Your information, and what we do with it.

Only what the work actually needs:

• Account details — your name, business name, email address and phone number.
• Business information — trading address, opening hours, services and prices, and the other details that go on your website.
• Project content — the logo, photos, text and links you send us to build the site.
• Order and payment information — what you ordered, the amounts, the currency, dates, payment status and the identifiers our payment provider gives us.
• Support and change requests — the messages you send us and our replies.
• Technical information — the limited data our hosting produces in order to serve and secure the site, such as server logs.

We do not hold your card details. Card numbers, expiry dates and security codes go directly to the payment provider. We receive a reference, an amount and a status — never the card itself.

Different purposes rest on different grounds. Consent is not a blanket answer, and we do not claim it where the real basis is the contract between us.

Where we rely on legitimate interests, you can object — see clause 08. Where we rely on consent, you can withdraw it at any time without affecting anything done before you did.

Buying a website does not sign you up to a mailing list. Marketing email is a separate, unticked choice at checkout and in your account settings, and saying no has no effect on what you buy or how we support you.

Service messages are different: build updates, review requests, payment confirmations and failure notices are part of the service and cannot be switched off while your project or subscription is active. Every marketing email carries an unsubscribe link, and the same switch is in Account Settings → Notification preferences.

We keep information for as long as the reason for holding it lasts:

• Account and project information — while your account is open, and for a reasonable period afterwards in case you come back or a dispute arises.
• Website content you supplied — while we host your site, plus a short window after cancellation so it can be restored or exported if you ask.
• Invoices and payment records — for the period required by tax and accounting law in the Republic of Kosovo.
• Support messages — while they are useful for supporting you, then deleted on our normal clean-up cycle.
• Marketing consent records — while you are subscribed, plus a record of the withdrawal so we do not email you again by mistake.

We have deliberately not printed exact durations we cannot yet stand behind. The retention schedule should be finalised alongside the legal review, and this clause updated with the actual periods.

We use a small number of service providers to run the service. They act on our instructions and only for the purposes below.

We do not sell your information, and we do not share it for anyone else's advertising. We will disclose it if the law requires it, and we will tell you when we are allowed to.

Some providers may process information outside the European Economic Area. Where that happens, the transfer needs a lawful safeguard — normally an adequacy decision or standard contractual clauses with the provider.

Paddle, Vercel, Resend and Hostinger may process data outside Kosovo and the EEA. Each is engaged under a data processing agreement incorporating the European Commission's Standard Contractual Clauses, which is the transfer mechanism we rely on. Copies are available on request from info@xovahweb.com.

Depending on where you live, you can ask us to:

• Give you a copy of the information we hold about you.
• Correct it if it is wrong or out of date.
• Delete it, where we do not have to keep it for legal or accounting reasons.
• Restrict what we do with it while a question about it is resolved.
• Object to processing we base on legitimate interests.
• Port it — receive it in a common machine-readable format, or have it sent to another provider where that applies.
• Withdraw consent where consent is the basis, such as marketing email.

Write to info@xovahweb.com and we will respond within the period the law allows. If you are not satisfied, you can complain to your data protection authority — in Kosovo, the Information and Privacy Agency (Agjencia për Informim dhe Privatësi), and if you are in the EEA, the authority for the country you live in.

Your website is served over HTTPS, access to customer data is limited to the people who need it to do the work, and card details never reach our systems because the payment provider handles them directly.

We are not going to tell you our systems are unbreakable, because nobody can honestly say that. What we can say is what we do: keep the stack patched, keep backups, keep access narrow, and tell you promptly if something happens that affects your information.

This is a service for businesses. It is not directed at children and we do not knowingly collect information about them.

If we change how we handle your information, we update this page and change the date at the top. Where the change materially affects you, we will tell you directly rather than relying on you noticing.