PRIVACY POLICY OF WORLD BUSINESS PASSPORT ONLINE (WBPO) LLC

General - Data processing information

WBPO is incorporated as a limited liability company in the Republic of Albania and operates under Albanian law. WBPO manages an online platform that enables businesses worldwide to register and access its services, subject to a registration fee.

In accordance with Law No. 124/2024 on the Protection of Personal Data of the Republic of Albania , WBPO processes personal data belonging to its employees, as well as a limited number of clients, suppliers, and partners. This includes certain individual businesses—such as sole practitioners operating under their personal names (e.g., individual attorneys, doctors, accountants, etc.).

This Privacy Policy outlines the principles and practices followed by WBPO in the processing of personal data, in accordance with Law No. 124/2024. It applies to customers, website visitors, contractors, users of WBPO’s services, and all individuals who interact with WBPO through its official website or verified social media platforms.

Specific details regarding the processing of personal data under individual contractual arrangements are set out in the relevant agreements, including service contracts, general terms and conditions of use, and service proposals.

1. INFORMATION ABOUT THE CONTROLLER

Unless otherwise specified in the documents governing a specific contractual relationship, the data controller for the processing of personal data is:

WBPO

Principal Address: “Durrës” Street, Shamo Building, Apartment 8/1 No.1, Level No.2, Floor 9,

Municipal Unit No.10, Tirana, Republic of Albania

For any inquiries regarding the processing of personal data, you may contact WBPO’s Personal Data Protection Officer (DPO) in writing at: dpo@worldbusinesspassport.com

2. COLLECTION AND PROCESSING OF PERSONAL DATA

WBPO collects personal data from individuals for the purposes of entering into contracts, fulfilling legal obligations, providing services, and pursuing other lawful objectives. This data may be:

• Provided directly by the individuals themselves;
• Received from third-party sources; or
• Generated during the provision and use of WBPO's services.

Additionally, based on its legitimate interests, WBPO collects personal data through cookies and similar technologies, either placed by WBPO or by third parties. This enables the delivery of personalized advertisements and service offerings.

In the course of providing services to its customers, WBPO may also process additional personal data that is submitted by data subjects or received from other sources. This processing is carried out in accordance with applicable legislation, relevant contractual agreements, this Privacy Policy, and WBPO’s Terms of Service.

To ensure the accuracy and reliability of the personal data it processes, WBPO may verify such data against an official personal identification document and/or other authoritative sources.

For the purpose of verifying the authenticity of data submitted by clients, WBPO reserves the right to share such data with, or verify it through, relevant authorities, institutions, employers, banks, or other personal data controllers, in compliance with applicable data protection laws.

Legal basis and purposes for Personal Data Processing

WBPO processes personal data in accordance with the applicable legal bases under Albanian data protection law, for the following purposes:

Contractual Performance & Consent

Personal data is processed under the Online Consent Form and mutual contractual agreements for the provision of services, processing and storing payment information, and delivering related products and services. We also process inquiries, gather customer feedback, conduct market research, and engage in direct marketing activities (including profiling and analysis) to promote and improve our business and service quality.

Legitimate interests (Business Relationships)

We process the contact details of business partners and corporate clients solely for the purpose of managing our business relationships and tailoring our sales activities to specific needs. The legal basis for such processing is WBPO’s legitimate interest. Where the purpose of the contact is to establish a contractual relationship, the contractual basis will also apply. Data is managed securely within our internal software systems.

Recruitment and Job Applications

Personal data received in relation to job postings and applications is used exclusively by our HR & Finance Department for recruitment purposes. The legal basis for such processing is the initiation or execution of a contractual relationship. Prior consent is obtained before any application documents are forwarded to third parties.

Marketing, Analytics & Cookies

We use third-party advertising and analytics tools on our website and embed similar technologies in our marketing emails, as further described in our Cookies Notice. You may refuse or block cookies through your browser settings at any time.

Social Media Interactions

If you mention or engage with WBPO on social media, we may process your contact information to respond to inquiries, complaints, or comments. This is done in pursuit of our legitimate interest in managing our online reputation and user relationships.

