Privacy, Cookies, and Accessibility Policy

1. Introduction

EMSA N.P. (“we”, “EMSA”) attaches particular importance to the protection of your personal data. This Policy explains what data we collect, how we use it, with whom we share it, and what your rights are.

This Policy is in compliance with:

• Regulation (EU) 2016/679 — GDPR, which applies when we process data of persons in the EU/EEA;
• Law No. 06/L-082 on the Protection of Personal Data in Kosovo;
• ePrivacy Directive 2002/58/EC on cookies and similar technologies.

2. Data Controller

For privacy matters, you can contact us directly at: info@emsaks.com.

3. Personal Data We Collect

We collect the following data:

3.1. Data you provide directly

• First and last name;
• Delivery and billing address;
• E-mail address;
• Phone number;
• Payment data, which are encrypted and not stored by us;
• Messages and requests sent via contact forms.

3.2. Data collected automatically

• IP address;
• Browser type and version;
• Operating system;
• Pages visited and duration of the visit;
• Referral source, i.e., how you found our site;
• Cookie identifiers, as explained in Section 9.

3.3. Data from third parties

We may receive data from payment platforms or social networks only if you provide permission or if this is necessary for the provision of the service.

4. Purpose and Legal Basis of Processing

Purpose	Legal basis according to GDPR, Article 6
Order execution and delivery	Performance of a contract, Article 6.1.b
Account management	Performance of a contract, Article 6.1.b
Order status notification	Performance of a contract, Article 6.1.b
Tax and accounting obligations	Legal obligation, Article 6.1.c
Fraud protection	Legitimate interest, Article 6.1.f
Newsletter and direct marketing	Consent, Article 6.1.a
Site analysis with analytical cookies	Consent, Article 6.1.a
Necessary cookies	Legitimate interest and/or performance of the service

5. Sharing Data with Third Parties

We do not sell your personal data. We may share them only with:

• Shipping providers, only for the data necessary for delivery, such as name, address, and phone number;
• Payment processors, through authorized platforms and with SSL encryption;
• Cloud/hosting service providers, on secured servers within the EU or with adequate guarantees;
• State authorities, only when required by law, for example by the Tax Administration;
• Google Analytics or analytical plugins, only with your consent and with anonymized IP.

All external processors are contractually bound to maintain confidentiality and to treat data only according to our instructions.

6. International Data Transfer

If your data are transferred outside of Kosovo or the European Economic Area (EEA), we guarantee adequate protection through:

• Adequacy decisions of the European Commission;
• Standard Contractual Clauses (SCC) of the European Commission;
• Other mechanisms approved by law.

7. Data Retention Period

Category	Retention period
Order and invoice data	10 years, according to legal tax obligations
User account	Until deletion + 30 days backup
Newsletter / marketing	Until withdrawal of consent
Analytical cookies	Maximum 13 months
Security logs	90 days
Contact requests	2 years

8. Your Rights

According to GDPR and Law No. 06/L-082, you have the following rights:

• Right of access: you can request confirmation as to whether we process your data and a copy thereof.
• Right to rectification: you can request the correction of inaccurate data.
• Right to erasure (“right to be forgotten”): you can request the deletion of data when there is no legal reason for their retention.
• Right to restriction of processing: you can request the restriction of processing in certain circumstances.
• Right to data portability: you can receive your data in a structured format, such as JSON or CSV, and transfer them to other operators.
• Right to object: you can object to processing based on legitimate interest or for direct marketing purposes, with immediate effect.
• Right not to be subject to automated decision-making: we do not perform automated profiling with legal effects.

Exercise of rights: Send a written request to info@emsaks.com. We will respond within 30 calendar days.

If you are not satisfied with the response, you can file a complaint with:

If you are an EU resident, you also have the right to complain to the supervisory authority of your EU state.

9. Cookies and Tracking Technologies

9.1. What are cookies?

Cookies are small text files that are stored on your device when you visit our site. They help us provide the functionality of the site and analyze its use.

9.2. Types of cookies we use

Necessary cookies

These cookies are always active. They are necessary for the functioning of the site and cannot be deactivated.

Cookie	Purpose	Term
wordpress_logged_in_*	Login session	Session
woocommerce_cart_hash	Cart identification	Session
woocommerce_items_in_cart	Number of items in cart	Session
wp_woocommerce_session_*	Purchase session	2 days
PHPSESSID	Server session	Session
cookie_consent	Storage of cookie preferences	12 months

Analytical cookies

These cookies require your consent. They help us understand how visitors use our site.

Cookie	Provider	Purpose	Term
_ga	Google Analytics	Visitor distinction	13 months
_ga_*	Google Analytics	Session storage	13 months
_gid	Google Analytics	Visitor distinction for 24 hours	24 hours

Google Analytics is configured with IP anonymization and without data sharing with Google. For more, see Google’s privacy policy: policies.google.com/privacy.

Marketing cookies

These cookies require your consent. They can only be activated with your express consent.

Cookie	Provider	Purpose	Term
_fbp	Meta/Facebook Pixel	Targeted advertising	90 days
fr	Meta/Facebook	Advertising	90 days

9.3. Cookie Management

When you visit the site for the first time, a cookie banner appears where you can:

• Accept all cookies;
• Reject non-essential cookies;
• Personalize preferences by category.

Preferences can be changed at any time by clicking “Cookie Preferences” at the bottom of the page.

You can also manage cookies through your browser:

• Chrome
• Firefox
• Safari
• Edge

10. Data Security

EMSA N.P. implements appropriate technical and organizational measures for the protection of your data:

• SSL/TLS encryption for all communications;
• Restricted employee access according to the “need to know” principle;
• Secured servers with periodic backup;
• Continuous security monitoring;
• Regular staff training on data protection.

In case of a high-impact security breach, we will notify you within 72 hours according to GDPR.

11. Accessibility

EMSA N.P. is committed to making the site emsaks.com accessible to all users, including persons with disabilities.

11.1. Applied standard

We aim to meet the requirements of the Web Content Accessibility Guidelines (WCAG) 2.1, Level AA, according to the European Accessibility Act (Directive EU 2019/882), which entered into force for the private sector from June 28, 2025.

11.2. Implementation measures

• Correct HTML semantic structure;
• Alternative text (alt text) for all relevant images;
• Sufficient color contrast with a minimum ratio of 4.5:1;
• Full navigation via keyboard;
• Full labeling of forms;
• Text size adapted by the browser.

11.3. Reporting accessibility issues

If you encounter difficulties in accessing any part of the site, please contact us:

We will try to provide you with the requested information in an alternative format and resolve the issue within 10 business days.

11.4. Known limitations

Some older PDF documents may not be fully accessible. We are working on their progressive correction.

12. Links to Other Sites

Our site may contain links to third-party sites. EMSA N.P. is not responsible for the privacy practices or the content of those sites. We encourage you to read the privacy policies of every site you visit.

13. Policy Changes

This Policy may change from time to time. Substantial changes will be communicated through:

• E-mail notification for customers with accounts;
• Informational banner on the site.

The “effective date” at the top of the document indicates the latest version.

14. Contact and Supervisory Authority

Supervisory Authority — Kosovo

Information and Privacy Agency (AIP)
www.aip-ks.org

ODR Platform — EU

https://ec.europa.eu/consumers/odr