Home › Privacy Policy
Privacy Policy
Website Privacy Policy
Information on the processing of personal data of users of the website www.wearefiber.com
Last updated: 25/09/2026
This privacy notice explains how we process the personal data of those who visit the website www.wearefiber.com (the “Website”) or use it to contact us or subscribe to the newsletter. It is provided pursuant to Article 13 of Regulation (EU) 2016/679 (the “GDPR”) and applicable law.
This notice covers only the processing carried out through the Website. It does not apply to the personal data that Fiber processes on behalf of its client companies as part of its outsourcing services: for such processing, the information to data subjects is provided by the client companies, acting as data controllers.
1. Data controller
The data controller is FIBER GROUP SHPK, owner of the “We Are Fiber” brand, hereinafter “Fiber” or the “Controller”:
- registered office: Rruga “Don Bosko”, Njësia me Nr. Pasurie 6/422 – N10, Njësia me Nr. Pasurie 6/422 – N11, ZK. 8310, Vol. 46, F. 115 and 116, 1001 Tirana, Albania;
- NIPT / VAT No.: L52519403R;
- email: amministrazione@wearefiber.com;
- telephone: +355 69 60 77 693.
2. Data protection contacts
For any information or request concerning the processing of personal data, you may contact:
- the Controller, at amministrazione@wearefiber.com;
- the Data Protection Officer (DPO), at dpo@wearefiber.com;
- the Representative in the European Union appointed pursuant to Article 27 GDPR, Fiber Group Srl, at the certified email address fibergroup@pec.it or at the email address financeitalia@wearefiber.com.
3. What data we process, why and on what legal basis
The personal data collected through the Website are processed solely for the purposes set out in this notice and in compliance with the principles of lawfulness, fairness, transparency, data minimisation and storage limitation laid down by the GDPR.
The table below sets out, for each processing activity, the categories of data processed, the relevant purposes, the legal basis and the retention periods.
| Processing | Data processed | Purposes | Legal basis | Retention |
|---|---|---|---|---|
| Website browsing | IP address, date and time, pages visited, browser, operating system, technical server logs | Operation and security of the Website, prevention of abuse and detection of security events | Legitimate interest of the Controller in the security and proper functioning of the Website, Article 6(1)(f) GDPR | 6 months, unless further retention is necessary for investigations into incidents, abuse, legal obligations or security enquiries |
| “Contact” form | First name, last name, email, telephone, content of the message | Responding to the request, arranging a call, sending information, the company profile or a proposal | Pre-contractual measures at the data subject’s request, Article 6(1)(b) GDPR; for company contact persons, legitimate interest, Article 6(1)(f) GDPR | Up to 24 months from the last contact, if the request does not lead to a contractual relationship. If a contractual relationship follows, the relevant data are kept for up to 5 years from its termination, without prejudice to any longer periods applicable to contractual or legal documentation |
| Marketing communications and newsletter | Email; first and last name if provided | Sending the newsletter and updates on services, events and content | Consent, Article 6(1)(a) GDPR | Until consent is withdrawn or the user unsubscribes. Only the evidence needed to demonstrate consent or its withdrawal is retained |
| Anti-spam protection of forms (Google reCAPTCHA v3) | IP address, device and browser data, interactions with the page, reCAPTCHA technical cookie | Distinguishing real users from bots and protecting forms from abuse | Legitimate interest in the security of the Website, Article 6(1)(f) GDPR | The reCAPTCHA cookie has a maximum duration of 6 months. The data collected are processed by Google according to its own retention periods |
| Usage statistics (Google Analytics 4) | Online identifiers, browsing and device data, approximate location | Analysing the use of the Website and improving its content and performance | Consent, Article 6(1)(a) GDPR, given through the cookie banner | 2 months for event-level data and 14 months for user-level data, as configured in Google Analytics 4 |
| Protection of rights | Data and documentation required in relation to the specific case | Establishing, exercising or defending a right in or out of court | Legitimate interest, Article 6(1)(f) GDPR | For as long as necessary to handle the dispute and for the subsequent applicable limitation periods |
The retention periods indicated above may be extended where necessary to comply with legal obligations, handle requests from the authorities, establish or defend rights, manage security incidents or fulfil specific contractual obligations. Once the retention period has expired, the data are deleted, anonymised or otherwise rendered no longer usable for the original purposes.
The fields of the “Contact” form marked as mandatory are necessary to handle the request: without these data we cannot reply. Consent to marketing communications is optional and does not affect our reply.