Security and Crime Prevention

In line with our legitimate interests, we implement measures to prevent and detect criminal activity and ensure the safety of our operations. This includes the use of video surveillance systems within WBPO premises.

Sharing, Transfer, and Retention of Personal Data

To fulfill the purposes described above:

Data Sharing

We may share your personal data with payment processors, technology providers and other specialized professional or technical service providers as necessary to process payments and deliver our services effectively.

International Data Transfers

If we transfer your personal data outside the European Economic Area (EEA)—which includes EU member states, Iceland, Liechtenstein, and Norway—we will implement appropriate safeguards to ensure your data remains protected and is processed in compliance with applicable data protection laws.

Data Retention

We retain your personal data:

• As required to fulfill our contractual obligations;
• To provide services or comply with legal requirements;
• To respond to your inquiries or complaints;
• To comply with data retention obligations;
• To maintain and protect our contractual or legal rights;
• Where it is in our or a third party’s legitimate interest;
• Or where you or another individual has a vital interest in such processing.

When processing is based on your consent, we retain the data only for as long as necessary to fulfill the specific purpose for which it was collected. Furthermore, we may retain data for the duration of applicable limitation periods, and in accordance with tax, legal, or regulatory obligations.

3. PERSONAL DATA WE COLLECT

WBPO collects personal data when you interact with us—whether by contacting us, registering a business on our platform, using our website or app, or entering into a service agreement. We may also receive personal data from third-party sources. The types of data we collect include:

• Personal Identifiers
  Title, first name, last name, postal and email addresses, postal code, IP address, and contact telephone numbers.
• Corporate Customer Information
  For corporate clients and business contacts: job title, business address, and business email address.
• Transaction Information
  Details of payments and services subscribed to.
• Corporate Membership Information
  Information relating to any specific corporate membership, such as enrollment in premium services.
• Cookies and Device Data
  Data collected through cookies and similar technologies, such as device identifiers and browsing behavior. For more information, please refer to our Cookies Notice.
• Social Media Interactions
  Information from verified social media accounts, including views, reactions, comments, and other forms of engagement with our posts, website, and app. We may receive aggregated data from these platforms to understand user navigation and interaction patterns. In cases where personal data is involved, we act as joint controllers with the relevant social media platforms.
• Customer Correspondence
  Information you provide through direct communication, including specific inquiries, feedback, complaints, and other customer service interactions.
• Call Centers, Emails, and Online Forms
  Data submitted via calls, emails, or freely completed text fields in our online forms.

4. HOW DO WE USE YOUR PERSONAL DATA AND WHAT IS THE LEGAL BASIS?

WBPO processes your personal data when it is necessary to perform a contract or to take steps at your request prior to entering into a contract. This includes the provision of services via our website or app, and other related products and services. Specifically, we may use your data for the following purposes:

• Access Facilitation
  To grant you access to contact businesses registered on our platform, including those operating under regulated professions such as Attorneys, Doctors, Accountants, etc.
• Customer Support
  To assist you in reaching businesses listed on our platform, especially if you encounter any technical or communication issues.
• Identity Verification
  To verify your identity when necessary, including for fraud prevention or to ensure service security.
• Legal Compliance
  To fulfill legal obligations, including the requirement to report information to authorized public bodies or enforcement authorities.
• Payment Processing
  To facilitate and manage payments related to your use of our services.
• Communication
  To communicate with you regarding our services, updates, and changes relevant to your account or contract.
• Customer Service & Complaint Handling
  To provide support, manage inquiries, and handle complaints or disputes.
• Service Notifications
  To notify you by SMS, email, or phone in case of unplanned events requiring changes to our agreement, or where it is deemed necessary to protect your vital interests.

If you do not provide the requested information, WBPO may be unable to enter into a contract with you or fulfill its legal or contractual obligations.

