This policy explains how Ndriçim Duraku B.I. ("we") collects and uses the personal data of visitors and customers of premium-sticker.com, in line with the EU General Data Protection Regulation (GDPR) and the data-protection law of Kosovo.

1. Data we collect

Order data: name, e-mail, phone, delivery address, order content and history.
Artwork files: the designs you upload to be printed.
Payment data: we do not process card data online. Cash-on-delivery orders involve no payment data; bank transfers are handled by your bank.
Technical data: IP address and browser, kept in the security log; visit statistics are measured without cookies and without storing your IP address, and — only if you accept — with a random identifier kept in your browser (see section 6).

2. Purposes and legal bases

Processing and delivering your order — performance of a contract (Art. 6(1)(b) GDPR).
Fraud prevention and security of the site — legitimate interest (Art. 6(1)(f)).
Accounting and tax obligations — legal obligation (Art. 6(1)(c)).
Newsletter — consent (Art. 6(1)(a)), withdrawable at any time.
Visit statistics, level 1 (pages viewed and visits, time spent on a page and how far it was scrolled, page loading speed, missing pages, country and — when our host provides it — region and city, language, device type, browser and system family, screen-width range, the site or campaign you came from, configurator and order steps, orders linked to the source, campaign and landing page of the visit), measured on our own server without cookies and without storing your IP address. These statistics are pseudonymous, not anonymous: your visits of one day are recognised through a code that changes every day, and an order — even one placed without accepting statistics — is counted for the source, campaign and landing page of your visit that day; this count does not change the order, but it can be matched with it on our server. Legitimate interest (Art. 6(1)(f)) in improving the site and knowing where our sales come from. You can object at any time: “Reject non-essential” in the cookie banner, or Do-Not-Track / Global Privacy Control in your browser.
Visit statistics, level 2 — customer journeys, only if you click “Accept all” or turn the Statistics switch on: a random identifier kept in your browser links your visits over several days to each other and to your order, quote request or newsletter sign-up, so that we understand how customers find and choose our products; at the moment you accept, the pages shown in the same browser tab during the previous 30 minutes, and the site you came from, are linked too (your browser reports them itself; we never look them up by IP address) — consent (Art. 6(1)(a)). You can withdraw it at any time with “Manage cookies”: the identifier is deleted from your browser at once and the data linked to it is erased from our server; only the level 1 statistics, without identifier, remain. An identifier older than 13 months is replaced by a new one and the data linked to the old one is erased. If your consent ends without you coming back to the site (after 13 months, or when your browser turns on Do-Not-Track or Global Privacy Control), or if your browser's storage is cleared (by you, or by the browser itself, e.g. Safari after 7 days without a visit), our server is not told: it then erases by itself the data linked to the identifier 396 days after first receiving it (an identifier is never used for more than 13 months, i.e. 395 days). You can also ask us to erase it sooner (possible when it is linked to an order, quote request or newsletter sign-up with your e-mail address).

3. Retention

Order and invoicing data: 10 years (accounting obligations).
Artwork files: 12 months after your last order, then deleted.
Security log: 12 months.
Newsletter: until you unsubscribe.
Visit statistics: raw events and visits 13 months, then only daily totals without any visitor code; orders by source (day, amount, source, campaign, landing page, country, device, language): 13 months, then only their number and amount per month and source; the level 2 identifier and everything linked to it (visits, pages, links to your orders or requests): erased 396 days (13 months) after our server first received it, or as soon as you withdraw your consent; the irreversible fingerprint (SHA-256) of an erased identifier, without any linked data: 14 months.

4. Recipients and transfers

Your data is shared only with the providers needed to fulfil your order: our billing entity (Premium Sticker), carriers (name, address, phone), our e-mail provider (transactional e-mails), and Cloudflare (CDN and security). We never sell or rent your data. Because we are established in Kosovo, data may be transferred outside the EU/EEA; we apply appropriate safeguards (standard contractual clauses, access restricted to what is strictly necessary).

