Privacy Policy — ITS Bileta

At a glance

• ITS Bileta is a work application for Albanian businesses (transport operators, local and national authorities). It is not an application for the general public and it is not for passengers.
• We process your staff account data (name, email, role, fiscal operator code), POS device data (installation identifier, serial number where the operating system permits), GPS location during the active shift only, and ticket/sales data, which are the operator's fiscal documents.
• We do not collect contacts, SMS, phone calls, photos, microphone, health data, banking data or credit card data. We do not use advertising and we do not sell data. We do not use third-party advertising or analytics SDKs.
• Data is stored on contracted servers inside the European Union (France and Germany).
• As an individual you have the right to request access, rectification, erasure, restriction, objection and data portability. Write to privacy@its.al.

1. Who is the controller

The controller of personal data (the entity that determines the purposes and means of processing) is:

• Entity: ITS SYSTEMS
• NIPT: M62905204D
• Address: Bulevardi Aqif Pasha, Elbasan, Albania
• Privacy email: privacy@its.al
• Phone: 0686412170
• Website: https://its.al

This processing is carried out in accordance with law no. 124/2024 “Për mbrojtjen e të dhënave personale” (On the Protection of Personal Data), its secondary legislation and the Albanian legislation in force.

We do not intend use outside Albania. The service, the text, billing, support and configuration are built for the Albanian market and for Albanian legislation (fiscalisation, road transport, Albanian public registers).

2. Who the application is for

ITS Bileta is used only by:

• conductors and operational staff of transport operators;
• operator managers/owners who configure devices and staff;
• authority administrators (municipalities, national authority) who manage the network and fares.

The application:

• is not intended for consumers, passengers or children;
• must not be used by persons under the age of 18;
• requires a work account created by the operator or by the platform administrator.

3. Our role: controller or processor

Depending on the data, our legal role differs. This matters, because it determines whom you should approach regarding your rights.

When we act as a processor:

• we process the data only on the documented instructions of the operator/authority and for the purposes of the contract;
• we apply security measures and notify the controller without delay in the event of an incident;
• we assist the controller in responding to requests from individuals (access, erasure, rectification);
• we do not use the data for other purposes, we do not sell it and we do not transfer it without authorisation.

In practice: if you are a conductor of an operator and you wish to exercise a right over tickets, shifts or shift location, you should address the request first to your employer/operator (the controller). We will help the operator to fulfil it. For your own platform account and for security matters, you may write to us directly.

4. What data we process, why and for how long

4.1 Account and staff identity

4.2 The POS device and its pairing

We do not read the contact list, messages, call log or personal files of the device.

4.3 Location during the shift

When the conductor opens a shift, and until the shift is closed, the device periodically sends:

• GPS coordinates (latitude/longitude), the measurement accuracy and the time;
• data linking the ticket to the station (stop matching), including manual confirmation, when GPS is not available.

Purposes:

1. to verify that the ticket was sold on the correct line/station;
2. to report the actual service to the contracting authority (fulfilment of the timetable and the itinerary);
3. the safety of staff and passengers in the event of an incident.

The limits we apply:

• tracking works only during an active shift; when the shift is closed, the location service stops;
• the application displays a visible notification about the use of background location during the shift;
• we do not track the device outside working hours and we do not use location for automatic assessment of individual performance;
• the employer (operator) is responsible for informing its staff about this tracking, in accordance with employment legislation.

4.4 Tickets, sales and fiscalisation

We process: the ticket number, line, direction, station of sale, the fare applied and the approved fare, the amount, the currency (ALL), the method of payment (cash or NFC purse/card), the time of sale, the operator, the device and the user who sold it, as well as the fiscal references (IIC/FIC, TCR, business unit) returned by the fiscalisation service.

• We do not store the passenger's name, document, telephone or other identifying data. The ticket is anonymous as regards the passenger.
• Tickets are fiscal/accounting documents of the operator; for them the operator is the controller and we are the processor.
• Legal bases: legal obligation (invoicing and turnover-monitoring legislation, e.g. law no. 87/2019 “Për faturimin dhe sistemin e monitorimit të qarkullimit” and its secondary legislation) and performance of the contract with the operator.

4.5 Technical data, security and auditing

We store: the IP address and “user agent” of sessions, audit logs (who did what and when), security and technical events, application errors.

Purpose: platform security, detection of abuse, diagnosis of defects, fulfilment of accounting and evidentiary obligations. Legal basis: legitimate interest and legal obligation.

4.6 Business data from public registers (QKB) and from authorities

The platform holds data on business entities: NIPT, the name of the entity, legal form, address, status, activity and, where necessary, the representative/administrator and the contact person.

• Main source: the National Business Centre (QKB, Qendra Kombëtare e Biznesit) and other official Albanian public registers; other sources: the entity itself, the contracting authority and the transport network import sources (e.g. eTransport).
• Purpose: correct identification of customers and operators, verification of legal identity, invoicing, fulfilment of legal obligations and the integrity of transport data.
• Legal bases: performance of the contract, legal obligation and legitimate interest in verifying the customer's identity.

About public data: the fact that a piece of data is recorded in the QKB does not mean that it is not protected. Where a piece of data identifies a natural person (e.g. a self-employed person, an administrator, an owner or a contact person), this document applies in full. We do not collect this data from you again and we do not ask for consent for it, because we obtain it from an official public register and we use it for the same purposes for which it was published. Any affected person may object to the processing or request the rectification of inaccurate data (see §12).