Processing based on consent

In certain cases, WBPO processes your personal data based on your explicit consent. This includes the following:

• Marketing Communications
  Sending you emails, text messages, and push notifications (including newsletters) about products and services offered by WBPO or our carefully selected partners.
• Cookies and Tracking Technologies
  Placing cookies and similar technologies (such as pixel tags and web beacons) on your computer, mobile phone, or other devices. These may also be used in marketing emails and communications. For more details, please refer to our Cookies Notice.
• Competitions and Promotions
  Using your information when you participate in competitions or promotional activities organized by WBPO. If you win, we may use your data for promotional purposes, in accordance with the terms provided at the time of entry.
• Other Consent-Based Activities
  In any other case where we request your consent, we will clearly explain the specific purpose of the processing at the time we collect your information.

You have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. Instructions for withdrawing consent will be provided wherever consent is requested.

Processing for Legal Compliance

WBPO may process your personal data when necessary to comply with legal obligations imposed by applicable laws and regulations. This includes:

• Taxation and Financial Regulations
  Complying with legal requirements related to tax, anti-money laundering, and other regulatory frameworks.
• Government and Court Requests
  Responding to official requests from government authorities, regulators, or in accordance with court orders.
• Health and Safety Compliance
  Processing personal data when necessary to meet obligations under health and safety legislation.
• Information Sharing with Authorized Bodies
  Disclosing information to authorized entities in accordance with their licensing or regulatory requirements.
• Data Subject Requests
  Processing data in order to respond to and fulfill your rights under applicable data protection laws, such as access, correction, erasure, or objection requests.

Processing to protect vital interests

WBPO may process and disclose your personal data when necessary to protect your vital interests or those of another person. This includes:

• Emergency Situations
  Sharing your personal information with emergency services or other relevant authorities when we reasonably believe it is required to prevent serious harm, injury, or loss of life involving you or another individual.

Such processing is carried out only where it is strictly necessary and in circumstances where consent cannot be obtained in a timely manner.

5. SERVICE PROVIDERS AND CO-CONTROLLERS OF PERSONAL DATA

For some activities, we use external service providers. Your personal data will be shared with these providers when it is necessary to provide a service or when it is in our legitimate interest to do so. You will be notified separately when a third party and we act as a joint controller.

• Marketing purposes;
• Customer experience survey;
• Conducting analysis for business purposes;
• We send promotional offers;
• We send personalized advertisements;
• We advertise our services on our webpage or app;
• We ensure the development, support, maintenance and hosting of Information Technology, including the deployment of applications and webpage hosting;
• We process payments so you can pay by credit or debit card;
• Performing credit and fraud checks;
• Providing and maintaining video surveillance systems within our premises.

6. OTHER PARTIES

WBPO may disclose your personal data to third parties in specific situations where it is required by law or necessary to fulfill contractual or legal obligations. This includes:

• Regulatory and Legal Disclosures
  We may share your data with regulatory authorities, government bodies, and law enforcement agencies for the prevention or detection of crime, to comply with legal obligations, or to pursue or defend legal or contractual claims.
• Service-Related Disclosures
  Your data may also be shared with payment providers, technology providers, and technical advisors as needed to:
  • Facilitate secure payments;
  • Provide and support our services;
  • Fulfill obligations under applicable laws.

These disclosures are made only when lawfully required or when necessary to uphold our contractual commitments, and we ensure that these third parties respect your privacy and handle your data securely.

7. INTERNATIONAL TRANSFER OF PERSONAL DATA

WBPO does not transfer or store personal data outside the Republic of Albania or the European Economic Area (EEA), except in cases where such transfer is:

• Required by law or an applicable international agreement;
• Requested by you, in connection with the conclusion or performance of a contract.

These international transfers are exceptional and conducted in strict accordance with applicable data protection legislation.

If a transfer of personal data outside the EEA becomes necessary, WBPO ensures that your data is protected by one of the following safeguards:

• Adequacy Decisions
  The personal data is transferred to a country that the European Commission has deemed to provide an adequate level of data protection (i.e., a country covered by an adequacy decision).
• Contractual Safeguards
  We enter into a contractual agreement with the recipient, requiring them to protect your personal data to the same standards as those required under EEA and Albanian law. This may include the use of:
  • Standard Contractual Clauses (SCCs) approved by the European Commission;
  • Standard data protection clauses adopted by the Republic of Albania.

These safeguards are designed to ensure that your personal data remains secure, confidential, and protected in accordance with applicable data protection laws.

