Privacy Policy

Changes to our privacy policy

This Privacy Policy gets updated from time to time; whenever we make a change, we’ll post this on our website and let you know.

Last updated: 01^st of November 2024

How to use this privacy policy

In this policy, we explain how we collect, use, share and protect your personal information when you use our products and services and our website.

You can find the privacy supplements for all our products and services please go to Privacy and Products

Who we are

We are Vodafone Albania sh.a. We are part of the Vodafone Group.  If you go to About Vodafone Albania you can find useful links to Vodafone Albania. 

In some circumstances, Vodafone Group Services Limited (VGSL) controls the processing of your personal information jointly with us. The registered office of VGSL is Vodafone House, The Connection Newbury, Berkshire RG14 2FN. They are registered in England under company number 03802001. Unless otherwise specified in a separate privacy statement, the way your personal information is processed will remain compatible with the wording of this privacy statement. 

In this privacy policy:

• “we/us” means Vodafone Albania sh.a.;
• “third party” means someone who is not you or us;
• “partner organisation” means external third party business entity that provides value-added services; and
• “Vodafone Group” means Vodafone Group Plc and any company or other organisation in which Vodafone Group Plc owns more than 15% of the share capital.

Our registered office is Autostrada Tirane- Durres, Rruga Pavaresia, Nr.61, Kashar, Tirane. We are registered in the National Business Centre with NUIS No. K11715005L. Vodafone Albania is registered with the Information Data Protection Commissioner (IDP)

Our main switchboard is +355 699000140  or you can email us at nakontaktoni@vodafone.com.

How to contact us

Your opinion matters to us – if you have any questions about our privacy policy, you can email us at: nakontaktoni@vodafone.com  or you can contact us.

You can contact our Data Protection Officer at alfunc.askprivacy@vodafone.com

Our principles

Vodafone is committed to respecting your privacy. We take privacy, security and complying with data protection and privacy laws seriously.

We have set out our core Privacy Commitments in our Privacy Centre. We aim to put these commitments at the heart of everything we do.

Directly from you

The information we collect about you and how we collect it can vary depending on the products and services that you use and subscribe to, how you have used the products and services, and how you have interacted with Vodafone even if you aren’t a customer, or what we have obtained from a third party.

We will collect your personal information when you, for example:

• sign up to any of our products or services;
• use our network or other Vodafone products or services;
• contact us through various channels for support or ask for information about products or services;
• visit or browse our website; and
• if you are a non-Vodafone customer and contact a Vodafone customer or a Vodafone customer care team.

From third parties

Information collected not directly from you 

The types of information we may have, where applicable:

1. Contact details Such as your name, address, phone and/or mobile number and email address;
2. Financial details Such as your credit or debit card information, information about your bank account and other banking information – for example, you’ll have to give us this information when you open an account with us. We’ll collect the data necessary to process a payment whenever you make a purchase;
3. Your traffic data Every time you use your mobile phone, a record is kept.  This includes the number you called or sent an SMS to, the length, date and time of that call or SMS, the amount of data you are using and your approximate location at the time that the communication takes place (based on the location of the nearest cell that you sent that call or message from).  The same is also recorded every time you receive an incoming call or message.  This is data we see as part of providing you with connectivity; we don’t, however, keep a record of the content of your calls or messages.
4. Information about your device or connectivity such as IP address, IMEI and MSISDN.
5. Your location data This can be precise where it uses Global Positioning System (GPS) data or by identifying nearby mobile phone masts and Wi-Fi hotspots and you enable location-based services or features. Or less precise where, for example, a location is derived from your IP address or data such as a post code or name of a town or city;
6. Your contact with us Such as a note or recording of a call you make to one of our contact centres, a Live Chat, Tobi app, or Whatsapp app, an email or letter sent, or other records of any contact with us;
7. Your account information Such as your date of birth, gender, dates of payment owed or received, subscriptions you use, account numbers or other information related to your account or included in My Vodafone;
8. Credential information We’ll collect passwords, hints and similar security information used for authentication and access to accounts and services;
9. Your preferences for products, services and lifestyle activities when you tell us what they are, or we assume what they are, based on how you use the products and services;
10. Cookies See the Cookie Policy for details on what we collect using cookies, web beacons and other technologies, including advertising data;
11. Your browsing history If you have given your permission, Vodafone collects the categories of website you have browsed on your mobile, device or PC, for example Sports, Music or News. However, we don’t have a history of the sites you browse, as this is limited for a short period of time to enable the connection to be made. We use these interests to send you personalised marketing or show you personalised advertising. You can opt out of advertising through Cookies or, in the case of marketing, your Privacy Settings.
12. Information about how you use our products and services Such as the level of service that you receive – for example, network or service faults and other events that may affect our network services or other services; or your viewing history if you use our VTV product for example.
13. Details of your use of the specific services or products for example CIOT devices or VTV. You can refer to the specific privacy supplement for each product/service for more information on the data processed.