4.7 Biometrics and NFC

• Biometrics (fingerprint / face): used only to unlock the saved sign-in on the device. We do not send and do not store any biometric template on the server; verification is performed by the device operating system. We only check the “success/failure” response.
• NFC: used to read staff cards and, when activated, the traveller's purse/card. The card identifier (UID) is stored and, for the purse, the balance and the top-up history. This is pseudonymous data: it is not linked to the passenger's name, except where the operator links it itself.

5. What we do not collect and do not do

• We do not collect contacts, SMS, call logs, microphone, photos/camera, personal files, health data, religious or political data, or sexual orientation.
• We do not store bank card data and we do not process credit card payments.
• We do not display advertising and we do not use targeted advertising.
• We do not sell and we do not rent out personal data.
• We do not use third-party analytics or advertising SDKs (no Firebase Analytics, no advertising network, no behavioural trackers).
• We do not use the data for automated decisions with legal effects on the person.
• We do not use the application for consumer purposes or for children.

6. Android permissions and why we request them

The application does not request permission for the camera, contacts, SMS, microphone, background location without an active shift, or access to all files.

7. With whom we share data

Data is shared only to the extent necessary:

We do not sell personal data and we do not give it for advertising.

The updated list of sub-processors may be requested at privacy@its.al.

8. Transfers outside Albania

The platform servers are located inside the European Union (France), and the fiscalisation service operates on servers inside the European Union (Germany). These are countries with an adequate level of protection under Albanian legislation.

If in the future we use a sub-processor outside the EU/EEA, the transfer will take place only with appropriate contractual safeguards (standard contractual clauses or an adequacy decision) and this document will be updated.

9. How long we keep data

When the period ends, the data is deleted or irreversibly anonymised. Aggregate statistical data (without personal identification) may be kept longer.

10. Security

We apply technical and organisational measures, including:

• mandatory HTTPS/TLS communication with the server; no unprotected traffic on the internet;
• passwords stored only as a hash (Argon2id), never in clear text;
• local storage of credentials and configuration in encrypted memory on the device (AES-256);
• full isolation between operators: one operator does not see the data of another operator;
• device pairing with time-limited permissions and verification of fiscal identity before use;
• role-based access (conductor, manager, administrator) and audit logging of actions;
• regular backup of the database and tested restoration;
• prevention of automatic copying of application data to the cloud (allowBackup=false);
• continuous review of access and of malfunctions.

In the event of a personal data security breach that presents a risk, we notify the Commissioner (Komisioneri) within the legal deadlines and inform the affected persons and/or the controller where this is required.

11. Your rights

Under law no. 124/2024, you have the right:

1. To information — to know what we process and why (this document).
2. To access — to receive a copy of the data concerning you.
3. To rectification — to correct inaccurate data or to complete incomplete data.
4. To erasure (“the right to be forgotten”) — where there is no longer a legal basis for the processing.
5. To restriction of processing.
6. To object to processing based on legitimate interest.
7. To portability of the data you have provided, in a readable format.
8. To withdraw consent at any time, where the processing is based on consent (this does not affect the lawfulness of prior processing).
9. To complain to the Commissioner for the Right to Information and Protection of Personal Data (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e Të Dhënave Personale) — https://idp.al

How to exercise them: write to privacy@its.al from the account email or with a signed request, describing the right you are seeking. We reply within 30 days (the legal deadline), and we will notify you if the request requires more time or if we need to verify identity.

Restrictions: we cannot delete data that the law obliges us to keep (e.g. fiscal documents) or that is needed to establish, exercise or defend legal rights. In these cases we restrict the processing and keep the data only for that purpose.

For data for which the operator is the controller, we forward the request to the operator and support it in responding.

12. Deletion of the account and of data

• Accounts are created and administered by the operator or by the platform administrator. The conductor/manager must ask the operator to deactivate or delete the account.
• For accounts created for platform clients, the request may be sent to privacy@its.al or through the page https://itsalbania.com/account-deletion.
• After verification of identity and authorisation, the account is deactivated and the personal data is deleted or anonymised within 30 days, with the exception of:
  • fiscal/accounting documents (the legal retention period);
  • audit logs and evidence necessary for security or disputes;
  • data that the law requires us to keep longer.
• Deleting the account does not delete the operator's fiscal documents, because they are mandatory by law.

13. Employees and monitoring during the shift

ITS Bileta carries out a limited form of operational monitoring during the shift: the position of the device, the time of actions, the tickets sold and the device used.

• The monitoring is limited in time (the active shift) and in purpose (attribution of the ticket to the line/station, service fulfilment, security).
• The employer (operator) is the controller for this data and has the duty to inform its staff and, where applicable, to consult employee representatives, in accordance with employment legislation.
• We do not use this data for automatic assessment of individual performance and we do not use it outside the employment relationship.

14. Automated decisions and profiling

We do not make decisions with legal or similarly significant effects on the person based solely on automated processing. The data is used for operational functions (stop attribution, fare validation, service reporting), not for commercial profiling.

15. Children

The application is a work tool for adults and is not intended for persons under 18. We do not knowingly collect data on children. If we discover such an account, we deactivate it.

16. Changes to this policy

We may update this policy because of legal, technical or functional changes.

• The version in force is always published at https://itsalbania.com/privacy-policy.
• For material changes we notify users in the application or by email, before they take effect.
• We keep previous versions and their effective dates.

17. Contact and complaints

• Privacy and rights: privacy@its.al
• Phone: 0686412170
• Post: Bulevardi Aqif Pasha, Elbasan, Albania
• Data protection contact: privacy@its.al

If you believe that your rights have been infringed, you may complain to:

Commissioner for the Right to Information and Protection of Personal Data (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e Të Dhënave Personale)
Official website: https://idp.al (contacts and official address as per the website)

Annex — Document versions