Privacy Policy
What this site collects, why it collects it, who else sees it, and what you can ask us to do about it.
Last updated: 23 September 2026
Who is responsible
This site is operated by Marketing Chains LLC, a Delaware limited liability company trading as Kastriot Tanaj at kastriottanaj.com. The company is the data controller for everything described here. Kastriot Tanaj runs it from Pristina, Kosovo, and the servers are in Germany.
Email: kastriot@kastriottanaj.com
Phone: +383 48 111 611
Registered office: 8 The Green STE R, Dover, DE 19901, United States, c/o Resident Agents Inc.
Post sent there reaches our registered agent rather than us directly, so email is much the faster route for anything about your data.
The contact form
When you send the form on the contact page we receive your name, email address, the service you selected and your message. Along with it the server records your IP address, your browser's user-agent string and the page that referred you.
That record is written to a database on our own server and emailed to us. The email is a notification; the database is the copy that lasts, so a bounce or a spam folder is never the difference between you writing to us and us never knowing.
Why: to answer you and to take steps you asked for before a possible contract. The IP, user-agent and referrer are kept for security and abuse prevention, which is our legitimate interest in keeping the form usable.
The newsletter
Subscribing stores your email address, the page you subscribed from, your IP address, your user-agent and the relevant timestamps. Nothing is ever sent to an address that has not confirmed itself: you receive a confirmation link first, and the subscription only becomes real when you click it.
Confirmed subscribers are also passed to MailerLite, which delivers the emails on our behalf. Every email carries an unsubscribe link, and unsubscribing takes effect immediately.
Why: your consent, which you can withdraw at any time.
Analytics and advertising cookies
Nothing optional runs until you choose. The banner you saw on your first visit sets Google Consent Mode to denied by default, and the Meta Pixel's script is not even downloaded until you accept — so rejecting is not a promise, it is the absence of a request.
If you accept, two things are switched on:
- Google Analytics 4 — how people find and move through the site, in aggregate.
- Meta Pixel (ID 1616830733405682) — measuring and personalising advertising.
With advertising consent given, a lead you submit is also sent to Meta's Conversions API from our server. Your email address and name are hashed before they leave the server, so Meta receives an irreversible fingerprint rather than the values themselves. Your IP address and user-agent are sent as they are, together with Meta's own _fbpand _fbc cookies where they exist. Without advertising consent, none of this is sent.
Why: your consent. You can change it at any time with theCookie settings link in the footer of every page.
Spam protection and server logs
Every form carries a hidden field that real people never fill in, and submissions are rate-limited per IP address. Cloudflare Turnstile may also be used to tell people from bots; where it is, Cloudflare receives your IP address and a token for that check alone.
The web server keeps standard access logs — IP address, timestamp, the URL requested, the referrer and the user-agent — which roll over automatically.
Why: our legitimate interest in keeping the site up and free of abuse.
What this site does not do
- Fonts are served from this domain. Visiting a page sends no request to Google Fonts and discloses nothing to them.
- We do not sell personal data, and we do not buy it.
- There is no automated decision-making and no profiling that produces legal effects.
Who else processes your data
- Hetzner — the server the site and its database run on. Germany, so the data itself never leaves the EU.
- Hostinger — outgoing email for form notifications and confirmations.
- MailerLite — newsletter delivery. Established in Lithuania, and its own sub-processors are in the EU.
- Google — Analytics, only with consent. United States.
- Meta — Pixel and Conversions API, only with consent. United States.
- Cloudflare — Turnstile bot checks. United States.
The processors that hold your data at rest — the server and the newsletter platform — are in the EU, so the contact form and the subscriber list stay inside it. The analytics, advertising and bot-check providers are in the United States, and those transfers rest on the data processing terms each one publishes, which incorporate the European Commission's Standard Contractual Clauses. Nothing reaches Google or Meta at all unless you accept the optional cookies.
The two that hold your data at rest each do so under a written agreement of the kind Article 28 requires: Hetzner's accepted in their customer portal, MailerLite's concluded as part of their Terms of Use. The US providers' processing terms, including the Standard Contractual Clauses, apply through their own terms of service.
How long it is kept
- Contact form enquiries — 24 months after our last contact with you, then deleted.
- Newsletter subscribers — until you unsubscribe. Unconfirmed subscriptions are discarded rather than kept.
- Server access logs — rolled over on a short cycle, not archived.
- Analytics and advertising data — held by Google and Meta under their own retention settings.
Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how it is used, or hand it to another provider in a portable form. Where processing rests on consent, you can withdraw that consent at any time — for cookies through the footer link, for the newsletter through any unsubscribe link — and withdrawing it does not affect what was lawful beforehand.
Email kastriot@kastriottanaj.com and we will answer within one month.
If you think we have handled your data badly you can complain to a data protection supervisory authority — in the EU, the one where you live or work.
Changes
If this policy changes, the date at the top changes with it. Material changes to anything resting on your consent will be asked for again rather than assumed.
See also the Terms & Conditions.