GDPR and data protection

Last updated: 21 October 2026

Auto Postlix is built to be used by businesses that must comply with the EU General Data Protection Regulation (GDPR) and Albanian data protection law. This page summarises how we meet those rules. It complements our Privacy Policy.

1. Roles

• Controller: AppAlbania (Auto Postlix) for account, billing and website data.
• Processor: AppAlbania for the data of people who write to your connected Facebook Pages and Instagram accounts. You, the customer, are the controller of that data and decide why it is processed.

2. Legal bases we rely on

• Contract (Art. 6(1)(b)): running your account and the features you use.
• Legitimate interest (Art. 6(1)(f)): security, abuse prevention and service improvement in aggregate.
• Legal obligation (Art. 6(1)(c)): accounting and tax records.
• Consent (Art. 6(1)(a)): optional analytics and any marketing email, which you can withdraw at any time.

3. Processing on your behalf

When we act as your processor we process data only on your documented instructions (your settings and automations), keep it confidential, protect it with appropriate technical and organisational measures, help you answer data subject requests, notify you without undue delay of any personal data breach, and delete or return the data when you close your account. A data processing agreement (DPA) is available on request at info@appalbania.com.

4. Sub-processors

We use a small number of sub-processors: Meta Platforms (messaging and publishing APIs you connect), our hosting provider, email delivery, payment providers and, only if you enable AI replies, an AI text provider. We will tell customers about new sub-processors before they process customer data. The current list is available on request.

5. International transfers

Some providers, including Meta, may process data outside the EU and Albania. Where that happens we rely on adequacy decisions or the European Commission's Standard Contractual Clauses, with additional safeguards where needed.

6. Rights of data subjects

People have the right to access, rectify, erase, restrict and port their data and to object to processing. Account holders can write to info@appalbania.com. If you wrote to a business's Page, contact that business first; we will help it respond, or you may contact us directly. We answer within one month. See the data deletion instructions.

7. Security measures

• HTTPS for every connection; passwords stored only as hashes.
• Access tokens kept server-side and never shown in the browser.
• Least-privilege staff access, logged administration and regular backups.
• Data minimisation: we only request the Meta permissions a feature needs.

8. Retention

Account data is kept while the account is active and deleted or anonymised within 30 days after closure; billing records are kept for the period required by law; technical logs for up to 90 days.

9. Contact and complaints

Data protection questions: info@appalbania.com (AppAlbania, Tirana, Albania). You may lodge a complaint with the Albanian Information and Data Protection Commissioner or with the supervisory authority of your EU country of residence or work.