1. Purpose of the Privacy Policy

Through this Privacy Policy, the company Ofroi App SH.P.K. ('Ofroi,' 'we,' 'the company') collects, uses, stores, shares and protects the personal data of users and service providers who use the Ofroi platform. The policy is drafted in accordance with Law No. 06/L-082 on Personal Data Protection (LPPD) in Kosovo, as well as the guidelines of the Information and Privacy Agency (AIP), and in line with the principles of the General Data Protection Regulation (GDPR).

The purpose of the policy is to ensure full transparency and protection of user data.

2. Data controller

Ofroi App SHPK, a company registered with the Kosovo Business Registration Agency (ARBK), with unique identification number (NUI): 812307735, address: Rr. Dardanit H. B - S. No. 31, Prishtina 10000, Kosovo, email: kontakt@ofroi.com, is the data controller that processes the data of users of the Ofroi platform services.

3. Categories of data collected

Ofroi collects only data that is necessary for operating and providing our services. The types of data we collect are:

• a) identifying data – name, surname, location (if permitted), privacy settings;
• b) contact data – email, phone number;
• c) account data – login credentials (where applicable), activity within the platform;
• d) payment data – basic financial transaction data for each package or service offered by Ofroi;
• e) technical data – cookies and analytics data to improve operation and user experience.

4. Purpose of processing personal data

Ofroi collects only data necessary for operating and providing our services. Purposes for which Ofroi processes users' personal data include:

Processing of users' personal data is used for:

• Managing user accounts;
• Communications with user support;
• Legal and regulatory compliance;
• Fraud and security prevention;
• Service improvement;
• Marketing (only with the user's explicit consent).

4.1 Legal basis for processing personal data For each processing of personal data, Ofroi relies on one or more legal bases set out by the LPPD, including:

• a) Explicit consent of the data subject – e.g. for marketing, analytics, cookies;
• b) Contract or agreement with the user – e.g. processing data necessary to provide platform services and legal obligations;
• c) Legal obligation – e.g. compliance with legal or regulatory requirements;
• d) Legitimate interest of the controller – e.g. improving services, preventing fraud and ensuring platform security, provided this does not override users' fundamental rights;
• e) Public interest or public function – only where applicable under applicable law.

Any consent may be withdrawn by the user at any time, stopping further processing for the stated purpose without affecting the lawfulness of prior processing.

5. Storage and retention period

Personal data is stored only for as long as necessary to fulfil the stated purposes, as defined by this Privacy Policy and applicable law in the Republic of Kosovo.

After this retention period, data is automatically deleted or anonymised.

6. Sharing personal data with third parties

Ofroi guarantees that your personal data will be treated with full confidentiality and will not be shared with third parties not covered by this Privacy Policy without prior user consent, except where legally required.

To provide services under this Privacy Policy, Ofroi may share your personal data with service providers who carry out core operations for service delivery.

7. User rights

Users have the right to access, rectify, delete or restrict processing of personal data.

• a) The user has the right to access their personal data at any time in a structured, machine-readable format via the Ofroi platform.
• b) The user may withdraw consent for marketing communications at any time.
• c) The user has the right to request transfer of their personal data in an easy, structured and commonly used format without hindrance from the current controller.
• d) The user has the right to object to processing of their personal data in certain personal situations.
• e) The user has the right to lodge a complaint with the national authority for personal data protection in Kosovo – the Information and Privacy Agency (AIP).

8. Security measures

All user data and information is stored securely and confidentially and used only for platform functions.

8.1 Technical security includes:

• a) Use of HTTPS protocols and encryption methods to protect communication and data;
• b) Control and monitoring of user access to personal accounts;
• c) Network security rules;
• d) Prevention of system infection by viruses.

8.2 Access and verification of service users:

• a) Each user is required to consent to storage of their data;
• b) Users are not permitted to share credentials with others.

8.3 Back-up and security Ofroi implements automated back-up procedures for eventual data retention. Thus interference with data integrity on protected servers, deliberate interference with data, system failures, security incidents or accidental disclosure may be mitigated.

Users are encouraged to use the latest versions of browsers and the Ofroi app for maximum security.

9. Transfers of personal data

Ofroi does not transfer data outside the territory of Kosovo.

Ofroi applications comply with contractual standards.

• a) The user accepts necessary legal measures such as standard contractual clauses;
• b) Data is transferred to places with an adequate level of data protection according to the list published and amended by the AIP;
• c) Any transfer is carried out in accordance with applicable law in Kosovo.

10. Notification of users and the authority in the event of security incidents

In the event of incidents or breaches during processing of personal data, Ofroi will take technical and organisational corrective measures and notify data subjects as soon as possible where required under Article 34(3) of the LPPD – within 72 (seventy-two) hours from when it became aware that a breach or incident occurred.

11. Use of cookies

Ofroi uses cookies and similar technologies for:

• a) ensuring its essential operation;
• b) personalising use of the site;
• c) measuring and analysing traffic;
• d) marketing (only with user consent).

Details on the use of cookies are included in the Cookie Policy.

12. Communications for marketing purposes

Marketing-related communications will only be made after explicit consent from the service user.

The user may withdraw marketing consent at any time via their personal account or subscriptions on the official website.

Details on marketing communications are included in the Marketing Consent Policy.

13. Changes to the policy

This Privacy Policy may be updated from time to time; continued use implies acceptance of changes. Users will be notified via the official platform website or email.

The latest version will always be published on Ofroi's official website.

14. Official contact

For any questions, users may contact us via: Email: info@ofroi.com, official website: www.ofroi.com, or directly at the company address: Rr. Dardanit H. B – S. No. 31, Prishtina 10000, Kosovo.