5. Your rights

You may request access, rectification, erasure (except data we must keep for accounting), restriction, portability, and withdraw your consent at any time by writing to [email protected]. We reply within 30 days. You may also lodge a complaint with the data-protection authority of your country of residence.

6. Cookies

See our Cookie Policy.

Data controller: Ndriçim Duraku B.I. · Rr. Mehmet Hasi, 20000 Prizren, 20000 Prizren, Kosovo · [email protected]

Manage cookies

1. Data we collect

Order data: name, e-mail, phone, delivery address, order content and history.

Artwork files: the designs you upload to be printed.

Payment data: we do not process card data online. Cash-on-delivery orders involve no payment data; bank transfers are handled by your bank.

Technical data: IP address and browser, kept in the security log; visit statistics are measured without cookies and without storing your IP address, and — only if you accept — with a random identifier kept in your browser (see section 6).

2. Purposes and legal bases

Processing and delivering your order — performance of a contract (Art. 6(1)(b) GDPR).

Fraud prevention and security of the site — legitimate interest (Art. 6(1)(f)).

Accounting and tax obligations — legal obligation (Art. 6(1)(c)).

Newsletter — consent (Art. 6(1)(a)), withdrawable at any time.

Visit statistics, level 1 (pages viewed and visits, time spent on a page and how far it was scrolled, page loading speed, missing pages, country and — when our host provides it — region and city, language, device type, browser and system family, screen-width range, the site or campaign you came from, configurator and order steps, orders linked to the source, campaign and landing page of the visit), measured on our own server without cookies and without storing your IP address. These statistics are pseudonymous, not anonymous: your visits of one day are recognised through a code that changes every day, and an order — even one placed without accepting statistics — is counted for the source, campaign and landing page of your visit that day; this count does not change the order, but it can be matched with it on our server. Legitimate interest (Art. 6(1)(f)) in improving the site and knowing where our sales come from. You can object at any time: “Reject non-essential” in the cookie banner, or Do-Not-Track / Global Privacy Control in your browser.

Visit statistics, level 2 — customer journeys, only if you click “Accept all” or turn the Statistics switch on: a random identifier kept in your browser links your visits over several days to each other and to your order, quote request or newsletter sign-up, so that we understand how customers find and choose our products; at the moment you accept, the pages shown in the same browser tab during the previous 30 minutes, and the site you came from, are linked too (your browser reports them itself; we never look them up by IP address) — consent (Art. 6(1)(a)). You can withdraw it at any time with “Manage cookies”: the identifier is deleted from your browser at once and the data linked to it is erased from our server; only the level 1 statistics, without identifier, remain. An identifier older than 13 months is replaced by a new one and the data linked to the old one is erased. If your consent ends without you coming back to the site (after 13 months, or when your browser turns on Do-Not-Track or Global Privacy Control), or if your browser's storage is cleared (by you, or by the browser itself, e.g. Safari after 7 days without a visit), our server is not told: it then erases by itself the data linked to the identifier 396 days after first receiving it (an identifier is never used for more than 13 months, i.e. 395 days). You can also ask us to erase it sooner (possible when it is linked to an order, quote request or newsletter sign-up with your e-mail address).

3. Retention

Order and invoicing data: 10 years (accounting obligations).

Artwork files: 12 months after your last order, then deleted.

Security log: 12 months.

Newsletter: until you unsubscribe.

Visit statistics: raw events and visits 13 months, then only daily totals without any visitor code; orders by source (day, amount, source, campaign, landing page, country, device, language): 13 months, then only their number and amount per month and source; the level 2 identifier and everything linked to it (visits, pages, links to your orders or requests): erased 396 days (13 months) after our server first received it, or as soon as you withdraw your consent; the irreversible fingerprint (SHA-256) of an erased identifier, without any linked data: 14 months.

4. Recipients and transfers

5. Your rights

Privacy Policy

1. Data we collect

2. Purposes and legal bases

3. Retention

4. Recipients and transfers

5. Your rights

6. Cookies

Privacy Policy

1. Data we collect

2. Purposes and legal bases

3. Retention

4. Recipients and transfers

5. Your rights

6. Cookies