Privacy Policy & Terms and Conditions

I. PURPOSE OF THIS RECRUITMENT PRIVACY NOTICE

I.1. This Recruitment Privacy Notice (“Privacy Notice”) explains how IuteCredit Albania SH.A (“Iute“, “we“, “us“) manages its employer branding and recruitment process through its career site https://iute.al/en/jobs/ via email and through recruitment agencies and other recruitment channels i.e. LinkedIn and processes the personal data of candidates we contact and applicants that apply to a position (“you”) in connection with our recruitment processes.

I.2. Please read this Privacy Notice carefully before submitting your personal data to us. By providing your personal data, you acknowledge that you have read, understood, and agreed to the terms outlined in this Privacy Notice regarding the use of your information.

II. WHO WE ARE

II.1. For the purpose of the General Data Protection Regulation (“GDPR”) and the Law 124 /2024 “On Personal Data Protection” (herein “the Law 124 /2024”) , the data controller is IuteCredit Albania SH.A, a company registered in Albania, with registered address at “Andon Z. Cajupi” str., Building 3, Entrance 2, Zip code 1001, Tirana, Albania. If you have any comments or questions about this Privacy Notice or the processing of your personal data, please contact us at .

II.2. Our Data Protection Officer can be contacted at .

III. PERSONAL DATA WE COLLECT

III.1 We may collect and process the following categories of personal data depending on your interaction with us regarding or during recruitment processes:

Purpose	Data types	Lawful Basis
Application handling and candidate communication	CV, cover letter, work samples, contact details, salary expectations, interview and assessment data, communication content, application history	Legitimate interest – to assess your suitability and manage the recruitment process, including communication with you about vacancies
AI-based analysis and video interviews	CV content, video or audio recordings, AI-generated summaries or scores	Legitimate interest – to enhance the consistency and efficiency of candidate evaluation; additional safeguards apply where automated processing is involved
Sourcing and profiling	Publicly available profiles (e.g. LinkedIn), referrals, communications, CVs sourced via third parties	Legitimate interest – to identify, evaluate, and maintain contact with prospective candidates
Website or recruitment channel operation and analytics	IP address, browser type, device information, session behavior, technical logs, cookies	Legitimate interest – to operate, secure, and improve our recruitment channels; Consent – for cookies where legally required
Surveys and user feedback	Contact details, communication content	Legitimate interest – to gather insights and improve the recruitment process
Reference and background checks	Reference contact details, feedback from referees	Legitimate interest – to verify candidate suitability
Pre-contractual and contractual documentation	Identification info, employment history, academic data, signed offers, CVs, background documents	Necessary for entering into or performing an employment contract
Legal obligations and rights protection	Any data relevant to the context, including contact details, application data, interview notes	Legitimate interest — to establish, exercise, or defend legal claims and ensure compliance with legal obligations

IV. SOURCES OF PERSONAL DATA

IV.1. Most of the information we process is provided by you – when you apply for a position, communicate with us, or participate in interviews or assessments. This includes your CV, cover letter, salary expectations, and any other details you choose to share.

IV.2.When you visit our career site or recruitment webpage, we may collect technical and statistical data such as your IP address, browser type, session behavior, and other device-related information. This helps us understand how our site is used and improve its performance. For more details, see our Cookie Policy.

IV.3. We may collect professional information from publicly available sources such as LinkedIn, job boards, or the website of your current employer.

IV.4 We may receive your data through:

Referrals from Iute employees or external contacts;
Recruitment agencies, who act as data controllers before submitting your application to us;
References you have listed, from whom we may collect information to verify your background.

IV.5. We generate additional data during the recruitment process, such as interview notes, assessment results, and communication records between you and our team.

V. SHARING PERSONAL DATA

V.1. We may share your personal data with trusted third-party processors where necessary to support our operations and deliver services. These include:

Service providers supporting our employer branding and recruitment activities (i.e. EPPC);
Legal or regulatory authorities when required by law.

V.2All third-party service providers are contractually bound by strict data processing agreements (DPAs) and are required to comply with applicable data protection laws.

V.3. We do not sell, rent, or otherwise commercially share your personal data with third parties under any circumstances.

VI. INTERNATIONAL DATA TRANSFERS

VI.1. As a general rule, we do not transfer your personal data outside the EU/EEA, unless this is necessary for the recruitment process or for the use of service providers.

VI.2. This includes transfers to countries with an adequacy decision from the European Commission or under standard contractual clauses or equivalent safeguards that ensure your data remains protected.

VI.3. We also implement appropriate technical and organizational measures to secure your data during and after transfer, based on what is effective and technically feasible.

VI.4. If you would like more information about these transfers or the safeguards in place, please contact us using the details provided below.

VII. DATA RETENTION

VII.1. We retain personal data only as long as necessary for the purposes described above and in accordance with applicable local law. Unless a different period is required by law or justified by the recruitment process, the following retention periods apply:

General recruitment enquiries or contact form submissions: up 6 months.
Job applications: up to 6 months after the recruitment process ends.
Cookie data: refer to Cookie Policy.

VII.2. We may retain data longer where legally required or if necessary to resolve disputes or enforce agreements.

VII.3. If no specific retention period is stated, we determine the appropriate timeframe based on the nature of the data and the purpose for which it was collected.

VIII. YOUR RIGHTS AS A DATA SUBJECT

VIII.1. To the extent required by applicable data protection regulations, you have all the rights of a data subject as regards your personal data. Such rights include the following:

Right to access – know what personal data we hold and obtain a copy.
Right to rectification – correct inaccurate or incomplete data.
Right to erasure (“right to be forgotten”) – request deletion under certain conditions.
Right to restrict processing – suspend processing under specific circumstances.
Right to data portability – receive your data in a structured, commonly used format.
Right to object – to processing based on legitimate interest.
Right to withdraw consent – at any time without affecting past lawful processing.
Right to lodge a complaint – with us or a supervisory authority (see below).

VIII.2. We will respond to your request within one month in accordance with the GDPR. No fee is required unless requests are unfounded or excessive.

To exercise your rights, you can contact us at .

IX. LODGING A COMPLAINT

IX.1. If you believe your rights have been violated, you can contact us at or fill the related form at our website Complaints and proposals or lodge a complaint with the competent data protection supervisory authority in Albania:

Email:
Website: idp.al

CHANGES TO THIS NOTICE

1. We reserve the right to update this Privacy Notice. All changes will be made available through our website www.iute.al and significant changes will be communicated where required by applicable law.

Last updated: 10 July 2026