Translation; in the event of any discrepancy, the German version prevails.
This notice applies to offrano.com and all its language versions. It has three parts:
- Part A for anyone who submits an enquiry through Offrano ("customers"),
- Part B for businesses that buy enquiries ("buyers"),
- Part C for all visitors to the website.
Sections D to I apply to everyone.
1. Controller
XARC Solutions SHPK (Administrator: Xhonatan Çopani) Rruga Ali Demi, Ndërtesa P.263, Hyrja 1, Ap. 1, 1000 Tiranë, Albania Email: contact@offrano.com
Offrano is a brand of XARC Solutions SHPK ("we", "us").
2. How Offrano works — in five sentences
You tell us what work you would like done and where. We check your phone number by text message and your email address by a confirmation link. We then offer the enquiry to businesses — at first only with your postcode, town and details of the work, without your name, street, house number, phone number or email address. Exactly one business can buy the enquiry, and it pays us for it. Before that business sees your contact details, we email you its name, address and phone number.
Part A — Customers
A1. What data we process
- Contact details: first name, surname, email address, phone number, street and house number, postcode and town, and for companies the company name.
- Details of your enquiry: the trade and service chosen, country, your answers in the enquiry form (for example floor area or whether you own the property) and any free text.
- Record of your consent: the version of the consent wording, that you ticked the consent box, the times of the text-message check and of the email confirmation, the page on which you made the enquiry, your IP address when submitting it, which business the enquiry was passed to, when we told you its name and whether you have withdrawn consent.
- Source of the enquiry: the page you came from (referrer) and campaign codes in the link (UTM parameters), where present.
- Check values: non-reversible check values (HMAC) calculated from your email address and phone number, which let us recognise duplicate enquiries and misuse without searching the address in plain text.
A2. Purposes and lawful bases
| Purpose | Lawful basis |
|---|---|
| Receiving and checking your enquiry and offering it to businesses with postcode and town but without name, street, house number, phone number or email address | Art. 6(1)(b) GDPR / UK GDPR (our user agreement with you, see Terms of use) |
| Passing your contact details and enquiry to exactly one business, and its contacting you by phone, text message and email | Art. 6(1)(a) GDPR / UK GDPR (your explicit consent); in the alternative Art. 6(1)(b), because you asked us to pass on your enquiry |
| Checking your phone number by text message and confirming your email address | Art. 6(1)(b) and Art. 6(1)(f) (our interest in passing on only genuine enquiries and preventing misuse of other people's numbers or addresses) |
| Keeping proof of your consent, detecting duplicates and fraud, handling buyers' complaints | Art. 6(1)(f) (duty to demonstrate consent under Art. 7(1), protection against misuse, defence of legal claims) |
| Call from Offrano about a complaint: if the buyer reports that it cannot reach you, or complains about the enquiry on another ground, Offrano may call you to review the complaint and ask whether you are still interested. We process your name, phone number, enquiry number and the outcome of the call. | Art. 6(1)(f) (reviewing the complaint, fair billing towards the buyer) |
| Telling you the name, address and phone number of the buyer | Art. 6(1)(f) (keeping you informed and making the disclosure traceable) |
A3. Text-message check and email confirmation
After you submit the form, we send a code by text message to the number you gave. Only once you enter it is the number treated as verified. We then send you an email with a confirmation link (double opt-in). An enquiry whose number and email address have not been confirmed is not offered to any business. This ensures that nobody can make an enquiry with your details without access to your phone and your inbox.
A4. Passing your enquiry to a business
Who sees the enquiry before it is sold: registered buyers see in the shop only the trade, country, the full postcode and the town, the form answers released for preview, the age of the enquiry and the price. Your name, street, house number, phone number and email address are never visible before the sale.
Who receives the enquiry: exactly one business that works in the chosen trade in your area and buys the enquiry. The business pays us for the enquiry. After that it is not offered to anyone else.
What the business receives: your name, email address, phone number, postal address and the details of your enquiry. It may call, text or email you about this enquiry.
What you receive first: as soon as a business has bought the enquiry, we automatically email you its name, address and phone number. Only then are your contact details shown to it. The email contains a link you can use to withdraw your consent.
The business is a controller in its own right. From the moment of disclosure, the business processes your data under its own responsibility and its own privacy notice. It is contractually bound to use your data only to respond to your enquiry, not to pass it on, to tell you at first contact where it obtained your data, not to contact you more than five times within 14 days, to act on a withdrawal of consent within 48 hours and to delete your data if no job is agreed within six months.
Businesses based outside the EU/EEA: Offrano also operates in European countries outside the EU. If the business is based in a country for which neither the European Commission nor — for enquiries from the United Kingdom or Switzerland — the competent authority there has found an adequate level of data protection, the disclosure is based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR), together with the UK International Data Transfer Addendum for enquiries from the United Kingdom, which form part of our contract with the business. The business's country is shown in the email you receive after the sale. You can ask us for a copy of the clauses.
A5. Withdrawing your consent
You can withdraw your consent at any time with effect for the future — via the link in any of our emails or informally by writing to contact@offrano.com.
- Before the sale: the enquiry is removed from the shop at once and your contact details are deleted.
- After the sale: we pass your withdrawal on to the business without delay. It must act on it within 48 hours. If you have since entered into a contract with the business yourself, further processing is governed by that contract.
Withdrawal does not affect the lawfulness of processing before it. We keep the record showing that and when you consented and withdrew (A6).
A6. How long we keep data
| Data | How long |
|---|---|
| Enquiry without confirmed phone number and email address | deleted no later than 7 days after receipt |
| Enquiry that is not sold | in the shop for no more than 21 days, deleted 60 days after receipt |
| Contact details and enquiry details after the sale | deleted 14 days after the sale (the buyer's 7-day complaint period plus time to handle complaints). After that we keep only the enquiry number, trade, country, region, price and timestamps for accounting — without name or contact details. |
| Enquiry withdrawn before the sale | contact details deleted at once |
| Record of consent, including the check values of email and phone number | 3 years from disclosure or from withdrawal |
| Text-message code | until entered, at most until it expires |
| Outcome of a call from Offrano about a complaint | as for the complaint: until it is closed; after that only the outcome of the complaint is kept, without your data |
The business applies its own retention periods; under its contract with us, no more than six months if no job is agreed (A4).
A7. Do you have to provide data?
Making an enquiry is voluntary. Without your name, email address, phone number and location, however, we cannot check it or pass it to a business. Without the consent tick the enquiry cannot be accepted.
Part B — Buyers (businesses)
B1. What data we process
- Account: name and email address of the contact person, login times and the IP addresses used to log in. You log in without a password: we send a one-time code to your email address; the code is valid only briefly and is then deleted.
- Business: company name, legal form, country, address, phone number, VAT number or register extract, trades and areas booked, the professional or trade licence you have confirmed.
- Transactions: enquiries bought, payments, invoices, refunds, complaints with supporting evidence (for example call records), notices of withdrawals and data breaches.
B2. Purposes and lawful bases
- Running your account, selling enquiries, invoicing, handling complaints: Art. 6(1)(b) GDPR / UK GDPR.
- Checking that you are a business (checking your VAT number in the European Commission's VIES system or with the competent national service, or checking a register extract): Art. 6(1)(b) and (f) (only businesses may buy; protection of customers).
- Telling the customer whose enquiry you buy your company name, address and phone number: Art. 6(1)(b) (part of the buyer agreement) and (f) (the customer must know who receives their data). If you trade as a sole trader, this is also your personal data.
- Keeping invoices and accounting records: Art. 6(1)(c).
- Detecting misuse and resale, enforcing claims: Art. 6(1)(f).
B3. Payment
You pay for each purchase individually through the payment service provider Stripe (card, Apple Pay, Google Pay). For this, Stripe creates a customer record for your business. You enter your card and payment details only with Stripe. If you wish, Stripe stores your payment method for further purchases; we only receive details for display in your account (such as card type and last four digits), never the full card details. You can remove the stored payment method in your account at any time. From Stripe we receive confirmation of whether payment was made and the details needed to match it (amount, payment reference, email address). Refunds after a complaint are also made through Stripe to the payment method used. Stripe also processes the data for fraud prevention under its own responsibility. The lawful basis is Art. 6(1)(b). More information: stripe.com/privacy.
B4. How long we keep data
| Data | How long |
|---|---|
| Account and business data | for the duration of the business relationship; deleted after termination unless one of the following periods applies |
| Proof of business status | up to 3 years after the end of the business relationship |
| Which enquiry you bought when, and when the customer was told about you | 3 years from the purchase (proof towards customers and authorities) |
| Stored payment method (with Stripe) | until you remove it or the account ends |
| Invoices, refund records, accounting records | for the statutory retention period |
| Complaints and evidence | until the complaint is closed; after that only outcome and amount, without the customer's data |
Part C — All visitors
C1. Delivering the website
When you visit the site, we process the technically necessary data: IP address, time, address requested, referrer, browser and operating system. This is needed to deliver the page and protect it from attacks (Art. 6(1)(f)). The website is delivered through Cloudflare's network; Cloudflare processes IP addresses to fend off attacks and speed up delivery.
C2. Protecting the forms (Cloudflare Turnstile)
The enquiry form and the buyer login are protected by Cloudflare Turnstile. Turnstile checks whether a form is being filled in by a human and processes the IP address, browser and device information and characteristics of how the page is used. Turnstile is not used for advertising. The lawful basis is Art. 6(1)(f) (protection against automated misuse).
C3. Cookies and Google Analytics
We only use cookies that are strictly necessary, and Google Analytics 4 only with your consent (Art. 6(1)(a); in the United Kingdom regulation 6 PECR). Until you agree, the Google tag is blocked. Details are in our cookie notice. You can change your choice at any time via "Cookie settings" at the bottom of every page.
C4. Contacting us by email
If you write to us, we process your details to deal with your request (Art. 6(1)(b) or (f)) and delete them once it has been dealt with and no retention duty applies.
D. Recipients and service providers
We use the following service providers. Unless stated otherwise, they process data on our behalf and on our instructions (Art. 28 GDPR / UK GDPR).
| Provider | Task | Location / transfer |
|---|---|---|
| Contabo GmbH, Germany | server hosting the database of enquiries | Germany (EU) |
| Cloudflare, Inc. | website delivery, DNS, protection against attacks, Turnstile | USA; EU-US Data Privacy Framework or Standard Contractual Clauses |
| Resend, Inc. | sending emails (confirmation link, buyer notification, login codes, invoices) | USA; EU-US Data Privacy Framework or Standard Contractual Clauses |
| Twilio | sending text-message codes | USA; Standard Contractual Clauses |
| Stripe | buyers' payments and refunds, stored payment methods (own responsibility for fraud prevention) | EU or USA depending on the contracting entity; Standard Contractual Clauses or EU-US Data Privacy Framework |
| Google Ireland Limited | Google Analytics 4, only with consent | Ireland; transfer to the USA possible, EU-US Data Privacy Framework or Standard Contractual Clauses |
Other recipients: the business that buys your enquiry (A4) and — on a purchase — the customer, who receives the buyer's name, address and phone number (B2). Public authorities receive data only where the law requires us to disclose it.
E. Our base in Albania
We are based in Albania and have no establishment in the EU or the United Kingdom. Because we offer services to people in the EU, the GDPR applies to us (Art. 3(2) GDPR); for enquiries from the United Kingdom the UK GDPR and the Data Protection Act 2018 apply, and for enquiries from Switzerland the Swiss Federal Act on Data Protection (FADP). The Albanian Law No. 124/2024 on Personal Data Protection, which is aligned with the GDPR, also applies.
There is no adequacy decision of the European Commission for Albania; Switzerland lists Albania as a country with adequate data protection. You enter your data directly with us. According to the European Data Protection Board's Guidelines 05/2021, this is not a transfer to a third country within the meaning of Chapter V GDPR but a collection by us to which the GDPR applies directly. Enquiries are stored on our server in Germany.
F. No automated decision-making
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR / UK GDPR), and we do not create profiles. Which business receives an enquiry depends solely on which business buys it. Automated checks (text-message code, confirmation link, duplicate check, Turnstile) only serve to distinguish genuine from fake enquiries; if your enquiry is wrongly rejected, please contact us.
G. Security
We store name, email address, phone number, street and IP address individually encrypted; the key is not kept in the database. Data is transmitted in encrypted form (TLS). Internal notifications about new enquiries and sales contain no personal data.
H. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and the right to withdraw consent at any time with effect for the future (Art. 7(3)).
Right to object (Art. 21): where we process data on the basis of Art. 6(1)(f), you may object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds or the processing is for the establishment, exercise or defence of legal claims.
To exercise your rights, write to contact@offrano.com. You can also exercise your rights directly against the business that bought your enquiry; its contact details are in the email we send you after the sale.
Complaints to a supervisory authority: you can complain to a data protection authority, in particular in the country where you live or work.
- EU/EEA: the authority of your country of residence; the European Data Protection Board keeps a list at edpb.europa.eu.
- United Kingdom: Information Commissioner's Office (ICO), ico.org.uk.
- Switzerland: Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch.
- Albania: Commissioner for the Right to Information and Personal Data Protection, idp.al.
- In other countries: the data protection authority responsible there.
I. Changes
If our processes change, we will update this notice. The version in force when you submitted your enquiry applies; its version code is stored with your consent.