Last updated: 14 September 2026
You don’t need to provide any personal data to view exchange rates on kursikembimit.al. This policy explains what data we process when you use certain services, why, how long we keep it and what your rights are.
1. Who processes your data
The data controller is Magus Group Albania, which develops and runs kursikembimit.al. For any privacy question, write to us from the Contact us page.
2. What data we collect
- Email alerts: your email address, alert preferences (currencies, threshold, bank), sign-up and verification dates, and a unique code for confirming and unsubscribing.
- Contact form: the name, email address, subject and message you send us.
- API users: the person’s or organisation’s name, a contact email and key usage logs (number and time of requests).
- Technical data: IP address, browser and device type, pages visited and request time, kept in server logs and security systems.
- Usage statistics: aggregated data about how the site is used (for example the most visited pages and visit duration), through analytics tools.
3. Why we use it and on what basis
- To send the alerts you ask for, based on your consent, given when you confirm your email and withdrawable at any time.
- To reply to you when you contact us, based on your request.
- To provide the API, based on the usage agreement.
- To keep the service secure: preventing spam, abuse and automated copying of data (for example request limits and Cloudflare Turnstile verification), based on our legitimate interest.
- To improve the site through aggregated statistics, based on legitimate interest or consent where the law requires it.
- To meet legal obligations when competent authorities lawfully require it.
We don’t use your data for profiling, personalised advertising or automated decisions with legal effects on you.
4. Cookies
- Essential: the session cookie and
XSRF-TOKEN, which protect forms against attacks. - Functional:
noir_moderemembers your light or dark mode choice. - Security:
kk_passis set only after you pass a security check and remembers that result for a few hours; Cloudflare may set technical cookies (for example__cf_bm) to tell automated traffic apart. - Analytics: Google Analytics (through Google Tag Manager) and Microsoft Clarity use cookies for aggregated usage statistics.
You can delete or block cookies in your browser settings. Blocking essential cookies may stop forms from working.
5. Who we share data with
We don’t sell or rent your data. We share it only with service providers who help us run the site and process it on our instructions:
- our server hosting provider;
- Cloudflare: content delivery, attack protection and Turnstile verification;
- our email delivery provider, for alerts and replies;
- Google (Tag Manager, Analytics) and Microsoft (Clarity), for usage statistics.
Some of these providers process data outside Albania, in the European Union or the United States, under internationally recognised safeguards.
6. How long we keep data
- Email alerts: until you unsubscribe. Sign-ups that are never confirmed are deleted periodically.
- Contact messages: up to 24 months, unless the law requires longer.
- Technical and security logs: usually up to 90 days.
- Analytics statistics: according to each provider’s retention settings.
7. Your rights
Under Albanian personal data protection law, you have the right to:
- know whether we process your data and get a copy of it;
- ask for inaccurate data to be corrected, or for your data to be deleted;
- restrict or object to processing;
- withdraw consent at any time, without affecting the lawfulness of earlier processing;
- receive your data in a machine-readable format.
To exercise these rights, write to us from the Contact us page; we reply within 30 days. If you believe your rights have been infringed, you can complain to the Commissioner for the Right to Information and Personal Data Protection (idp.al).
8. Data security
We use encrypted connections (HTTPS), restricted access to administration systems, verification against automated programs and regular backups. No system is 100% secure, but we work continuously to protect data from loss, misuse or unauthorised access.
9. Children
The service isn’t directed at children under 16, and we don’t knowingly collect their data.
10. Changes to this policy
We may update this policy when the service or the law changes. The date of the latest update is shown at the top of the page.