We will use your personal information for a number of purposes ranging from enabling us to provide you with the products or services you have requested to ensuring we are keeping these secure from fraud. 

We may use Artificial Intelligence (A.I.) to help us provide you with a requested product or service. If we use A.I. we will do so responsibly, and where necessary we will disclose that the content is generated by A.I.

Whenever we use your personal information, we do so based on a specific lawful bases under data protection law listed below:

1. The performance of your contract or to enter into the contract and to take action on your requests for example, so you can make calls and texts, and browse the internet on your phone, we process things like the numbers you dial, how much data you’re using and when you’re doing it so we can provide connectivity. This also enables us to generate your bill, based on your usage. We also conduct credit checks when you apply for a product or service, which is operated on a bill pay basis to verify your suitability for entry into such a contract.

2. Legitimate interests of Vodafone for example, fraud prevention, maintaining the security of our network and services, direct marketing, and improvement of our services. Whenever we rely on this lawful basis to process your data, we assess our legitimate interests to make sure they do not override your rights. Additionally, in some cases you have the right to object to this processing. For more information, visit the Your Rights section of this policy.

3. Compliance with a mandatory legal obligation including for example accounting and tax requirements, which are subject to strict internal policies (such as retention periods), procedures.

4. Consent where you have provided it by your own free will. Consent may be withdrawn at any time. See below ‘Your Rights’ for more information on how to do this.

Please see the table below for more information.

Below you can find an overview of the categories of personal information we process about you, the purposes for which we process that personal information and the lawful basis upon which we rely to conduct that processing.

Third parties that we work with 

We are not in the business of selling your data, we only share with suppliers who help us to provide services.

When you’ve purchased Vodafone products and services using a third party or partner organisation, we often need to exchange information with them as part of managing that relationship and your account – for example, to be able to identify your order and be able to pay them.

If we have a contract with a service provider or contractor to provide us with services or provide a service on our behalf, they may have access to your personal information. We don’t authorise them to use or disclose your personal information received from us except in connection with providing their services.

We collect and combine information in order to monitor your use of products and services, and that of our other customers, as well as to help us to improve the quality of our products and services. We provide this information to third parties (for example, to content providers and advertisers), but any such third-party reporting shall not include information which may identify an individual customer.

Mergers and Acquisitions  

If we reorganised or merged with or divested part of our business to another organisation, we may need to provide your information to that other organisation or their advisers or receive personal information from that other organisation. 

Third party devices that you connect your sim with 

You may connect your sim with a number of third-party devices, either manually with a sim card or electronically through our One Number product. These may include mobile phone devices or connected devices such as smart speakers or smart watches. When you connect your sim with these devices those third parties may record your sim details or your interaction with the network and provide that information to Vodafone for purposes of validating your eligibility for the OneNumber product offering. Those third-party device manufacturers will process your personal data in accordance with their privacy policies and we recommend that you read their privacy policies before choosing to connect your sim to their devices.

Third party products that you buy through your Vodafone account  

Where you buy a third-party product or service through your Vodafone account (such as Charge to Bill for mobile), the contract for it is with the party selling that product or service. Vodafone is only charging the amount directly to your bill as part of its arrangements with the seller. As part of this, you’re agreeing that Vodafone may pass certain personal information to the seller to complete your purchase with them.  

The seller’s terms and conditions and privacy and cookies policies will apply to how it uses your personal information – please read them carefully.

It is necessary for us to process your personal information to enable us to provide you with your service. By service we mean any services or products that you buy or use such as broadband, mobiles, use of our apps or smart tech products. 

 

How is your information used?	What data is used?	Lawful basis
To process your order and provide you with your products and services To process the products and services you’ve bought from us, and keep you updated with the progress of your order; Where you’ve purchased Vodafone products and services using a third party or partner organisation, we often need to exchange information with them as part of managing that relationship and your account – for example, to be able to identify your order and be able to pay them.	Contact details Account information Financial details	Performance of your contract
Billing and Customer Care To bill you for using our products and services, or to take the appropriate amount of credit from you; Contact you if the billing information you provided us with is about to expire or we’re not able to take payment; To respond to any questions or concerns you may have about our network, products or services.	Account information Financial details Your contact with us	Performance of your contract
Service messages We will contact you with customer service messages to keep you updated with current information about products and services you’ve purchased. For example, changes to our terms and conditions, price plan and data use, upgrade you might be entitled to, roaming or service interruptions.	Contact details Account information	Performance of your contract

We collect information such as on your use of our products and services on an aggregated or anonymous basis in order to help us manage and improve the services we offer to everyone. 

 

How is your information used?	What data is used?	Lawful basis
Improving and innovating our products and services We anonymise, de-identify or aggregate information in order to improve the service we offer to everyone. None of these analytics are linked back to you in any way.	Anonymised/ aggregated: Financial details Traffic data	Consent
Improving and innovating our products and services through third parties We collect and combine information in order to monitor your use of products and services, and that of our other customers, as well as to help us to improve the quality of our products and services. We provide this information to third parties (for example, to content providers and advertisers) but any such third party reporting shall not include information which may identify an individual customer.	Anonymised/ aggregated: Account information	Legitimate Interest
Manage our networks and understand network usage  To protect our networks and manage the volumes of calls, texts and other uses of our networks. For example, we identify peak periods of use so we can try and ensure the networks can handle the volume at those times;  To understand how you use our networks, products and services. That way we can seek to review, develop and improve these, develop more interesting and relevant products and services, as well as personalising our products and services.	Traffic data Location data	Legitimate Interest Consent
Improving roaming services To improve your roaming experiences and understand how Vodafone is performing in providing roaming services, whether Roaming Services and related products are working as intended, or whether improvements are needed to make roaming better.  Vodafone uses personal data such as your name, email address, password, mobile phone number and call records in order to do this. Vodafone creates aggregated and statistical management reports from this information that do not identify you individually. Vodafone may also take this personal data and anonymise it so that more in-depth analysis of our roaming services can be undertaken. This helps Vodafone to develop its roaming services for customers without identifying users in an individual way.	Anonymised/ aggregated: Contact details Credential information Traffic data	Legitimate interest

We process your personal information for marketing and advertising purposes, such as to let you know about new products or services and send you special offers, as well as to help us tailor our service to you.

You can control your Marketing permissions and the data we use to tailor these communications at any time by visiting Your Privacy Settings.

How is your information used?	What data is used?	Lawful basis
Marketing We process this data for the purpose of sending you marketing communications in the manner outlined in the row below. We can further tailor these messages using your calling and messaging activities, location information and browsing information, if you have authorised that we process this information for this purpose; If you have given your permission, we will also contact you to let you know about products and services of other Vodafone Group companies and those of other companies which we think may interest you depending on your marketing preferences.	Contact details Your preferences Browsing history Account information Location data	Consent
Marketing As our customer, we will keep you informed generally about new products and services, send you newsletters or white papers, invite you to participate in a survey or let you know about offers, promotions, prize draws or competitions. We tailor these messages based on the sorts of products and services you’ve bought from us (for example, we know not to market to you if you’re in the middle of your phone contract). We’ll contact you by post, online, phone or push notifications through our apps.	Contact details Account information Questionnaire answers	Legitimate interest
Personalised/targeted advertising online To deliver advertising that is relevant to you, you’ll also see targeted advertising online based on the use of cookies. This is known as interest-based advertising.  It can be on websites belonging to the Vodafone Group, those of other organisations as well as other online media channels such as social media sites.  We may also combine data collected via the cookies with other data we have collected. If you don't want any information processed through the use of cookies, check our Cookies section. It explains how to control and opt out of cookies. Remember that not providing consent for interest-based advertising won’t stop advertisements from being displayed – but they won’t be tailored to your interests.	Cookie data Browsing history Account information	Consent
Research and analytics  We use a variety of analytics methods including what is commonly referred to as “Big data analytics”.  Big data analytics are mathematically driven analysis techniques on large and varied data sets (that is why it is “big” data) to uncover hidden patterns and hitherto unrevealed trends. At Vodafone we take governance of big data analytics seriously.  We have a strict use case process that requires that privacy and data protection law checks are carried out before any use case commences. We have strict rules for anonymisation and de-identified techniques where appropriate.    We use our analytics to: Market research and to carry out research and statistical analysis including to monitor how customers use our networks, products and services on an anonymous or personal basis;	Account information	Legitimate interest

Profiling consists of the use of personal data in an automated form in order to evaluate certain personal aspects relating to an individual. We will process your personal information in this way for credit, fraud and security purposes.

 

How is your information used?	What data is used?	Lawful basis
Credit checks and ID  We will also use your personal information for identity verification purposes, for access to your account and for general account management. We sometimes supplement the information we collect about you with information from other sources to assess the accuracy of the information that we hold;	Financial details Account information Credential information	Performance of your contract
Fraud Prevention, Security and Debt Collection We will process your traffic data to protect against and detect fraud, to protect and detect misuse or damage to our networks, to recover debts or trace those who owe us money resulting from the use of our services. Fraud management and law enforcement  We may be obligated to release information if it’s reasonable for the purpose of protecting us against fraud, defending our rights or property, or to protect our legitimate interests or the interests of our customers.	Traffic data Account information Financial details	Legitimate interest
Network Security We will process your traffic data in order to protect and detect misuse or damage to our networks or to detect and resolve fraudulent use of our networks (and our partner roaming networks) and to solve technical issues you are experiencing.	Anonymous and aggregated contact details or credential related information Traffic data	Legitimate interest
Physical Security We may use CCTV footage to safeguard our stores and sites.	Images Video footage	Legitimate interest

Under certain circumstances, it is necessary for us to process your personal information in order to comply with the law, for example, when responding to law enforcement requests for data or to comply with tax requirements. 

 

How is your information used?	What data is used?	Lawful basis	Legislation applicable
Accounting and tax requirements	Address Customer number Date of birth / age E-mail address Gender Name Telephone number Title Employment Status Marital status Invoices Tariff information Other PII (e.g., in unstructured data fields completed by user) Bank or giro account numbers Credit card information Information about Customer’s creditworthiness Information about Customer’s payment behaviour	Compliance with mandatory legal obligation	- Law 9920/2008 "On Tax Procedures in the Republic of Albania", as amended - Law No. 25/2018 "On accounting and financial statements"
Law enforcement purposes We also may need to release your information to comply with our legal obligation to respond to the authorities’ lawful demands. Your personal data shall only be provided when we in good faith believe we are obliged to do so in accordance with the law and pursuant to an exhaustive evaluation of all legal requirements.	A number B number Call duration End time call IP address Network events and activity logs Network usage Unpriced CDRs Start time call Web logs files SMS Cell ID Identification of the network cell Location by end of the call Location by start call IMEI-number (International Mobile Equipment Identity) IMSI-number (International Mobile Subscriber Identity) Mac address MSISD-number (Mobile station international Subscriber Directory     Number) SIM card number	Compliance with mandatory legal obligation	- Law 9918/2008 "On electronic communications in the Republic of Albania", as amended - Law No.9887/2008 “On the Protection of Personal Data” as amended
Complaint handling purposes	Complaints Customer care contact information Requests for access to personal data Webchat history Portability information Subscription contract, copy of ID and any amendment or other customer request related with the subscription Add on product AHT scores Barrings Base product Contact information / contact person Feedback Medallia First time fix scores NPS scores Price plan Requests for access to personal data Subscription type Tariff information TSAT scores	Compliance with mandatory legal obligation	- Law 9918/2008 "On electronic communications in the Republic of Albania", as amended - Law No.9887/2008 “On the Protection of Personal Data” as amended - Law 9902/2008 “On Consumer Protection”
		Performance of your contract	- Law 9918/2008 "On electronic communications in the Republic of Albania", as amended - Law No.9887/2008 “On the Protection of Personal Data” as amended - Law 9902/2008 “On Consumer Protection”
Voice recording of Customer Centre calls	Complaints Customer care contact information Requests for access to personal data Webchat history Portability information Subscription contract, copy of ID and any amendment or other customer request related with the subscription Add on product AHT scores Barrings Base product Contact information / contact person Feedback Medallia First time fix scores NPS scores Price plan Requests for access to personal data Subscription type Tariff information TSAT scores	Compliance with mandatory legal obligation	Law 9918/2008 "On electronic communications in the Republic of Albania", as amended
Sharing caller ID and location data with emergency services	Address Customer number Date of birth / age Gender Name Telephone number Geo-location GPS data or high level network location data Geo-location network data Identification of the network cell Location by end of the call Location by start call Location during call Cell tower records (e.g., logs, user location, time, date)	Compliance with mandatory legal obligation	Law 9918/2008 "On electronic communications in the Republic of Albania", as amended

