Privacy notice

This privacy notice explains how AlbaSoul Group LLC processes personal data in connection with BMS, our software-as-a-service business management platform. This notice applies to personal data processed when you register for BMS, use the service, communicate with us, or otherwise interact with us in relation to the platform.

1. Who we are

AlbaSoul Group LLC is the operator of BMS. For privacy-related questions, requests, or complaints, contact[email protected].

2. Categories of personal data

• Account and registration data, such as names, email addresses, phone numbers, company details, and user roles
• Customer, supplier, vendor, and contact records entered by our customers into BMS
• Employee and workforce data, including attendance, leave, payroll-related values, and HR records where enabled
• Financial and operational records, such as invoices, purchases, journals, inventory records, and related business documents
• Technical usage data, device and browser information, access logs, audit logs, and security event records
• Support, billing, and communications data exchanged with us

3. Purposes and legal bases

• Providing, hosting, operating, securing, and supporting BMS, including customer onboarding and account administration
• Performing our contract with customers and taking steps at the customer’s request before entering into a contract
• Managing billing, invoicing, renewals, compliance investigations, and legal obligations
• Protecting the security, integrity, availability, and lawful use of BMS based on legitimate interests and, where applicable, legal obligations
• Responding to support requests, service communications, and legitimate business correspondence

4. Kosovo law compliance

Where Kosovo law applies, personal data is processed in accordance withLaw No. 06/L-082 on Protection of Personal Dataand related regulations.

5. Controller and processor roles

In most cases, our customers act as data controllers for the business and personal data they enter into BMS. AlbaSoul Group LLC generally acts as a data processor for that customer data, processing it on the customer’s behalf and in accordance with customer instructions, the applicable service agreement, and applicable law. We may act as an independent controller for our own account, billing, support, security, and compliance activities.

6. Data retention

Personal data is retained for as long as necessary to provide BMS, maintain the customer relationship, satisfy legal and accounting obligations, resolve disputes, enforce agreements, and support data export or closure processes. Retention periods may vary depending on the type of data and legal requirements.

7. Data sharing and subprocessors

We may share personal data with trusted service providers and subprocessors that support infrastructure, hosting, storage, backup, monitoring, email delivery, security, and support operations. Such providers are engaged under appropriate contractual and confidentiality obligations.

8. International data transfers

If personal data is transferred outside Kosovo or another applicable jurisdiction, we implement contractual, technical, and organizational safeguards required by applicable law.

9. Security measures

We implement measures intended to protect personal data against unauthorized access, disclosure, alteration, destruction, or loss. These measures may include authentication controls, role-based access controls, logging, monitoring, backup procedures, and encryption or similar safeguards where appropriate. No system can guarantee absolute security, and customers are also responsible for secure use of their accounts and credentials.

10. Your rights

Depending on the applicable law and context of processing, data subjects may have rights including access, rectification, erasure, restriction, objection, and data portability.

Where we process data solely on behalf of a customer, requests regarding customer-controlled data should generally be directed first to that customer as controller. Under Kosovo law, data subjects may also lodge a complaint with the Information and Privacy Agency of Kosovo (AIP), where applicable.

11. Cookies and technical records

BMS may use session technologies, authentication mechanisms, logs, and similar technical records that are required for secure access, platform functionality, troubleshooting, and auditing. Additional website-level cookie notices may apply where relevant.

12. Contact

Privacy inquiries can be sent to [email protected].General contractual or legal matters may be directed to [email protected].

13. Legal entity details

• Company: AlbaSoul Group LLC
• Service: BMS
• Registered jurisdiction: Republic of Kosovo
• Registered address: Xhevdet Doda, pn.
• Privacy contact: [email protected]
• Legal contact: [email protected]

14. Complaint workflow

1. Send your privacy request or complaint to [email protected] with relevant details.
2. We may need to verify identity, authority, and scope before responding.
3. We will respond within the timeframes required by applicable law.
4. If unresolved and where applicable, you may escalate the matter to the Information and Privacy Agency of Kosovo (AIP).