REGULATION ON PRIVACY AND PROTECTION OF PERSONAL DATA

INTRODUCTION

Plus Communication Sh.A. (hereinafter shortly referred to as "PLUS" ) is a joint stock company registered with the National Registration Center with NUIS no. K91811014B, established on 10.06.2009, operating in the field of electronic communications regularly notified on the basis of general authorization regime and registered in the Entrepreneurs’ Register published by Authority of Electronic and Postal Communications.

The continuous development of information networks and communication systems has resulted in the placement of subscribers’ personal data in matters of primordial importance and PLUS commitment to fulfill any and all obligations for the protection of personal data deriving from the legal and sublegal framework in force.

Therefore, PLUS has drafted, approved and published the Regulation on the Protection of Privacy and Personal Data among other for the information regarding the collection and processing of personal data by PLUS.


1 . DEFINITIONS
1.1. "Personal information" is any information about a person, identified or identifiable, directly or indirectly, in particular by reference to an identification number or one or more factors specific to his physical, physiological, mental, economic, cultural or social identity.
1.2 "Processing of Personal Data" is any action or set of actions, which are performed on personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, restoration, consultation, use, transmission, disclosure or otherwise made available, extension or combination, photography, reflection, dumping, filling, selection, blocking, erasure or destruction, even if they are not registered in a database.
1.3 "Sensitive Information" is any information about a natural person that has to do with its origins, race or ethnic origin, political opinions, trade union membership, religion, religious or philosophical beliefs, criminal prosecution, as well as any information on health and sexual life.
1.4 "The communications traffic data" means any data processed for the purpose of transmitting communications in an electronic communications network or for billing purposes.

2. TYPE OF PERSONAL DATA PROCESSED FROM PLUS
PLUS will get from its subscribers the data foreseen in article 129 of Law no. 9918 dated 19.05.2008 "On Electronic Communications in Republic of Albania", including but not limited to: name, surname, address, unique identification number of the subject (if there is any), fix telephony number, access number, e-mail address and other contact information of any kind.
PLUS does not process sensitive data defined under Article 3 of Law no. 9887, dated 10.03.2008 "On Protection of Personal Data".


3. GENERAL PRINCIPLES OF PERSONAL DATA PROCESSING
3.1. The protection of personal data is guaranteed by a fair, just and legitimate processing of these data from PLUS in order to fulfill its contractual or legal obligations arising from the Subscription Contract signed between the parties, as well as the increase of the services quality towards the subscribers.

3.2. PLUS operates in accordance with the legal principles to the processing of personal data, as provided by the Law no . 9887, dated 10.03.2008 "On Protection of Personal Data", as amended and no. 9918, dated 19.05.2008 "On Electronic Communications in Republic of Albania", as amended, and the relevant regulatory framework in force.

3.3. Access and request to correct or erase
3.3.1 The subscriber has the right to request in writing and free of charge in order to obtain from PLUS the following:
a) confirmation of whether the personal data are processed or not, information on the processing of the information, for the categories of data processed and the recipients or categories of recipients to whom the data are disclosed;
b) in an understandable form, personal data and the information available for their source;
c) in the case of automated decisions, information about the logic involved in the decisionmaking.
3.3.2 Within 30 days from the date of receipt of the request PLUS shall inform the subscriber on his/her/its request and the information on data is communicated in the form in which they were at the time the request was made. If information is not given, PLUS shall explain to the subscriber the reasons for withholding the information.
3.3.3 The Subscriber is entitled to request in writing and free of charge the blocking, correction or deletion of data when it finds that his/her data are not fair, true, complete, or are processed and collected in violation of the provisions of Law no. 9887, dated 10.03.2008 "On protection of personal data" as amended.
3.3.4 Within 30 days from the date of receipt of the request PLUS shall inform the Subscriber on lawful data processing, the performance or non-performance of blocking, correction or erasure of the data.

3.4. The consent of the subscriber
3.4.1. Unless the data processing is carried out in fulfillment of the legal requirements stipulated in Article 6 of Law no. 9887, dated 10.03.2008 "On Protection of Personal Data", as amended, the consent of the Subscriber shall be obtained before processing of his/her data. Such consent shall be expressly and according to its free and entire will of the Subscriber.
3.4.2. The Subscriber has the right not to be part and object at any time, in a simple and free of charge manner, the processing of his/her personal data for direct marketing purposes.
PLUS obtains prior written consent of the Subscriber whose personal data are processed for the above purpose. The Subscriber has the right to withdraw its consent to the foregoing.
3.4.3. In case the personal information will be transferred to third parties, PLUS undertakes to inform the Subscriber on;
(i) the recipient of the data and the purpose of its disclosure;
(ii) the abovementioned rights of Subscriber defined in paragraph 3.4.2.

