Privacy Policy

Last updated: 14 October 2026

1. Who we are

MCA Architecture (“we”, “us”) is an architecture and interior design studio in Tirana, working on residential, hospitality and commercial spaces. We offer space planning, concept design, material and colour selection and project supervision. For the personal data processed through this website (mcarchitecture.al) and in providing our services, we are the controller.

Address: Rruga Milto Tutulani, Tirana 1001, Albania
Email: mcarchitecture89@gmail.com
Phone: +355 69 528 4886

2. Legal framework

We process personal data in line with Law No. 124/2024 “On the protection of personal data” of the Republic of Albania and the guidance of the Information and Data Protection Commissioner. This policy explains what data we collect, why we collect it, how long we keep it and what rights you have.

3. What data we collect

Category	What it includes	How we get it
Enquiry data	Name, email address and your message	When you use the contact form, email us, call us or message us on WhatsApp or Instagram
Project data	Phone number, address of the property, plans, measurements, photos of the space, your preferences, budget and timeline	When you ask for an offer or work with us on a project
Contract and billing data	Name or company name, NIPT/ID number, billing address, payments made	When we sign a contract and issue invoices
Technical and usage data	IP address, browser and device type, pages visited, how you arrived at the website (e.g. from a Google ad), date and time of visit	Automatically, through server logs and, with your consent, cookies

4. Why we use your data and on what legal basis

Purpose	Legal basis
Answering your enquiry and preparing an offer	Steps taken at your request before a contract
Designing and supervising your project	Performance of a contract
Issuing invoices and keeping accounting records	Legal obligation
Showing completed projects (photos of spaces) in our portfolio and on Instagram, without identifying you	Legitimate interest. Where photos could identify you or your home, we ask for your consent first.
Measuring visits to the website (Google Analytics)	Your consent
Measuring the results of our Google ads and showing our ads to people who have visited the website (Google Ads)	Your consent
Keeping the website secure and working properly	Legitimate interest

5. Cookies and third-party services

Our website uses necessary cookies, which it needs to work correctly. These do not need your consent. With your consent, given through the cookie banner, we also use:

Google Analytics 4 (Google Ireland Ltd.): statistics on how visitors use the website. Cookies: _ga, _ga_*. Duration: up to 2 years.
Google Ads (Google Ireland Ltd.): measures enquiries that come from our ads (conversions) and lets us show our ads to people who have visited the website (remarketing). Cookies: _gcl_au and Google advertising cookies. Duration: up to 90 days for _gcl_au and up to 13 months for Google’s advertising cookies.

These tools are loaded through Google Tag Manager, which does not itself collect personal data. You can change or withdraw your consent at any time through the cookie settings link at the bottom of the website.

The website also uses or links to:

Google Fonts (Google Ireland Ltd.): loads the fonts on the website. When the page loads, Google may receive your IP address.
Google Maps, Instagram and WhatsApp (Meta Platforms Ireland Ltd.): our location and pages there are linked from the website. These platforms process your data under their own privacy policies only when you click through to them or contact us there.

6. Who we share your data with

We do not sell your personal data. We share it only when needed with:

engineers, contractors and suppliers working on your project (only the data they need);
public authorities, when permits or approvals are required for your project;
Google, as described in section 5;
our website hosting and IT providers, and our email provider (Google Workspace / Gmail);
our accountants and the tax authorities, as required by law;
courts or other authorities, when the law requires us to.

7. International transfers

Google may process data outside Albania, including in the European Union and the United States. In those cases, the transfer is protected by appropriate safeguards, such as European Commission adequacy decisions (including the EU–US Data Privacy Framework) or standard contractual clauses.

8. How long we keep your data

Data	Retention period
Enquiries that do not lead to a project	1 year
Project files and correspondence	5 years after the project is completed, for warranty and possible claims
Contracts, invoices and accounting records	10 years, as required by law
Google Analytics data	14 months
Server logs	6 months

9. Security

We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS) and access only for authorised staff. If a data breach is likely to put your rights at risk, we will notify the Commissioner within 72 hours and inform you when the law requires it.

10. Your rights

Under Law No. 124/2024 you have the right to:

access the data we hold about you;
have inaccurate data corrected;
have your data deleted, where there is no legal reason for us to keep it;
restrict or object to processing (including the use of your project photos);
receive your data in a portable format;
withdraw your consent at any time, including for cookies, without affecting earlier processing.

To use any of these rights, write to mcarchitecture89@gmail.com. We will reply within 30 days.

11. Children

Our website and services are not aimed at children under 16, and we do not knowingly collect their data.

12. Complaints and changes

If you think we have not handled your data correctly, you can complain to the Information and Data Protection Commissioner: Rr. “Abdi Toptani”, Nd. 5, Tirana; www.idp.al; info@idp.al.

We may update this policy. The current version is always published on this page, with its date at the top.