8. DATA RETENTION

1. Legal Basis for Data Processing Your personal data is stored and processed for:

• Fulfilling contracts or providing services.
• Compliance with legal obligations.
• Responding to inquiries or complaints.
• Protecting vital interests or legal rights.
• Legitimate business interests.
• Based on your consent (retained only as long as needed for the stated purpose).

2. Data Retention Periods Data is retained depending on its purpose. If the same data serves multiple purposes, it is kept for the longest required period. Examples:

• CCTV footage: Stored for up to 48 hours.
• Payment-related data: Stored for up to 3 years.
• Customer service interactions (enquiries, complaints): Stored up to 6 months after resolution.
• Marketing data: Stored for 3 years after last contact unless you opt out (in which case, data is retained only to respect your opt-out).

3. Extended Retention Data may be kept longer for:

• Internal or external investigations.
• Legal, tax, or regulatory obligations.

4. Deletion Rights
You may request deletion of your data at any time. Data may also be deleted sooner if no longer needed. This right is not absolute and we may reject it for a potential legal claim or compliance with law.

5. Web Server Logging When you visit the website, the following technical data is collected:

• Date/time of access
• Requested file and referring page
• Access status
• Browser and OS info
• Full IP address
• Data volume

This technical data:

• Is stored briefly for security purposes (e.g., attack detection).
• Is anonymized within 7 days.
• Used anonymously for statistical analysis.
• Not linked to individuals, nor shared with third parties.

9. PROCESSING FOR LEGAL AND REGULATORY PURPOSES

We process personal data as required to meet legal and regulatory obligations, which includes:

• Pursuit or defense of legal claims: This may involve disclosing personal data in the context of court proceedings or legal investigations.
• Regulatory compliance: Including obligations related to health and safety, such as maintaining records of workplace incidents or accidents.
• Crime and fraud prevention: We may process data to prevent, detect, investigate, or report suspected fraud, terrorism, security breaches, or other criminal activities, in line with applicable laws and regulations.
• Data anonymization: When personal data is no longer necessary for the original processing purpose, we may anonymize it to retain it for statistical, analytical, or legal record purposes without identifying individuals.

10. PROCESSING BASED ON LEGIMTIMATE INTEREST

WBPO may process users' personal data where it is necessary for the legitimate interests of WBPO or third parties. These purposes are outlined in this policy, the applicable terms and conditions, and in other documents that govern specific contractual relationships.

When processing personal data on the basis of legitimate interest, WBPO will:

• Carefully assess the potential impact of such processing on users, considering both positive and negative effects.
• Ensure that the rights and freedoms of users are not overridden by WBPO’s interests. The legitimate interests of WBPO will not automatically take precedence, particularly where users' fundamental rights (e.g. where a user is a child) are at risk.
• Avoid processing personal data on this basis if:
  • The user's interests or rights override WBPO’s;
  • The processing is not required by law; or
  • The processing is not otherwise permitted under applicable legislation.

In all such cases, WBPO will:

• Limit the processing to only the personal data necessary to fulfill the identified purpose.
• Apply all relevant data protection safeguards to ensure privacy and security.

Processing under legitimate interest is carried out in accordance with the Albanian Law on Personal Data Protection and the General Data Protection Regulation (GDPR).

11. FRAUD PREVENTION & OPERATIONAL SECURITY

As part of its commitment to customer care and ensuring uninterrupted business operations, WBPO processes customer data to prevent fraud and ensure the security, stability, and continuous operation of its services.

When processing data for these purposes, WBPO handles customer information strictly as necessary to deliver services securely and effectively. In this context, WBPO’s legitimate interest in preventing fraud and protecting its operations is considered to prevail over the interests, fundamental rights, and freedoms of customers, in accordance with applicable law.

To achieve this, WBPO may:

• Monitor, test, and review the performance and security of its systems, networks, processes, and premises to detect and prevent fraudulent activity and protect business continuity.
• Where customers provide credit or debit card details for payment, WBPO works with trusted third-party service providers to verify the validity of the bank account or card information in order to detect and prevent potential fraud.

All processing is conducted with strict adherence to data protection principles, ensuring that only the minimum necessary data is used, and appropriate safeguards are in place.