3.5. The disclosure of personal data to third parties
3.5.1. The disclosure of personal data to third parties will only be made in accordance with law and legal framework applicable to the processing of personal data, as well as the fulfillment of its contractual obligations by PLUS. Third parties shall preserve the confidentiality and credibility of the subscribers’ personal data.

3.5.2. Specifically, PLUS is legally bound to disclose personal data based on the specific requirements of state institutions, including the judiciary and prosecution authorities, in accordance with the relevant provisions of the Albanian legislation.
3.5.3. PLUS undertakes to maintain and administer, for a two-year term, the files of the subscribers’data. The data in these files are stored according to the legislation on personal data protection. These files shall be made available without delay, in electronic form, to the authorities prescribed in the Criminal Procedure Code, based on their request.
3.5.4. The legal interception of the electronic communications is made ​​in accordance with applicable legislation, namely Article 131 of Law no. 9918, dated 19.05.2008 "On Electronic Communications in the Republic of Albania", amended and Law nr.9157, dated 04.12.2003 "On the Interception of Electronic Communications".

4. NETWORK AND SERVICES SECURITY, DATA AND PRIVACY PROTECTION
4.1. Data on communication traffic
4.1.1 The data of the subscriber’s traffic processed or stored by PLUS should be deleted or become anonymised as soon as they are no longer needed for message transferring.
4.1.2 PLUS can store and process traffic data necessary for billing and interconnection payments until completion of payments.
4.1.3 For purposes of electronic communications services marketing or for the provision of value added services, PLUS can process traffic data only after prior acceptance by the subscriber. Subscribers must be informed of the type of traffic data that is processed, before giving their consent to processing. Subscribers have the right to withdraw at any time from the approval they have granted.
4.1.4. PLUS shall specify in the contract the mode, time limit and processing manner, as well as the declaration to maintain this information pursuant to this law.
4.1.5. Traffic data may be processed only by responsible persons authorized by PLUS, who are responsible for billing or traffic management, customer service, marketing electronic communications services, fraud detection, or providing value added services, while the processing data traffic will be limited solely to the development of PLUS activity.
4.1.6. PLUS is obliged to destroy the stored data at the end of the retention period, unless otherwise provided in the legislation.

4.2. PLUS will undertake the necessary technical and organizational measures, to maintain network security and/or services provided, in order to protect the rights and freedoms of subscribers, privacy and security of movement/free movement of such data and services.
4.2.1. PLUS authorized persons and employees who become aware of the processed data in the exercise of their functions are bound by confidentiality/privacy and of personal data confidentiality for duration of their contractual or legal relationship as well as after the termination of their functions at PLUS.
4.2.2. PLUS uses modern technology to protect, as well as physically and electronically secure the privacy/confidentiality of subscriber’s personal data, as well as to prevent the unauthorized access or unauthorized access to electronic communications systems and in any case of unauthorized personal data processing, PLUS informs immediately the Commissioner, in case of or suspected threatened of subscribers personal data security.

4.3. PLUS may collect, process and use subscribers data when such data are directly indicated for providing electronic communications services and/or to maintain network and equipment normal functioning as well as detection and tracking of "disturbing" calls, as provided by requirements of Chapter XI and following of the law no. 9918, dated 19.05.2008 "On electronic communications in the Republic of Albania".

4.4. PLUS will process and provide information on the subscriber location in case of emergency calls, including when prior consent is not obtained or the case of temporary withdrawal from the processing.

5. COMPLAINTS AND CLAIMS HANDLING
5.1. Subscriber can submit complaints and requests concerning the protection of personal data in the form defined by PLUS in the Subscriber Contract published on its website, which can be sent to PLUS:
a. by mail at:
Plus Communication Sh.A.
Rr."Ibrahim Rugova", Godina e Re pranë Gardës së Republikës, kati i dytë, Tirana;
b. By fax at +355 (0) 42382700;
c. by email at: complaints@plus.al or infoklienti@plus.al.

5.2 PLUS will accept subscriber complaints, requests and suggestions in its points of sales or through its representatives in the areas where the service is provided.

5.3. Within 30 days from the receiving complaint or request date, PLUS informs the subscriber on his/her/its information and data request is communicated to the subscriber in the form in which they were at the time the request is made. In case the information is not given, PLUS should explain to the subscriber the reasons for withholding the information.

5.4. PLUS should send in writing to the subscriber the answer via:
a. mail;
b. fax, or
c. online.

5.5. PLUS will retain, preserve and archive a register of subscriber complaints, requests, suggestions PLUS has received as well as the answers to the subscriber archiving files containing complaints, requests, suggestions, responses, decisions and measures taken within 12 months.

5.6. If access is denied or not given or correction or erasure of personal data is not performed, or any other complaint associated with them, the subscriber as subject of his/her/its personal data has its own right to appeal or to inform the Commissioner for the Protection of Personal Data to protect its rights. Following this complaint, in accordance with the Civil Procedure Code, the subscriber may initiate court proceedings.

***