Weavano — Privacy Policy

Effective date: 25 July 2026 Last updated: 23 September 2026

1. Who is responsible for your data (Controller)

This Privacy Policy explains how Weavano, operated by Natanael Xhelilaj PF, a sole trader (person fizik, "PF") established in Albania, registered address Lagja 8 Shkurti, Rr. Joti Prifti, Parafabrikati 14, Shkalla 1, Hyrja 4, Fier, Albania ("Weavano", "we", "us", "our"), collects and uses personal data.

We are established in Albania, which is outside the EU/EEA and the UK. Because we offer services to clients and website visitors in the EU/EEA and the UK, the EU General Data Protection Regulation ("GDPR") and the UK GDPR can apply to our processing of their personal data on an extraterritorial basis, and we also comply with Albania's Law on the Protection of Personal Data. For the purposes of the GDPR and UK GDPR, we are the data controller of the personal data described in this Policy, except where we act as a processor on behalf of a business client (see Section 12).

Privacy contact: Natanael Xhelilaj — natanxhelilaj00@gmail.com.

2. Scope of this Policy

This Policy applies to personal data we process about:

visitors to the Weavano website ("Site");
prospects who request a free Preview or contact us;
clients who purchase a Build or Care Plan, and their staff contacts; and
individuals whose data appears in materials a client asks us to handle (for example, enquiries submitted through a website we host for a client) — for which we usually act as a processor.

It does not cover third-party websites or services we link to, which have their own privacy policies.

3. The personal data we collect

a. When you visit the Site

Technical data may be processed by our hosting and content providers when your browser requests a page or asset, including your IP address, browser details and request time. The site loads fonts from Google Fonts and its animation library from jsDelivr. We do not currently use website analytics or advertising trackers.

b. When you request a free Preview or contact us

Your name, business name and email address, your selected package, and any optional phone number, business type, website, referral or free-text details you provide.
The enquiry form prepares an email draft in your browser. Nothing is sent automatically, and the homepage does not save your contact details in browser storage. We receive the enquiry only when you send the email using your email service. You can also email us directly.

c. When you become a client

Contact and billing details: name, business name, email, phone (if provided), billing address, VAT number where relevant.
Payment data: processed by our payment processor; we receive confirmation and limited details (e.g. last four digits, not full card numbers).
Project data: content, images, logos and materials you provide for your site, and access credentials you share so we can build or maintain it.

d. When we operate a Care Plan for you

Data needed to manage your hosting, domain, SSL, business email and Google Business Profile, and to handle update requests and support.
Where your website or inbox collects data from your customers (e.g. enquiry forms, bookings, mailboxes), we may process that data on your behalf as a processor under Section 12.

e. Communications

Records of emails, messages and support requests between us.

We do not intentionally collect special-category data (e.g. health, religion) or children's data (Section 15). Please don't send us special-category data unless strictly necessary.

4. How we collect it

Directly from you — via forms, email, onboarding and while providing the Services.
Automatically — technical request data may be processed by our hosting and content providers when you visit the Site (Section 3).
From third parties/providers — e.g. our payment processor confirms a payment; a registrar or hosting provider confirms account details.

5. Why we use your data and our legal bases

Purpose	Data used	Legal basis (GDPR/UK GDPR)
Respond to Preview requests and enquiries	Contact & business data	Steps at your request prior to a contract (Art. 6(1)(b)); our legitimate interest in responding (Art. 6(1)(f))
Provide the Services (Build, Care Plans)	Contact, project, credentials, care-plan data	Performance of a contract (Art. 6(1)(b))
Take payment and keep tax/accounting records	Billing & payment data	Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c))
Operate and secure the Site	Technical data, strictly necessary cookies	Legitimate interests (Art. 6(1)(f)) in a working, secure site
Communicate about your project/support	Contact & communications	Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f))
Send marketing (if any)	Contact data	Consent (Art. 6(1)(a)), or legitimate interests / soft opt-in where lawful — see Section 8
Comply with law and defend legal claims	As relevant	Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f))

Where we rely on legitimate interests, we have balanced those interests against your rights; you may object (Section 13).

6. Website analytics

We do not currently load Google Analytics, advertising trackers or other website analytics. If that changes, we will update this Policy to describe the service and how it uses data before enabling it, and request consent where required.

7. Cookies and browser storage

The website does not set analytics or advertising cookies. Contact fields such as your name, email and business details are not saved in browser storage. If you arrive through a referral link or enter a referral name or code, we keep that referral value in session storage for the current tab so it carries between the homepage and partner page. No analytics consent banner is displayed because analytics is not enabled. Hosting and security providers may process technical request data to deliver and protect the Site. Your email provider's own privacy policy applies when you send us an enquiry.

8. Marketing communications

We will only send you marketing where we have a lawful basis to do so — generally your consent, or, where permitted, on a "soft opt-in" basis to existing clients about similar services. Every marketing message includes an unsubscribe link, and you can opt out any time by emailing natanxhelilaj00@gmail.com. Opting out of marketing does not stop essential service messages (e.g. invoices, security or account notices).