Where applicable, we share information about you with:

• Companies in the Vodafone Group
• Partners or agents involved in delivering the products and services you’ve ordered or used;
• Companies who are engaged to perform services for, or on behalf of, Vodafone Albania, or Vodafone Group;
• Debt collection agencies or other debt-recovery organisations;
• Law enforcement agencies, government bodies, regulatory organisations, courts or other public authorities if we have to, or are authorised to by law;
• A third party or body where such disclosure is required to satisfy any applicable law, or other legal or regulatory requirement;
• Emergency services (if you make an emergency call), including your approximate location;
• Third parties for joint promotions with that third party;
• Partner organisations we’ve carefully chosen so they can contact you about their products and services (which may or may not include Vodafone products and services). We’ll ask for your consent before sharing this information;
• Other third parties when you are signing up to their service and it is used by them for authentication and fraud-prevention purposes;
• Third parties that we advertise with, such as Facebook, in order to serve you advertisements online;
• Third parties that we use to serve you marketing.

For the purpose of providing our services as well as possible, Vodafone may need to transfer your personal data to other Vodafone Group companies or service providers in European Economic Area (EEA) countries. The EEA consists of European Union countries, Switzerland, Iceland, Liechtenstein and Norway: they are considered to have laws equivalent to those of the European Union when it comes to data protection and privacy.

This type of data transfer will occur if our servers (i.e. where we store data) or our suppliers and service providers are located inside or outside the EEA, or if you use our services and products while visiting EEA countries.

If Vodafone sends your personal identifiable information to a country that is in the EEA or outside the European Economic Area (EEA), we will ensure that your information is properly protected, in accordance with Law 9887/2008 "On the Protection of Personal Data" , Decision No. 8/2016 "For the Designation of States with Adequate Level of Protection of Personal Data" of the Commissioner for Protection of Personal Data as well as the 2014 Guide of the Commissioner for Personal Data for the international transfer of personal data”. We will always ensure that we carry out an assessment of the impact of the transfer and ensure that there is an appropriate legal agreement covering the transfer of data. In addition, if the country is not deemed to have laws that are equivalent to EU data protection standards or deemed adequate by the Republic of Albania (here you will find the decision of the Commissioner), then we will implement additional technical security and organizational safeguards, such as require the third party to enter into a legal agreement containing standard contractual clauses approved by the European Commission that reflects those standards..

We’ll store your information for as long as we must by law. If there’s no legal requirement, we’ll only store it for as long as we need to. 
We’re required by law to keep your account and invoice information for 10 years from the end of your contract with us in case of postpaid and 2 years from the end of the contract in case of prepaid.
Also, we need to keep traffic information for law enforcement purposes and information about your complaints for 2 years.
We’ll keep some personal information for a reasonable period after your contract with us has finished in case you decide to use our services again. We, or one of our partners, may contact you about Vodafone services during this time if you haven’t opted out of receiving marketing communications from us. 

