INFORMATION TRAIL / CASE BY CASE
Kosovo personal-data requirements need current, project-specific review. The technical contribution is to expose purpose, roles, access, vendors, transfers, retention, rights, security, and incident paths so the accountable people can make and implement informed decisions.
Explain why each field is needed and who receives it. Choose Albanian or Serbian notice language with a qualified reviewer. Keep optional information visibly optional and avoid sensitive details in ordinary email where a safer path is required.
Operators need the minimum view required for their task. Separate assignment, notes, attachments, approvals, exports, and administration. Record important actions without giving every team member unrestricted visibility.
List hosting, email, analytics, files, support, payment, backups, monitoring, and any AI service. For each, name purpose, data categories, access, locations and transfer questions, subprocessors, contract owner, and exit method.
Closing a service case does not automatically remove its copies. Define retention for the core record, messages, documents, logs, exports, backups, and abandoned requests. Build a deletion or anonymisation procedure that can be tested.
Decide where a person asks for access, correction, restriction, deletion, or another applicable right; how identity is checked; who searches each system; and who approves the response. Separately, define how suspicious access, disclosure, loss, or vendor incidents are detected, escalated, investigated, and communicated.
This site has a dedicated GA4 property and records voluntary phone and email link actions. The separate property helps attribute activity to this site, but any applicable notice, consent, vendor, transfer, retention, or rights analysis still remains. Advertising and profiling are not silently added.