9. Who we share your data with

We do not sell your personal data. We share it only with:

Service providers / processors who help us run the business, under contracts that require them to protect it, including:
- Hosting — our website hosting provider
- Business email — our business email provider
- Domain registration — our domain registrar
- Payments — our payment processor
- Enquiry email — Gmail (Google), when you send an enquiry to our published email address
- Website fonts and assets — Google Fonts and jsDelivr, when your browser requests those resources
- E-commerce platform (for Shopify builds) — Shopify Inc.
- Google Business Profile — Google (where a Care Plan includes GBP management)
Professional advisers (accountants, lawyers) where necessary.
Authorities or third parties where required by law, to enforce our Terms, or to protect our rights, safety or property.
A successor in the event of a business sale, merger or reorganisation, subject to this Policy.

10. International data transfers

We serve clients in the EU/EEA, UK and US. Two kinds of transfer are relevant:

To us in Albania. We are established in Albania, which is a "third country" for GDPR/UK GDPR purposes and does not currently benefit from an EU adequacy decision. This means that when we handle personal data relating to EU/EEA or UK individuals, that data is processed in Albania. Where a business client in the EEA/UK engages us as a processor, we will put appropriate safeguards in place for that transfer (typically the Standard Contractual Clauses, plus the UK Addendum/IDTA for UK data) as part of a data processing agreement.
To our providers. Some providers (e.g. Google, Shopify, and payment or hosting providers) may process data outside your country, including in the United States.

Where personal data is transferred across borders, we rely on appropriate safeguards, such as the Standard Contractual Clauses (and the UK Addendum/IDTA), an adequacy decision where one exists, or the EU–US Data Privacy Framework where a provider is certified. You can ask us for details or a copy of the relevant safeguards at natanxhelilaj00@gmail.com.

11. How long we keep your data

We keep personal data only as long as necessary for the purposes above:

Preview/enquiry data — for as long as needed to respond to and follow up on your enquiry, unless you become a client or we need to retain the correspondence for a legal obligation or dispute. You can ask us to delete it.
Client and project data — for the life of our relationship and while a Care Plan is active.
Billing, tax and accounting records — for the period required by law (commonly 6–10 years depending on jurisdiction).
Backups — cleared on our normal rotation cycle.

When data is no longer needed, we delete or anonymise it.

12. When we act as a processor for clients

When we host or maintain a website or inbox for a business client, we may process personal data about that client's own customers (e.g. enquiry-form submissions, bookings, mailbox contents). For that data, the client is the controller and Weavano is the processor: we process it only on the client's documented instructions and as needed to provide the Service, and we will enter a data processing agreement with business clients on request. This Policy's controller sections (legal bases, marketing) do not apply to that processor data; the client's own privacy policy governs it.

13. Your rights (EU/EEA and UK)

Subject to conditions and exemptions in law, you have the right to:

Access — get a copy of the personal data we hold about you.
Rectification — correct inaccurate or incomplete data.
Erasure — ask us to delete data ("right to be forgotten").
Restriction — ask us to limit processing in certain cases.
Portability — receive certain data in a portable format, or have it sent to another controller.
Object — object to processing based on legitimate interests, and to direct marketing at any time.
Withdraw consent — where we rely on consent, withdraw it at any time (without affecting prior processing).
Not be subject to solely automated decisions with legal or similarly significant effects — we do not carry these out (Section 16).

To exercise any right, email natanxhelilaj00@gmail.com. We will respond within the time the law allows (generally one month under GDPR/UK GDPR). Exercising your rights is free unless a request is manifestly unfounded or excessive.

Right to complain. You may lodge a complaint with a supervisory authority. In the EU/EEA, this is the data protection authority in your country of residence; in the UK, the Information Commissioner's Office (ICO) at https://ico.org.uk; and in Albania, the Information and Data Protection Commissioner (IDP) at https://www.idp.al. We'd appreciate the chance to resolve your concern first — please contact us.

14. Your rights (United States — California and other states)

If you are a US resident, you may have rights under state privacy laws such as the California Consumer Privacy Act as amended by the CPRA and similar laws in other states, including the right to:

Know / access the categories and specific pieces of personal information we collect, use and disclose;
Delete personal information we hold about you, subject to exceptions;
Correct inaccurate personal information;
Opt out of "sale" or "sharing" of personal information and of targeted advertising; and
Non-discrimination for exercising your rights.

We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising, as those terms are defined under California law. To exercise any right, contact natanxhelilaj00@gmail.com. We will verify your request and respond within the timeframe required by law. You may use an authorised agent where the law permits.

15. Children

The Services are for businesses and adults. We do not knowingly collect personal data from children under 16 (or the age set by your local law). If you believe a child has provided us data, contact natanxhelilaj00@gmail.com and we will delete it.

16. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing, and we do not carry out profiling of that kind.

17. Security

We use commercially reasonable technical and organisational measures to protect personal data (for example, access controls, encryption in transit via HTTPS/SSL, and vetted providers). No method of transmission or storage is completely secure, so we cannot guarantee absolute security; see also the security provisions in our Terms. If a personal-data breach occurs that is likely to result in a risk to your rights, we will notify the relevant authority and, where required, affected individuals, as the law requires.

18. Third-party links

The Site and your emails may link to third-party sites and services. We are not responsible for their content or privacy practices; review their policies separately.

19. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new "last updated" date and, for material changes, take reasonable steps to inform you. Continued use of the Services after changes take effect means you accept the updated Policy.

20. How to contact us

For any privacy question or to exercise your rights:

Natanael Xhelilaj PF Lagja 8 Shkurti, Rr. Joti Prifti, Parafabrikati 14, Shkalla 1, Hyrja 4, Fier, Albania Email: natanxhelilaj00@gmail.com