KVKK / GDPR Privacy Notice

This Data Protection Notice has been prepared to explain the purposes for which personal data are processed, to whom and for what purposes they may be transferred, the methods of collection, legal grounds, retention periods, and the rights of data subjects within the scope of services offered through the Kosovainvestment.com website operated by KS Law Consultancy LLC.

2.1 Identity Data: Name, surname, date of birth, place of birth, nationality, citizenship, passport number, ID number, tax number/TIN, marital status, signature, photograph, biometric photo.\n\n2.2 Contact Data: Phone number, WhatsApp number, email address, residence address, billing address, business address, country, city, and communication preferences.\n\n2.3 Customer Transaction Data: Purchased service/package information, application number, form records, document upload records, missing document requests, client portal records, service status, messaging history, appointment information, agreement/consent records, and transaction history.\n\n2.4 Financial Data: Invoice information, payment amount, payment date, payment provider, transaction number, payment status, refund/chargeback records.\n\n2.5 Company and Commercial Data: Company name, business number, tax number, ownership structure, shareholder information, director/authorized person information, UBO/ultimate beneficial owner information, business activity, NACE/activity code.\n\n2.6 Document Data: Passport, ID, address document, lease agreement, company documents, rejection decisions, bank documents, insurance documents, power of attorney, translation documents.\n\n2.7 Risk, Compliance and KYC/KYB Data: PEP declaration, sanctions list declaration, source of funds explanation, UBO information, countries of operation, transaction volume.\n\n2.8 Technical and Digital Data: IP address, device information, browser information, session logs, cookie records, access logs, transaction timestamps, language preference.\n\n2.9 Special Category Data: As a rule, special category/sensitive data is not requested. However, health insurance documents, criminal records, and biometric photographs may be processed for certain services.

• Receiving service or package applications\n• Filling forms and preparing application files\n• Preparing company formation files, ARBK forms, address documents, contract drafts\n• Residence permit application form preparation\n• Bank application preparation, KYC/KYB document list, source of funds explanation\n• Accounting, translation, notary, insurance, expert coordination\n• Creating missing document requests\n• Service tracking through client portal\n• Payment, invoicing, refund, and chargeback processes\n• Recording distance service agreements and consents\n• Customer communication, support, and appointment processes\n• Fulfilling legal obligations\n• Information security and fraud prevention\n• Improving service quality

• Necessity for establishing or performing a contract\n• Fulfilling the legal obligation of the data controller\n• Necessity for establishing, exercising, or protecting a right\n• Legitimate interest, provided it does not harm fundamental rights and freedoms\n• Explicit consent of the data subject\n• Being expressly stipulated by law

• Forms on Kosovainvestment.com\n• Product/service/package application forms\n• Document upload areas\n• Client portal and admin portal\n• Email, WhatsApp, phone\n• Payment provider and invoicing processes\n• Cookies, log records, and technical system records\n• Documents provided by the customer

• Authorized official institutions and administrative authorities\n• ARBK and related business registration bodies\n• Immigration/residence authorities\n• Tax administration and accounting experts\n• Banks and payment institutions\n• Notaries, sworn translators\n• Insurance providers\n• Lawyers, consultants, experts\n• Technical infrastructure, hosting, software, security providers\n• Cargo/postal service providers\n• Courts, enforcement offices, and other public institutions

As Kosovainvestment.com provides multilingual and international services, some of your personal data may be processed or transferred to Kosovo, Turkey, EU countries, or other countries where technical infrastructure providers are located for the purpose of service execution.\n\nInternational transfers are carried out within the framework of service performance, contractual relationship, explicit consent, legal obligation, legitimate interest, and transfer conditions provided in applicable data protection legislation.

Your personal data is retained for the duration required by the processing purpose. The duration of the service relationship, legal retention periods for contract and payment records, tax/accounting obligations, dispute possibilities, and limitation periods provided in relevant legislation are taken into account.\n\nPersonal data whose retention period has expired or whose processing purpose has ceased is deleted, destroyed, or anonymized in accordance with applicable legislation.

• HTTPS and secure connections are used\n• Role-based access is implemented\n• Document access is restricted by authorization\n• Admin operations and document accesses are logged\n• File upload security and MIME type controls are applied\n• Payment information is processed in payment provider infrastructure\n• System security, backup, and access controls are implemented

• Learning whether personal data is processed\n• Learning the purpose and whether it is used in accordance with its purpose\n• Knowing third parties to whom data is transferred domestically or abroad\n• Requesting correction of incomplete or incorrect data\n• Requesting deletion or destruction of personal data\n• Objecting to results of automatic analysis\n• Requesting compensation for damage caused by unlawful processing\n• Rights of access, correction, deletion, restriction, portability, objection, and withdrawal of consent under GDPR

KS Law Consultancy LLC\nAddress: Rruga Ernest Koliqi Nr.48, Prishtinë, Kosovë\nEmail: [email protected]\nWeb: https://kosovainvestment.com\n\nYour application should include your name, surname, contact information, subject of your request, and information to help verify your identity.

The customer accepts that all information and documents submitted to the site are accurate, current, complete, and lawful. If documents or personal data belonging to another person are submitted, informing the relevant person is the customer's responsibility.

This Data Protection Notice may be updated due to legislative changes, service structure, payment infrastructure, data processing procedures, or technical requirements. The current text is published on Kosovainvestment.com.