Privacy Policy

1. Overview

Two Credits SHPK ("Two Credits", "we", "our", "us") is a multi-disciplinary consulting studio based in Lezhe, Albania. We work with clients across strategy, technology, marketing, and commercial advisory. This Privacy Policy explains what personal information we collect when you visit twocredits.com (the "Site"), interact with us by email or phone, engage us as a client, or work with us as a prospect, partner, vendor, or applicant, and how we use, share, retain, and protect it.

We aim to write this policy in plain language. Where a section uses a legal or technical term, we explain what it means for you. If anything is unclear, contact us at hello@twocredits.com.

2. Data controller

For the purposes of applicable data protection law, including Regulation (EU) 2016/679 ("GDPR") where it applies extraterritorially, and Albanian Law No. 9887 on the Protection of Personal Data (as amended), the data controller is:

When we process information on behalf of a client under a written services agreement, that client is generally the controller and we act as a processor. In those cases, the client's own privacy notice governs how the personal data is collected from end users.

3. Scope

This policy applies to personal information we collect through the Site and in the course of our business relationships. It does not apply to third-party websites we link to, to personal information processed by clients within their own products, or to data we hold purely as a processor on behalf of a client under a separate data processing agreement.

4. Information we collect

We collect the categories of information described below. We keep collection to the minimum needed for the purpose.

4.1 Information you provide

• Identity and contact details, such as name, job title, company, email address, and phone number.
• Inquiry content, including the message body of any form submission or email you send us.
• Engagement information, such as scoping documents, requirements, meeting notes, and correspondence during a project.
• Billing and administrative information, such as invoicing details, VAT numbers, and payment references.
• Recruitment information, such as CVs, portfolios, and application details if you apply to work with us.

4.2 Information collected automatically

• Device and connection data, including IP address, browser type and version, operating system, screen size, and language.
• Usage data, such as pages viewed, referring URL, timestamps, and general interaction events.
• Approximate location derived from IP address (city or region level).
• Cookie identifiers and preferences, as described in the Cookies section below.

4.3 Information from third parties

• Business contact details from public professional sources, such as LinkedIn profiles or company websites.
• Information shared by mutual contacts who introduce you to us.
• Information from analytics, hosting, and email providers who help us operate.

We do not knowingly collect special categories of personal data (such as health or biometric data) through the Site. Please do not include such information in messages to us unless we have arranged a secure channel with you.

5. Sources of information

We collect information directly from you (through the Site, email, calls, meetings, and shared documents), automatically when you visit the Site, and occasionally from third parties such as introducers, public professional sources, and our service providers.

6. How we use information

• To respond to inquiries and provide information you request.
• To evaluate potential engagements and prepare proposals.
• To deliver, manage, and improve our services under a written engagement.
• To administer billing, accounting, and record keeping.
• To operate, maintain, secure, and improve the Site.
• To measure aggregated Site performance where you consent to analytics cookies.
• To send occasional operational or relationship communications where permitted, with an opt-out where required.
• To comply with legal, tax, and regulatory obligations, and to establish or defend legal claims.
• To review job applications and manage recruitment.

7. Legal bases (GDPR)

Where GDPR applies, we rely on the following legal bases:

• Contract: to take steps at your request before entering a contract, and to perform our services.
• Legitimate interests: to run and improve our business, secure the Site, communicate with prospects and clients, and pursue business development in a proportionate way.
• Consent: for optional analytics or marketing cookies, and for marketing emails where required. You can withdraw consent at any time.
• Legal obligation: to comply with tax, accounting, and other laws.

8. Sharing and disclosures

We do not sell personal information and we do not share it with third parties for their own independent marketing. We share information only in the following circumstances:

• With service providers that help us operate (hosting, email, analytics, cloud storage, productivity tools, accounting).
• With trusted collaborators or subcontractors engaged on a specific project, under confidentiality obligations.
• With clients, when your inquiry or interaction relates to a project we are delivering for them.
• With professional advisors, such as lawyers, auditors, and accountants.
• With authorities or other parties where required by law, court order, or to protect rights, safety, or property.
• With a successor entity in the context of a merger, acquisition, or reorganization, subject to equivalent protections.

9. Service providers

We use a small set of established service providers to run the Site and our operations, including cloud hosting and edge networking, email and calendar, cloud file storage, customer relationship management, and analytics. These providers act on our instructions under written terms that include confidentiality and security obligations. We can provide a current list on request.

10. International transfers

Some of our providers are located outside Albania and the European Economic Area. When personal information is transferred internationally, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, adequacy decisions where applicable, and additional technical and organizational measures. You can request information about the safeguards we use.

11. Cookies and tracking

A cookie is a small text file stored on your device. We use a small number of cookies and similar technologies (such as localStorage) in the following categories:

You can change your choice at any time through the "Cookie preferences" link in the footer. You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies may cause parts of the Site to stop working. Your current choice is stored locally in your browser under the key tc-cookie-consent.

12. Analytics

Where you consent to analytics, we use privacy-respecting tools to understand aggregated Site usage (for example, which pages are visited and general performance metrics). We configure these tools to minimize personal data, and we do not use them to build advertising profiles about you.

13. Retention

We keep personal information only as long as needed for the purpose we collected it for, plus the period required by law or reasonable business need.

• Inquiry emails and form submissions: typically up to 24 months, unless a relationship develops.
• Client engagement records and correspondence: for the duration of the engagement and for up to 10 years afterwards, in line with contractual, accounting, and tax requirements.
• Billing and accounting records: for the period required by applicable tax law.
• Website logs: typically up to 12 months.
• Recruitment records: up to 12 months after the decision, unless you agree to a longer period.

At the end of the retention period, we delete or anonymize the information so it can no longer be linked to you.

14. Security

We use reasonable technical and organizational measures to protect personal information, including access controls, encryption in transit, least-privilege administration, endpoint protection, backups, and vendor due diligence. No online service can guarantee absolute security. If we become aware of a personal data breach that meets the reporting threshold, we will notify affected individuals and authorities as required by law.

15. Your rights

Depending on where you live, you may have some or all of the following rights in relation to your personal information:

• Access a copy of the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete information, subject to legal exceptions.
• Restrict or object to certain processing, including for direct marketing or based on our legitimate interests.
• Portability of information you provided, in a structured, commonly used format, where technically feasible.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with a supervisory authority, including the Albanian Information and Data Protection Commissioner (IDP), or your local EEA authority.

To exercise any of these rights, email us at hello@twocredits.com. We may need to verify your identity before acting on a request. We will respond within the timeframe required by applicable law (usually within one month).

16. Children

The Site is not directed to children under 16 and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

17. Automated decision-making

We do not use your personal information to make automated decisions that produce legal or similarly significant effects on you.

18. Third-party links

The Site may reference or link to third-party websites and services. We are not responsible for their content or privacy practices. When you leave the Site, review the privacy notice of the destination.

19. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top. Material changes will be highlighted on the Site or communicated to you where appropriate.

20. Contact

Questions, requests, or complaints about this policy or our handling of personal information can be sent to: