Privacy

Privacy Policy

What I collect, why, and what you can do about it.

Last updated: 30 August 2026

This policy explains what personal data Josei.Agency collects, why, and what you can do about it. It's written to be readable rather than impressive.

Who is responsible for your data

Josei.Agency is operated by Xhesika Tufa, working as an independent sole trader across Tirana, Albania and Madrid, Spain.

Contact for any data question: [email protected]
Postal address available on request.

What I collect, and why

What	When	Why
Name, email, company, website	You submit a contact or enquiry form	To reply to you and, if we work together, to deliver the service
Message content	You write to me through a form or by email	To understand and answer your enquiry
Email address only	You subscribe to blog updates	To send you new posts. Nothing else.
Name, email, meeting details	You book a consultation	To schedule and hold the call
Usage data — pages viewed, referrer, approximate location, device	You browse the site with analytics cookies accepted	To understand which content is useful
Client project data	We work together	To do the work you hired me for

Legal basis

Consent — blog subscriptions and any non-essential cookies. You can withdraw it at any time.
Contract — data needed to deliver a service you've engaged me for.
Legitimate interest — responding to an enquiry you sent me, and keeping the site secure and working.
Legal obligation — invoices and records I'm required to keep.

Who else processes your data

I'm one person, so I use third-party tools to run the business. Each of these may process your data on my behalf:

Service	What it handles
Web3Forms	Delivers form submissions to my inbox
HubSpot	CRM — stores enquiries and website analytics
Calendly	Consultation bookings
Google (Analytics & Search Console)	Website traffic and search performance
Hostinger	Website hosting and server logs
Google Fonts	Typography — may log your IP when fonts load

I don't sell your data, and I don't share it with anyone for advertising.

Where your data goes

Some of these providers are based outside the EU, including in the United States. Where that happens, transfers rely on the safeguards those providers have in place — typically Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long I keep it

Enquiries that don't become work — up to 12 months, then deleted.
Client records — for the duration of our work plus 5 years, for legal and accounting reasons.
Blog subscribers — until you unsubscribe.
Analytics — according to each provider's retention settings, typically no more than 14 months.

Your rights

Under GDPR you can ask me to:

Tell you what data I hold about you
Correct anything that's wrong
Delete your data
Restrict or object to how I use it
Send you a copy in a portable format
Withdraw consent you previously gave

Email [email protected] and I'll respond within 30 days. There's no charge. If you're unhappy with how I've handled it, you can complain to your national data protection authority — in Spain that's the AEPD, and in Albania the IDP.

Security

The site runs over HTTPS, access to accounts is protected, and I keep the number of tools handling your data as small as I reasonably can. No system is perfectly secure, but I don't collect data I don't need.

Children

This is a business-to-business service. It isn't directed at anyone under 16, and I don't knowingly collect their data.

Changes

If this policy changes materially, I'll update the date at the top. Worth a glance if you're a returning client.