Privacy policy

Ura Advisory, Prishtina, Kosovo (“Ura Advisory”, “we”, “us”) is the controller of the personal data described in this policy. It applies to this website, the client portal and the services we provide to clients.

We process personal data in line with the EU General Data Protection Regulation (GDPR), where it applies, and Kosovo Law No. 06/L-082 on the Protection of Personal Data.

To contact us about privacy, use the contact form on this website and choose “Something else” as the service.

We collect only what we need for the purposes described below:

• Contact form: your name, email address, company, country, phone number if you give it, the service you are interested in, your message, your preferred time for a call and the language of the page.
• Client portal accounts: name, email address, phone number, job title, password (stored only as a secure hash), language preference, two-factor authentication settings and the companies you have access to.
• Client documents and financial data: invoices, receipts, contracts, bank statements, payroll data and other records that you or your colleagues upload, the data read from them, and the filings, payments and reports we prepare.
• Verification (KYC) data: details of company owners, directors and beneficial owners, and identity documents, as required to verify clients.
• Technical logs: IP address, browser type, the pages and actions requested, timestamps and security events such as sign-ins, which we keep to run and protect the service.

• To answer your enquiry and prepare a proposal: steps taken at your request before entering into a contract, and our legitimate interest in responding to business enquiries.
• To provide our services and the client portal: performance of our contract with you or your company.
• To verify clients and meet our tax, accounting and anti-money laundering obligations: compliance with legal obligations.
• To keep the website and portal secure, prevent abuse and keep an audit trail: our legitimate interest in protecting our clients and our systems.
• To understand how the website is used, with cookieless analytics that do not identify you: our legitimate interest in improving the website.

We do not sell personal data and we do not use it for advertising.

We use carefully selected providers that process data on our behalf, under contract and only on our instructions:

• Hosting and database: the infrastructure that runs this website and the client portal.
• File storage: private storage for documents, which open only through links that expire.
• Transactional email: sends account emails, notifications and replies to enquiries. It measures whether emails are opened and which links are clicked, so we know messages arrived. Links that carry security codes are not tracked.
• AI processing, where enabled: reads documents and answers assistant questions for your company. Your data is never used to train AI models.
• Cookieless visitor analytics: counts visits to the website without cookies and without identifying individual visitors.

Some providers may process data outside Kosovo, for example in the European Union or the United States. Where data leaves Kosovo or the European Economic Area, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses, as the GDPR and Kosovo law require.

We keep personal data only for as long as we need it for the purpose it was collected for, or for as long as the law requires:

• Contact form enquiries: as long as needed to answer and follow up, then deleted, unless you become a client.
• Client records and documents: for the duration of the engagement and afterwards for as long as Kosovo tax and accounting law requires us to keep them.
• Portal accounts: until the account is closed, then for as long as needed to meet legal obligations and resolve disputes.
• Technical and security logs: for a limited period, unless they are needed to investigate an incident.

We use technical and organisational measures that match the sensitivity of financial data, including:

• Private document storage, with access only through links that expire
• Encrypted connections (HTTPS) for the website and the portal
• Passwords stored only as secure hashes
• Two-factor authentication for accounts
• Role-based access, so each person sees only what their role allows
• An audit log of sign-ins, uploads, changes and approvals
• Confidentiality obligations for everyone who works on client files

We use one essential cookie: a session cookie that keeps you signed in to the client portal. It is strictly necessary and is not used for tracking.

Our visitor analytics are cookieless. They count visits and pages without placing cookies on your device or building a profile of you. We do not use advertising or tracking cookies, so we do not ask for cookie consent.

Depending on the law that applies, you have the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• have data deleted when we no longer need it
• restrict or object to certain processing
• receive your data in a portable format
• withdraw consent at any time, where we rely on consent

To exercise any of these rights, send us a request through the contact form on this website. We may ask you to confirm your identity and will answer within the time the law allows.

You can also complain to the Information and Privacy Agency of Kosovo or, where the GDPR applies, to your local data protection authority.

We may update this policy when our services or the law change. The date at the top shows when it was last updated. Significant changes will be announced on this website or in the client portal.