For cookies and other tracking tools, including the technical cookie that remembers the selected language, please refer to the Cookie Policy. The Website fonts are hosted on the Controller’s servers and loading them does not involve any transfer of data to third parties.
The Website and its related services are not intended for minors.
4. External services and platforms
Some services linked to the Website are managed through dedicated platforms, each with its own privacy notice:
- job applications: the portal careers.wearefiber.com;
- whistleblowing reports: the platform fiber.whblowing.it;
- social profiles (LinkedIn, Instagram, Facebook, TikTok): the Website only contains outbound links, with no embedded plugins. Processing carried out on social platforms is governed by their respective privacy notices.
The use of these services may involve processing with purposes and methods different from those described in this notice.
5. Processing methods and security
The Controller implements technical and organisational measures appropriate to the risk, pursuant to Article 32 GDPR. These measures are designed to ensure the confidentiality, integrity, availability and resilience of the data and of the systems used for processing.
For information on Fiber’s certifications, please see the Certifications page.
Within the processing activities described in this notice, the Controller does not carry out automated decision-making, including profiling, that produces legal effects concerning the data subject or similarly significantly affects them.
6. Recipients of the data
Personal data may be disclosed, strictly to the extent necessary to pursue the purposes set out in this notice, to the following categories of recipients:
- providers of IT, hosting, maintenance and Website security services;
- providers of digital platforms and services used to manage contacts, communications and newsletters;
- providers of analytics, security and automated-access prevention services;
- companies belonging to the same group, where necessary to handle requests or provide the services;
- consultants and professionals assisting the Controller in carrying out its activities;
- public authorities, supervisory bodies or other parties to whom disclosure is required by law or by measures of the competent authorities.
Depending on the case, these parties may act as processors pursuant to Article 28 GDPR or as independent controllers in relation to the specific activities carried out. The Controller selects its suppliers in compliance with applicable law and, where necessary, governs the processing by means of specific agreements.
An up-to-date list of the processors may be requested from the Controller or the DPO at the addresses indicated in this notice.
Personal data are not disseminated, except in the cases provided for by law, nor are they transferred to third parties for their own marketing purposes.
7. Transfers of data outside the European Economic Area
The Controller is established in Albania, a country outside the European Economic Area (EEA). Data sent through the Website are therefore received and processed in Albania.
Some providers, including Google LLC in the United States for Google Analytics 4 and reCAPTCHA, may also process data in other non-EEA countries. In such cases, the transfer takes place in compliance with Chapter V of the GDPR, subject to one of the following conditions:
- an adequacy decision of the European Commission (Article 45 GDPR), such as the EU-U.S. Data Privacy Framework for certified providers;
- appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission (Article 46 GDPR).
Data subjects may obtain information on the countries of destination and a copy of the safeguards adopted by writing to the Controller or the DPO.
8. Rights of the data subject
In the cases and under the conditions provided for by Articles 15-22 GDPR, data subjects may exercise the following rights:
- obtain confirmation as to whether or not personal data concerning them are being processed and, if so, access them and receive a copy;
- request the rectification or completion of inaccurate or incomplete data;
- request the erasure of the data, in the cases provided for by applicable law;
- request the restriction of processing;
- obtain data portability, where applicable;
- withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal.
Right to object. Data subjects have the right to object at any time, on grounds relating to their particular situation, to processing based on the Controller’s legitimate interest. They also have the right to object at any time, without giving reasons, to the processing of their data for direct marketing purposes.
Requests may be sent to the Controller, the DPO or the Representative in the European Union, at the contact details indicated in this notice. The Controller responds without undue delay and, in any case, within one month of receiving the request, except in the cases of extension provided for by Article 12(3) GDPR.
For the newsletter, consent may also be withdrawn using the unsubscribe link included in every communication. Preferences regarding cookies and other tracking tools may be changed at any time through the dedicated function available on the Website.
9. Complaint to a supervisory authority
If data subjects consider that the processing of their personal data infringes applicable law, they have the right to lodge a complaint with the competent supervisory authority.
For data subjects to whom the GDPR applies, a complaint may in particular be lodged with the supervisory authority of the Member State where the data subject habitually resides, works or where the alleged infringement took place. The list of European Union supervisory authorities is available on the website of the European Data Protection Board: www.edpb.europa.eu.
The possibility of also contacting other authorities competent under the law applicable to the Controller remains unaffected.
10. Changes to this notice
The Controller may update this notice in the event of regulatory or organisational changes or changes to the services offered through the Website. The current version is published on this page, together with the date of the latest update.