12. PERFORMANCE AND BUSINESS IMPROVEMENT

WBPO processes personal data to enhance service quality, support employee development, and improve overall business performance. This includes:

• Monitoring and recording video surveillance (CCTV), call center communications (including incoming and outgoing calls and emails), for the purposes of employee training, quality assurance, and service improvement.
• Analyzing customer transactions and interactions to better understand service usage, improve existing products and services, and support strategic planning and business development.

All processing is carried out with appropriate safeguards to protect privacy and in accordance with applicable data protection laws.

13. EMPLOYEE SAFETY AND WORKPLACE SECURITY

WBPO processes personal data to ensure a safe and secure working environment for all employees. This includes:

• Protecting premises and maintaining security, including the use of video surveillance systems (CCTV).
• Monitoring food safety and hygiene practices to comply with health regulations and safeguard employee wellbeing.
• Collecting witness statements related to workplace accidents or incidents, for investigation and reporting purposes.
• Detecting and preventing criminal activities, in coordination with relevant authorities where required.

All such processing is conducted in line with applicable legal obligations and internal safety policies, with the necessary safeguards to protect personal data.

14. DEVELOPMENT AND MARKETING OF PRODUCTS AND SERVICES

WBPO may process personal data for direct marketing purposes and to support the development of its products and services, where such processing is based on legitimate interest or, where required, your consent. These activities are carried out in accordance with the Law on Personal Data Protection and applicable regulations.

Processing for these purposes may include:

• Increasing brand awareness through targeted campaigns and advertising.
• Understanding customer preferences and behaviors by analyzing transactions and other data provided directly by you or inferred through your interactions with us.
• Sending marketing communications—including profiling and promotional content—via mail, email, SMS, or push notifications, as permitted by law.
• Providing personalized offers and recommendations, where legally allowed.
• Displaying targeted advertisements on third-party platforms (e.g., Facebook, Instagram, Google), based on your interests and prior interactions with WBPO.

To achieve these objectives, we may:

• Share certain personal data with marketing service providers, advertising technologies, and digital ad networks such as Facebook, Google, Adobe, and Rocket Fuel.
• These third parties may:
• Use hashed identifiers (e.g., your name, email address, or device ID in encrypted form) to recognize your devices;
• Collect additional information, such as your IP address, browser, or operating system;
• Combine your data with information from other data-sharing partnerships;
• Set or recognize cookies in your browser to deliver interest-based advertising, which may include anonymous demographic data.

Additionally, WBPO may:

• Monitor the performance and usage of its website and mobile applications to optimize functionality and enhance marketing efficiency.
• Invite selected individuals to participate in surveys, provide feedback, or engage in market research.
• Use data in support of business development strategies, including the application and structuring of service fees.

All such data processing is subject to strict data protection safeguards, and where required by law, WBPO will obtain your prior consent before engaging in direct marketing activities.

15. THE RIGHT TO OBJECT

Your Right to Object to Data Processing
You have the right to object at any time to the processing of your personal data when it is based on legitimate interests. This includes profiling. After receiving your objection, we will cease further processing of your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your rights, freedoms, and interests, or the processing is necessary for the establishment, exercise, or defense of legal claims.

Right to Object to Direct Marketing
If your personal data is being processed for direct marketing purposes, you have the unrestricted right to object at any time. This includes any profiling carried out for marketing. You can exercise this right by:

• Clicking the ‘unsubscribe’ link at the bottom of any marketing email or text message.
• Contacting our Data Protection Officer at dpo@worldbusinesspassport.com.

If you object to our processing of personal data for direct marketing, we will immediately stop processing your data for these purposes.

Marketing through Third Parties
If you have consented to receive marketing communications via another organization, such as a social media platform (e.g., Facebook), we may ask them to send you marketing on our behalf. However, if you object to receiving marketing from us, we will stop all marketing communications. If you wish to withdraw your consent regarding marketing from our company, please contact our Data Protection Officer at the above email address.

