1. Scope and contact

This policy applies to eds-ks.com, its authenticated client portal, delivery services, and the Eds-ks.com Klient application for iOS and Android.

The data controller is Express Poste e Shpejte, Prishtina, Republic of Kosovo. Privacy questions and requests can be sent to info@eds-ks.com, by telephone at 049 553 101, 045 553 101, or 038 553 101, or through the contact page.

2. Information we process

Account and contact information

Name, email address, telephone number, account identifier, authentication information, preferred language, and business-account details.

Shipment and delivery information

Sender and recipient names, telephone numbers, pickup and delivery addresses, city, shipment identifiers, parcel details, delivery instructions, status history, signatures or proof-of-delivery information, notes, and shipment photos that an authorized user chooses to upload.

Payment and business records

Cash-on-delivery amounts, payout batches, invoices, payment status, accounting records, and related business correspondence. The app does not collect payment-card or bank-login credentials.

Device and notification information

A random app-installation identifier, access and refresh-session data, app version, operating-system platform, locale, and Apple Push Notification service or Firebase Cloud Messaging token used to deliver operational notifications.

First-party mobile usage analytics

After a user signs in, Eds-ks.com Klient records foreground session start and end, a limited presence heartbeat, approved screen views, successful approved feature actions, app version, platform, locale, and event timestamps. The server derives the account from the authenticated session and stores only a one-way HMAC hash of the random installation identifier.

Analytics guardrail: the analytics endpoint does not accept shipment identifiers, tracking numbers, recipient details, addresses, telephone numbers, notes, search text, photo data, error messages, or arbitrary event properties.

Feedback and problem reports

When a signed-in user submits feedback, we process the selected category and message together with their account, app version, platform, locale, and submission time. The form asks users not to include passwords or sensitive recipient details.

Website and security information

The website may process session cookies, server logs, IP address, browser information, security events, and information submitted through forms. These support login, security, fraud prevention, and core operation. Eds-ks.com Klient has no advertising identifier or third-party behavioral-advertising SDK.

3. Purposes and legal bases

• Provide requested pickup, delivery, tracking, shipment-management, support, payment, and account services.
• Authenticate users, secure accounts, prevent fraud and abuse, diagnose failures, and maintain proportionate audit records.
• Send shipment, note, payment, security, and account notifications selected by the user.
• Meet accounting, tax, regulatory, dispute-resolution, and other legal obligations.
• Measure approved app features to improve reliability and usability.

Processing is based on performance of a requested service or contract, compliance with legal obligations, protection of users and the service, consent where specifically requested, or a legitimate operational interest that does not override the person's rights.

4. Sharing and service providers

Personal data is available only to authorized EDS-KS personnel and contractors who need it for delivery, support, finance, security, or system administration. Infrastructure and operational providers may include hosting providers and Apple or Google/Firebase for app distribution and push delivery.

We do not sell personal data. First-party usage analytics stays in EDS-KS infrastructure and is not sent to a third-party analytics provider. It is not used for advertising, cross-app tracking, or decisions that produce legal or similarly significant effects.

5. Retention

• Mobile analytics: raw events and sessions are deleted after 90 days and are removed when account deletion completes.
• Feedback: retained while reasonably needed for support, product improvement, security, or dispute handling, and removed when account deletion completes unless a legal preservation duty applies.
• Account deletion: a request starts a 30-day grace period. Mobile sessions and client-app push tokens are revoked. After the grace period, credentials, profile and contact information, saved recipients, preferences, tokens, and mobile activity are deleted or anonymized unless a longer legal duty applies.
• Accounting and payment records: Kosovo law requires journals, general ledgers, and supporting books for at least 10 years, source accounting documents for at least 5 years, and payment-related documentation for at least 3 years.
• Shipment photos: normally retained for 12 months. A specific record may be preserved longer while an audit, dispute, legal claim, fraud investigation, or legal preservation duty is active.
• Deletion records: a minimal record may be retained to demonstrate completion and prevent accidental reactivation.

6. Your rights and account deletion

Under Kosovo Law No. 06/L-082, a person may request access, correction, erasure, restriction, objection, or data portability where applicable, and may withdraw consent where processing relies on consent. We may need to verify identity before acting on a request.

Users can request deletion in Eds-ks.com Klient under Profile → Delete account, or follow the public account-deletion instructions. Erasure does not override records that must be retained by law or are necessary to establish, exercise, or defend a legal claim.

A complaint may be submitted to Kosovo's Information and Privacy Agency.

7. Security

We use HTTPS in transit, authenticated and role-restricted access, rotating mobile sessions, server-side authorization, limited administrative access, and operational retention controls. No system can guarantee absolute security, but safeguards are reviewed as the service changes.

8. Children

Our business delivery and account services are not directed to children. Eds-ks.com Klient is intended for adult business clients and authorized account users.

9. Changes

We may update this notice when services, legal obligations, or data practices change. The current version and update date will remain available at this URL.