Privacy & cookies

The inquiry form, on the Contact page and in the footer, asks for:

• your name and email (required);
• your phone number, company, project type, project location and a description of the project (optional);
• up to three files, 4 MB in total (optional).

The form also sends the language of the page and the address of the page you sent it from.

The form posts to a small server function on our hosting. The function emails your message to info@dafinor.com through Resend and stores nothing itself: no database, no file store. The email, with any attachments, then sits in our mailbox. We use it to answer you and, if you become a client, to run the project.

To stop automated abuse, the function counts requests per IP address: five in ten minutes. The count lives in the function's memory and disappears when the function restarts. It is never written to disk.

If you write or call us directly instead, we keep what you send.

Vercel hosts the site. Like any web host, it records each request in server logs: your IP address, the time, the page requested, the response code, and your browser and device type. We use the logs to keep the site running and to spot abuse.

The site sets no cookies of its own and has no accounts. Fonts and images load from dafinor.com, not from Google Fonts or another outside service.

Nothing from Google or Meta loads until you agree. The first time you visit, a banner asks. You can accept everything, refuse everything, or choose by category. The site works the same whichever you pick.

• Necessary: remembers your answer. Always on.
• Measurement: Google Analytics 4.
• Advertising: the Meta Pixel.

Your choice is stored in your browser's localStorage under the key dafinor_consent_v1. It is not a cookie and it never leaves your browser. It holds two yes/no values, measurement and advertising, and stays until you change it or clear site data.

df-seen and df-nav are small flags in sessionStorage: the number 1, and a timestamp. They go when you close the tab.

Google Analytics

With your agreement, the site loads Google Analytics 4 (measurement ID G-98S2CQCMV1) from googletagmanager.com. Google sets two cookies, _ga and _ga_98S2CQCMV1, each valid for two years by default, according to Google's documentation.

We see which pages and projects are opened, which sector filter is chosen, whether a form is started or sent, and clicks on email and phone links, together with device, browser, approximate location and where the visitor came from. The events are page_view, view_item, select_content, begin_inquiry, contact and generate_lead. Google receives your IP address with each request. We do not send anything you type into a form.

Meta Pixel

With your agreement, the site loads the Meta Pixel (ID 962946239732639) from connect.facebook.net. It sets _fbp, a cookie that lasts about 90 days, and _fbc if you arrive from a Meta advert. We use it to measure results and to show Dafinor's adverts on Facebook and Instagram to people who have looked at our work. If you are logged in to Facebook or Instagram in the same browser, Meta can link the visit to your account. Once Meta has the data, it decides what to do with it under its own privacy policy.

The pixel sends these events:

• PageView: every page you open.
• ViewContent: a project page (with the project's name and sector), and the Expertise and Projects pages.
• FilterProjects: a sector chosen on the Projects page.
• Contact: a click on an email, phone or WhatsApp link.
• StartInquiry: the first click into an inquiry form.
• Lead: an inquiry was sent. Only the fact and which form, not what you wrote.

Change or withdraw your choice

Use Cookie settings in the footer, or the button below. It clears your saved answer and opens the banner again. Tracking stops at once and stays off until you choose again. Cookies already in your browser remain until they expire; delete them in your browser settings if you want them gone.

Albania's Law No. 124/2024 “On the protection of personal data” applies to Dafinor. It follows the EU's GDPR, and the GDPR applies as well to visitors in the EU and the European Economic Area. We rely on:

• Answering your inquiry: your request for steps before a contract, and our legitimate interest in replying to business inquiries.
• Server logs and the rate limit: our legitimate interest in keeping the site secure and available.
• Remembering your cookie choice: it is needed to honour that choice.
• Google Analytics and the Meta Pixel: your consent. You can withdraw it at any time. Withdrawing does not undo what happened before.

Dafinor does not sell personal data. These providers receive it, and all four are US companies:

• Vercel: hosting and server logs.
• Resend: delivery of the inquiry email.
• Google: Analytics, only with your measurement consent.
• Meta: the Pixel, only with your advertising consent.

So the data leaves Albania and the EU/EEA. For such transfers we rely on the safeguards the law allows (Article 41 of Law No. 124/2024), mainly the standard contractual clauses in each provider's terms. Ask us at info@dafinor.com which safeguard applies to which provider.

• Inquiries and attachments: in our mailbox while we are in contact or working together, and afterwards only as long as a contract, accounting or legal duty requires. An inquiry that leads nowhere is deleted 12 months after our last exchange.
• Server logs: Vercel keeps them for a limited time under its own terms.
• Rate-limit counts: ten minutes, in memory.
• Your cookie choice: until you change it or clear your browser's site data.
• Google Analytics: the cookies last two years. Analytics keeps event-level data for 2 months and user-level data for 14 months, a period that restarts when the same browser comes back.
• Meta: _fbp lasts about 90 days. Meta keeps the data it receives under its own policy.

Under Law No. 124/2024 and, for visitors in the EU, the GDPR, you can ask for:

• a copy of the data we hold about you;
• correction of it;
• erasure of it;
• restriction of how we use it;
• a portable copy, to take elsewhere.

You can also object to uses that rest on our legitimate interest, ask not to be subject to purely automated decisions (we make none), and withdraw consent at any time.

Write to info@dafinor.com. We answer within 30 days. For a complex request the law allows up to 60, and we will tell you why. The answer is free unless the request is clearly unfounded or excessive. We may ask you to prove who you are.

If you think we have handled your data wrongly, you can complain to the Commissioner for the Right to Information and Personal Data Protection (IDP): idp.al, info@idp.al, Rr. “Abdi Toptani”, Nd. 5, Tirana. Visitors in the EU can also complain to the authority in their own country. You can go to court as well.

We update this page when what the site collects changes, and we change the date at the top.