16. THE RIGHTS OF INDIVIDUALS

Subject data of WBPO have the right to request the following, in accordance with applicable data protection laws:

• Access to personal data – You may request a hard copy or access to the personal data that WBPO processes about you.
• Correction of data – If you believe your personal data is inaccurate or incomplete, you may request that it be corrected.
• Deleting or restricting – You may request the deletion or restriction of some or all of your personal data if you no longer wish for it to be processed.

Additionally, data subjects may:

• Object to processing – You may object to the processing of your personal data when it is based on legitimate interests, or when it is processed for direct marketing purposes.

How to Submit a Request

To exercise any of these rights, data subjects must:

• Properly identify themselves; and
• Clearly state the nature of the request. Requests for data corrections can be submitted:

Requests for data corrections can be submitted:

• In writing; or
• By signing a new document that contains the corrected data.

Limitations and Response Time

Please note that in specific cases, certain rights may be restricted by law (e.g., withholding of data in the context of an active investigation). WBPO will respond to your request within one month of receipt. If necessary due to complexity or volume, this period may be extended to a maximum of three months, in which case you will be informed of the delay and the reason for it.

17. THE RIGHT TO COMPLAIN

Complaints and Contact Information
If you believe that WBPO has violated your rights during the processing of your personal data, you have the right to submit a complaint directly to us.

How to Submit a Complaint to WBPO
You can send your complaint to:

📍 Mailing Address:
WBPO
“Durrës” Street, Shamo Building,
Apartment 8/1 No.1, Level No.2, Floor 9,
Municipal Unit No.10, Tirana,
Republic of Albania

📧 Email: dpo@worldbusinesspassport.com

Right to Lodge a Complaint with the Supervisory Authority
In addition to contacting WBPO, you also have the right to file a complaint with the supervisory authority for data protection in the Republic of Albania:
Office of the Information and Data Protection Commissioner (https://idp.al/en/eng/)
Email: info@idp.al

We encourage you to contact us first to resolve any concerns, but you are free to contact the supervisory authority at any time.

18. CALIFORNIA PRIVACY RIGHTS - DO NOT SELL OR SHARE MY PERSONAL INFORMATION

As described in Sections 2, 5, and 14 of this Privacy Policy, WBPO shares certain personal data with trusted partners in order to provide you with personalized offers for goods and services based on your cookie preferences.

This section specifically applies to residents of California and merchants conducting business in California, USA.

Compliance with California Privacy Laws

Our platform—including our Website, Mobile App, and all associated tools—complies with the California Consumer Privacy Act of 2018 (CCPA) and the California Privacy Rights Act (CPRA), as amended in 2020 and 2023, particularly in regard to the requirement for a “Do Not Sell or Share My Personal Information” notice.
Under this legal framework, California residents and merchants are granted expanded rights and greater control over their personal information collected by businesses.

Your Right to Opt-Out

If you are a California resident or a merchant operating in California, you have the right to opt-out of the sale or sharing of your personal information.

You can exercise this right by:

• 👉 Clicking on the “Do Not Sell or Share My Personal Information” link on our website or app and adjusting your preferences accordingly.

By turning off the option, you are requesting that WBPO not sell or share your personal data with third parties for advertising or other purposes, in accordance with California law.

Additional Information

To learn more about your privacy rights under California law and how to exercise them, please visit the official website of the Attorney General of California – Department of Justice: https://oag.ca.gov/privacy/ccpa

19. FINAL PROVISIONS

This Privacy Policy forms an integral part of the legal framework governing the processing of personal data by WBPO. In addition to the provisions outlined herein, the processing of personal data within the scope of each contractual relationship is also subject to the respective agreement and the applicable terms and conditions regulating that relationship.

This Privacy Policy has been prepared in accordance with Law No. 124/2024 on the Protection of Personal Data of the Republic of Albania, which is fully harmonized with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation – GDPR), concerning the protection of natural persons with regard to the processing of personal data and the free movement of such data.

In addition to compliance with the GDPR, this Privacy Policy also adheres to applicable California privacy laws, specifically with respect to the "Do Not Sell or Share My Personal Information" requirement, as set out in the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

In cases where any terms and conditions governing a business relationship conflict with this Privacy Policy, personal data will be processed only to the extent permitted under the applicable data protection legislation.