology systems used by RVA may process information outside Albania.

When personal data are transferred internationally, RVA will take steps required by applicable data-protection law to ensure an appropriate level of protection.

Depending on the destination, safeguards may include

• a legally recognised adequacy mechanism;
• contractual safeguards;
• binding legal arrangements;
• explicit consent where legally appropriate;
• another transfer mechanism authorised by applicable law.

Sensitive information and information relating to children require particular care before any international transfer.

12

Data Retention

RVA does not intend to keep identifiable personal data indefinitely.

Retention periods depend on

• why the information was collected;
• the duration of the relevant project or programme;
• legal obligations;
• contractual obligations;
• donor requirements;
• accounting and audit requirements;
• limitation periods for potential legal claims;
• safeguarding needs;
• legitimate archiving or research requirements.

Once no longer required, RVA will

• delete them securely;
• destroy physical records securely;
• anonymise them; or
• archive them where continued retention is legally justified.

Where programme statistics can be retained without identifying individuals, RVA will prefer anonymised or aggregated data.

13

Information Security

RVA applies reasonable technical and organisational measures appropriate to the nature and risk of the information being processed. These may include:

• access controls;
• password protection;
• role-based access;
• secure hosting;
• secure backups;
• malware and security protection;
• secure transfer of documents;
• confidentiality obligations;
• staff awareness and training;
• controlled storage of paper records;
• secure deletion or destruction;
• restrictions on access to sensitive information.

No digital system can provide absolute security, but RVA seeks to reduce risks of unauthorised access, alteration, disclosure, loss or destruction.

Staff, contractors and other persons with authorised access to personal information are expected to maintain confidentiality.

14

Personal Data Breaches

A personal data breach may include accidental or unlawful:

• destruction;
• loss;
• alteration;
• unauthorised disclosure;
• unauthorised access to personal data.

RVA will investigate suspected personal-data breaches and take appropriate measures to contain and mitigate their effects.

Where required by Law No. 124/2024, RVA will notify the Commissioner for the Right to Information and Protection of Personal Data within the applicable legal period.

Where a breach is likely to result in a high risk to affected individuals, RVA will also inform those individuals when required by law.

RVA will maintain appropriate records of data breaches and remedial actions.

15

Your Data Protection Rights

Subject to the conditions and limitations established by applicable law, individuals may have the right to:

Be informed

You have the right to clear information about how your personal data are used.

Access your personal data

You may ask whether RVA processes information about you and request access to that information.

Rectification

You may request correction of inaccurate information and completion of incomplete information.

Erasure

You may request deletion of personal data in circumstances provided by law.

Right to be forgotten

Where legally applicable, you may request appropriate measures in relation to personal data that have been made public.

Restriction of processing

You may request that certain processing be restricted in circumstances provided by law.

Data portability

Where legally applicable, you may request eligible personal data in a structured, commonly used and machine-readable format or request transfer to another controller.

Object to processing

You may object to certain processing based on your particular circumstances. You may object to direct marketing at any time.

Withdraw consent

Where processing is based on consent, you may withdraw that consent at any time.

Rights concerning automated decisions

Where applicable, you may have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

RVA does not intend to make significant decisions about programme participants solely through automated decision-making unless appropriate legal safeguards are in place.

16

How to Exercise Your Rights

Requests relating to personal data may be sent to:

Please provide enough information for RVA to understand your request and identify the relevant records.

RVA may request reasonable additional information to verify identity before releasing or changing personal data.

Requests will be handled within the periods required by applicable law.

The exercise of data-protection rights is generally free of charge, except where the law permits a reasonable charge or refusal in relation to manifestly unfounded or excessive requests.

17

Photographs, Videos and Stories

RVA frequently communicates the impact of its educational and social-inclusion activities.

Media and personal stories are handled with regard for

• dignity;
• informed participation;
• safeguarding;
• cultural sensitivity;
• privacy;
• the individual’s ability to understand how the material will be used.

Where required, consent will be obtained before identifiable media are used publicly.

Consent for publicity or storytelling should be separate from participation in essential RVA services where participation does not require such publicity.

Refusing optional photography or publicity consent should not, by itself, prevent an individual from receiving an RVA service or participating in a programme.

Additional safeguards apply to children and sensitive personal information.

18

Research, Monitoring and Evaluation

RVA may collect information to evaluate programmes, measure impact, carry out research and fulfil donor reporting obligations.

Where possible, RVA will use

• anonymised information;
• aggregated statistics;
• pseudonymised datasets;
• minimal identifying information.

Research involving sensitive data, children or potentially vulnerable individuals should be subject to additional safeguards appropriate to the risk.

Published reports should not identify participants unless there is a lawful basis and publication is appropriate in the circumstances.

19

Recruitment and Applications

When an individual applies for employment, consultancy, volunteering, training, scholarships or other opportunities, RVA may process the information necessary to:

• assess the application;
• communicate with the applicant;
• conduct interviews;
• verify qualifications or references where appropriate;
• make selection decisions;
• fulfil legal or contractual requirements.

Information relating to unsuccessful applications will be retained only for an appropriate period unless there is a legal basis to retain it longer.

20

Website, Cookies and Similar Technologies

The RVA website may use technologies necessary for:

• website operation;
• security;
• accessibility;
• remembering user preferences;
• forms and submissions;
• performance monitoring.

Where non-essential cookies, analytics or similar tracking technologies are introduced, RVA will provide appropriate information and obtain consent where required by applicable law.

Users can also manage cookies through their browser settings.

The website’s technical configuration may change over time. This Policy should therefore be read together with any cookie notice or consent mechanism displayed on the website.

21

Email and Newsletters

Where RVA sends newsletters, announcements or other optional communications, recipients will be given an appropriate means to stop receiving them.

Where communications constitute direct marketing, individuals may object at any time.

Unsubscribing from optional communications does not prevent RVA from sending administrative communications that are necessary for an existing programme, application, contract or legal obligation.

22

Third-Party Websites

The RVA website may contain links to external websites operated by donors, partners, public institutions or other organisations.

RVA is not responsible for the privacy practices of third-party websites.

Users should review the privacy information provided by those organisations when leaving the RVA website.

23

Complaints

If you believe RVA has processed your personal data unlawfully or has not respected your data-protection rights, you are encouraged to contact RVA first so that the matter can be reviewed.

The right to complain to the supervisory authority does not affect any other administrative or judicial remedies available under applicable law.

24

Changes to this Policy

RVA may update this Policy to reflect:

• changes in legislation;
• regulatory guidance;
• organisational activities;
• programme requirements;
• technology;
• website functionality;
• data-protection practices.

The current version will be published on the RVA website together with its latest revision date.

Where a material change significantly affects the way personal data are processed, RVA will provide additional notice where appropriate.

25

Data Protection Officer

Roma Versitas Albania has designated the Secretary General as its Data Protection Officer.

The Data Protection Officer oversees RVA’s compliance with applicable personal data protection legislation, advises the organisation and its staff on data protection matters, supports appropriate safeguards for personal data, and serves as a contact point for data subjects and the Commissioner for the Right to Information and Protection of Personal Data.

Questions concerning personal data, privacy rights or RVA’s processing activities may be directed to: