Privacy Policy

The controller for the processing described in this policy is Kodesign Sh.P.K., unless another controller is identified for a particular service. Kodesign has not appointed a Data Protection Officer. Privacy questions and rights requests can be sent to the contact below.

Kodesign processes personal data under Kosovo Law No. 06/L-082 on Personal Data Protection. The EU General Data Protection Regulation (GDPR) applies where processing falls within its territorial scope. The Swiss Federal Act on Data Protection (FADP) applies where its scope is met.

Kosovo is not described here as an EU Member State, and this policy does not claim that the GDPR automatically applies to every visitor.

The form sends the submitted information through the same-origin /contact.php endpoint to contact@kodesign.dev. Namecheap's hosting and cPanel email infrastructure processes the request and resulting business email. Kodesign also forwards business mail to a company Gmail address. Only authorised Kodesign team members have routine access.

Submitting an enquiry does not subscribe the visitor to marketing. There is currently no optional email-marketing consent in the form.

If analytics consent already exists, a successful submission sends a generate_lead event with the contact category to GA4. The message, name, email, company, timeline, meeting preference, and other form contents are not sent to Google Analytics.

If marketing consent already exists, a successful submission may send a standard Lead event without parameters to Meta Pixel. The message, name, email, company, timeline, meeting preference, and enquiry type are not sent to Meta. This does not subscribe the visitor to marketing.

The server validates the request method, request size, same-origin Origin or Referrer and host information, required fields, lengths, email format, form timing, and a hidden honeypot field. Hosting systems may also create request, error, access, and security logs containing IP addresses and technical request information.

For rate limiting, the endpoint hashes the visitor IP with a service-specific value and stores recent timestamps in the PHP temporary directory. Hashing reduces direct exposure but does not necessarily make the identifier non-personal data. No more than five accepted attempts are allowed in the current one-hour window.

Timestamps cease to count after one hour. Expired rate files are eligible for probabilistic cleanup during later form requests and files with no active timestamps are deleted. A file can nevertheless remain until later form traffic or the hosting environment's temporary-file cleanup. Namecheap may retain access, error, security, and backup data for service operation, restoration, security, legal, and troubleshooting needs under its published policies and Kodesign's service agreement.

Kodesign uses Google Analytics 4 with Measurement ID G-TZNQNVZ90W only after Analytics consent. Depending on the visitor and contractual context, relevant providers include Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, and Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing is governed by Google's applicable Analytics Terms and data-processing terms.

After consent, the site loads gtag.js from www.googletagmanager.com and may send measurement requests to www.google-analytics.com and region1.google-analytics.com. GA4 can receive cookie and online identifiers, IP-derived approximate location, device/browser information, page URL and title, referrer, language, page views, scrolls, outbound clicks, file downloads, and successful-enquiry events.

The current site configuration disables Google Signals, Google advertising-personalisation signals, Privacy Sandbox interest-group storage, and all advertising-related Consent Mode signals. Site search, video engagement, and automatic form-interaction measurement are intended to remain disabled in the GA web-stream settings. Kodesign does not use User-ID and does not currently link this property to Google Ads.

After the contact endpoint confirms a successful submission, the site sends generate_lead with the category contact only if Analytics consent is active. It does not send the visitor's name, email address, company, message, timeline, meeting preference, enquiry type, or other form contents to GA4.

Consent can be withdrawn at any time through Cookie settings. Withdrawal prevents future GA loading from this site, applies denied Analytics consent, removes the loaded script, and attempts to delete accessible GA cookies. Browser controls may be required for third-party storage Kodesign cannot directly remove.

Kodesign uses Meta Pixel ID 1733276837931388 only after marketing consent. Depending on the visitor and service context, relevant providers include Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, and Meta Platforms, Inc., 1 Meta Way, Menlo Park, California 94025, USA. Kodesign and Meta process information under Meta's applicable Business Tools Terms and data-processing terms.

After marketing consent, the site loads the Pixel library from connect.facebook.net and sends requests to www.facebook.com. It reports a PageView and, after a successful enquiry, a standard Lead event without custom parameters. Meta may receive the event, page URL and referrer, timestamp, browser/device/network information, IP address, and Meta or cookie identifiers such as _fbp and _fbc when available. Meta may use information from its business tools in accordance with its terms and privacy policy.

Kodesign uses these events to measure and attribute Meta advertising and optimise campaigns. The current implementation does not create website audiences, enable Advanced Matching or use Conversions API. Automatic event detection is off. It does not send form contents, message text, name, email address, company, timeline, meeting preference, or enquiry type to Meta.

Marketing consent can be withdrawn through Cookie settings. Withdrawal revokes future Pixel collection from this site, removes the Pixel script, and attempts to delete accessible _fbp and _fbc cookies. Browser controls may be required for third-party storage that Kodesign cannot directly remove.

Access is limited to authorised Kodesign team members and providers who need the information for the purposes described. Lawyers receive enquiry information only if legal advice is necessary. Information may also be disclosed where required by law, a valid authority request, or to establish, exercise, or defend legal claims.

The live service uses Namecheap for hosting, cPanel email, DNS and spam filtering, Google Gmail for forwarded business mail, Google Analytics after Analytics consent, and Meta Pixel after Marketing consent. Providers may process data outside Kosovo, including in the Netherlands, Ireland, the United States, and other locations used by their subprocessors. Relevant provider contracts, data-processing terms, and transfer mechanisms such as standard contractual clauses apply where available and required. Kodesign does not claim that Kosovo has an EU adequacy decision.

Kodesign retains personal data only for the periods or objective criteria below, subject to any longer period needed for a legal claim, investigation, or mandatory accounting, tax, or other record-keeping duty. Kodesign management is responsible for applying this schedule and deletion is performed manually where the system does not expire information automatically.

Subject to the applicable law and its conditions, you may request access, correction, erasure, restriction, and data portability where applicable, and object to processing based on legitimate interests. You may withdraw consent at any time without affecting processing lawfully carried out before withdrawal, and object at any time to direct marketing. Kodesign does not currently use the general enquiry form for direct-marketing subscriptions.

Kodesign may update this policy when processing, providers, laws, or safeguards change. Material changes to consent purposes or vendors will receive a new policy/banner version and, where required, a new consent request. The effective date, last-updated date, and version above identify the applicable policy.