We have specialised security teams who constantly review and improve our measures to protect your personal information from unauthorised access, accidental loss, disclosure or destruction.
Communications over the internet (such as emails) aren’t secure unless they’ve been encrypted. Your communications may go through a number of countries before being delivered, as this is the nature of the internet.
We cannot accept responsibility for any unauthorised access or loss of personal information that is beyond our control.
We’ll never ask for your secure personal or account information by an unsolicited means of communication. You’re responsible for keeping your personal and account information secure and not sharing it with others.
Our website may provide links to third-party websites. We cannot be responsible for the security and content of such third-party websites. So, make sure you read that company’s privacy and cookies policies before using or putting your personal information on their site.
The same applies to any third-party websites or content you connect to using our products and services.
You may choose to disclose your information in certain ways such as social plug-ins (including those offered by Google, Facebook, Twitter and Pinterest) or using third-party services that allow you to post reviews or other information publicly, and a third party could use that information.
Social plug-ins and social applications are operated by the social network themselves and are subject to their own terms of use and privacy and cookies policies. You, should make sure you’re familiar with these.

Right to correct personal data

You have the right to correct information held about you if it is inaccurate. If what we hold on you needs updating, or you think it may be inaccurate, you can submit your request in writing by using this form. You can deliver the signed form together with your Identity Card (ID) at the Vodafone HQ address or at our Vodafone Shops or contact our Customer Service Team.

Right to access personal data

You have the right to make a request for a copy of the personal data that Vodafone holds about you. To make this request as an individual or an authorised 3rd party, please fill out the form  here and post it to the address on the form or in Vodafone Shops. Alternatively, you can contact the Customer Services team. We will take reasonable steps to confirm your identity before issuing any copy of your personal information. No charging fees for subject access rights request unless it is request for further copies of an already-provided SAR.

Right to object to processing where we rely on our legitimate interests:

Please contact our Customer Services team or email us at nakontaktoni@vodafone.com.

Right to withdraw consent

You can withdraw your consent anytime after giving it. Depending on how you provided your consent you should be able to withdraw your consent in the same way. You can also contact our Customer Services team or email us at nakontaktoni@vodafone.com.

Right to restrict use of your data

If you feel the data we hold on you is inaccurate or believe we shouldn’t be processing your data, please contact our Customer Services team to discuss your rights. In certain circumstances you will have the right to ask us to restrict processing.

Right to erasure

Vodafone strives to only process and retain your data for as long as we need to. In certain circumstances you have the right to request that we erase personal data of yours that we hold.  If you feel that we are retaining your data longer than we need, it is worth first checking that your contract with Vodafone has been terminated which you can do with Customer Services. If your contract with Vodafone has been terminated, we may still have lawful grounds to process your personal data (for more information on retention periods see How Long We Keep Your Personal Information For).

 

To opt out of Marketing messages:

If you no longer want to receive marketing messages from Vodafone, you can elect to opt out of all marketing communications or only selected methods (email, SMS MMS, phone or post). 

There are various ways to opt out:

• Log in to your Privacy Settings to manage your permissions; your Privacy Settings will also provide you with the ability to opt out or into receiving personalised marketing.
• Contact our customer services team – see the contact us page;
• Click the link at the end of a marketing email or text to unsubscribe;
• Tell the adviser if you receive a marketing call;
• Disable push notification messages, including marketing messages, at any time in our apps by changing the notification settings on your device or by uninstalling the app;

Email nakontaktoni@vodafone.com for guidance.

Opting out does not mean that you won’t any longer receive service-related messages. You will continue to receive those (unless we have indicated otherwise).

To opt out of receiving marketing communications from Vodafone, just contact them directly through Custumer Services team.

In some cases, you may receive marketing from Vodafone, even if you’re not a customer or never had contact with Vodafone. This is a result of third-party marketing lists which Vodafone may acquire from time to time. If you’ve registered to opt out of such marketing, you shouldn’t receive such communications. If you do, we ask that you let us know immediately.

To manage Cookies and understand more about what they are:

Want to disable a cookie, or understand more about what these are? Check the Cookies section of this policy for full details on how to do this.

How to lodge a complaint

If you want to contact us about any of your rights or if complain about how we use your information, contact our Customer Services team or email us at nakontaktoni@vodafone.com. We’ll do our best to help but if you’re still unhappy, you can contact [the IDP – their details are at https://idp.al/].