1. Data controller
The data controller is Shoqata e Rehabilitimit Fizik për Personat me Aftësi të Kufizuar (SHRFPAK), a non-profit organization / association registered in Albania under Registration Number / TIN L42312451R, with registered headquarters at Rruga E Kavajës Nr. 169, Tiranë 1001, Albania. Compliance and data protection enquiries must be addressed to info@shrfpakrehab.store or +355 69 587 7111.
2. Data we collect
Website visitors: the information you voluntarily submit through our contact form or by writing to our official email — your name, email address, telephone number, subject and message — together with basic technical data generated by your browser, such as your IP address and the pages requested, used for the security and stability of the website.
Beneficiaries of our services: identification and contact details, age, information on the disability or condition, relevant medical history, clinical assessment results, the individual rehabilitation plan and session records, assistive devices issued, and, where relevant to eligibility for subsidised care, documentation of economic situation.
Members, volunteers, trainees, donors and partners: identification and contact details, membership or agreement records, training participation and certificates, and the records required for the lawful accounting of donations and grants.
3. Purposes and legal bases
We process personal data in order to respond to enquiries; to assess, plan and deliver rehabilitation services; to provide and register assistive devices; to organise community, vocational and training activities; to administer membership, volunteering and partnerships; to comply with the accounting, reporting and statutory obligations of a non-profit association in Albania; and to protect the security of our premises, systems and records.
The legal bases are the explicit consent of the data subject, the performance of the service relationship or agreement, our legal obligations under Albanian law, and the legitimate interests of the association in operating and safeguarding its activities. Health-related data is processed only with explicit consent and only for the purposes of care and rehabilitation.
4. Confidentiality of health information
Clinical records are accessible only to the practitioners directly involved in the beneficiary's care, to their clinical supervisor, and to the administrative staff strictly necessary for scheduling and record-keeping. Trainees may access records only under supervision and after signing a confidentiality undertaking. Clinical information is never used in publications, presentations, photographs or campaigns in a form that identifies a person without that person's separate, written consent.
5. Sharing of data
We do not sell, rent or trade personal data. Data is shared only where necessary: with a health institution or specialist when the beneficiary requests or consents to a referral; with public authorities when required by Albanian law; with our auditors and, in anonymised or aggregated form, with donors and grant-makers for reporting purposes; and with service providers acting on our instructions, such as our email and website hosting providers, who are bound by confidentiality.
6. Retention
Contact-form and email correspondence is retained for as long as needed to handle the enquiry and to document our response. Beneficiary clinical records and device registers are retained for the period required by applicable health and archival rules. Accounting and grant records are retained for the period required by Albanian legislation. When a retention period ends, records are securely deleted or anonymised.
7. Security
Paper records are held in locked storage at our headquarters. Electronic records are held on access-controlled accounts with individual credentials, and access rights are limited to the role of each member of staff. Staff, trainees and volunteers are bound by confidentiality obligations. Security incidents affecting personal data are investigated by the administrative office and reported to the Executive Board and, where required, to the competent authority and the individuals concerned.
8. Your rights
You have the right to be informed about the processing of your data; to access your data and obtain a copy; to request correction of inaccurate data; to request deletion where there is no overriding legal or clinical obligation to retain it; to request restriction of processing or to object to it; and to withdraw your consent at any time without affecting the lawfulness of processing already carried out. Requests are made to info@shrfpakrehab.store or +355 69 587 7111 and receive a written answer.
9. Cookies and website technologies
This website uses only the technical means necessary to deliver its pages securely and to load web fonts. We do not use advertising cookies and we do not build behavioural profiles of visitors. Your browser settings allow you to restrict or delete cookies at any time.
10. Children and vulnerable persons
Where a beneficiary is a minor or a person under guardianship, consent is obtained from the parent or legal representative, and information is presented in a form the beneficiary can understand and participate in to the greatest extent possible.
11. Changes and contact
This policy may be updated to reflect changes in our activities or in applicable legislation; the current version is always published on this page. For any question concerning this policy or the processing of your data, contact Shoqata e Rehabilitimit Fizik për Personat me Aftësi të Kufizuar (SHRFPAK), Rruga E Kavajës Nr. 169, Tiranë 1001, Albania, telephone +355 69 587 7111, email info@shrfpakrehab.store.