Mirë se erdhët1. Who we are
mireseerdhet.com ("Mirë se erdhët", "we", "us") is operated by Bati Rexha, who is the data controller for the personal data described in this notice.
Operator: Bati Rexha, Florida, USA
Email: news@mireseerdhet.com
We have not appointed a Data Protection Officer, and we are not required to have one.
2. What we collect and where it comes from
(a) Link-outreach contacts. We sometimes email website owners, editors and organisations one-to-one to ask whether they would link to content on mireseerdhet.com. For this we hold:
- your name and work email address;
- the organisation you work for;
- the public source where we found your address (for example, the contact page of your organisation's website);
- any correspondence between us.
This data comes from publicly available sources and from you, if you reply. We contact only role or organisation addresses and business contacts we found publicly. We do not buy email lists.
(b) Newsletter subscribers. When you sign up for our newsletter we store your email address, the page or form where you signed up ("signup source"), and the language you chose ("signup language"). This data comes from you.
(c) Website visitors. When you visit the site, our hosting provider automatically processes technical data in server logs, such as your IP address, the date and time, the page requested, the browser/user agent and the referring page. We also use Vercel Web Analytics. It does not use cookies; it counts visits using a hash created from the incoming request, and the visitor session is discarded after 24 hours. It gives us only aggregated statistics (for example, page views) and is not designed to identify you or follow you across other websites.
(d) Emails you send us. If you write to us, we keep your message and your contact details so we can reply.
(e) Hire board profiles and job posts. If you add a profile at /hire/join we store what you enter (for example your name, headline, city, experience, skills and languages), your photo and résumé if you upload them, your email address and phone number. Your profile, photo and résumé are shown publicly only after a person reviews them and only with your consent; your email address and phone number are never shown. If you post a job we store the job details and the contact name and email you give us. This data comes from you.
(f) Meet a local. If you apply to host we receive your name, email, phone, city, languages, what you offer, your availability, your bio and an optional photo, and we carry out a short ID check before anyone is listed. If you ask to meet a host or send us a report, we receive your name, email and message. This data comes from you.
(g) Photo submissions. If you send photos at /share we receive the photos, the name you want credited, your email address and any note. This data comes from you.
(h) Sign-in. The hire board uses passwordless sign-in: we email you a 6-digit code or link. We store your sign-in email, a hashed (unreadable) copy of the code for 10 minutes, and a hashed session token for up to 30 days.
3. Why we use your data and our legal bases
Legal references: EU GDPR and UK GDPR Article 6(1); Kosovo Law No. 06/L-082 on Protection of Personal Data, Article 5(1); Albania Law No. 124/2024 on Personal Data Protection, Article 7(1).
(a) Link outreach: to contact you about linking to our content, and to keep a record of our correspondence.
Legal basis: legitimate interests, namely promoting our website to relevant publishers in a proportionate way (GDPR/UK GDPR Art 6(1)(f); Kosovo Art 5(1.6); Albania Art 7(1)(dh)). UK GDPR Article 6(11) names direct marketing as an example of processing that may be carried out for a legitimate interest. Kosovo Art 73 and Albania Art 46 also allow direct marketing using data from publicly accessible sources, provided you are told about your rights.
(b) Newsletter: to send you the newsletter you asked for.
Legal basis: your consent (GDPR/UK GDPR Art 6(1)(a); Kosovo Art 5(1.1); Albania Art 7(1)(a)). You can withdraw your consent at any time with the unsubscribe link in every newsletter, or by emailing us. Withdrawing consent does not affect anything we did lawfully before you withdrew it.
(c) Keeping a suppression list: to make sure we never contact again someone who has objected or unsubscribed.
Legal basis: legitimate interests and compliance with our legal obligations to honour opt-outs (for example, the US CAN-SPAM Act).
(d) Running and securing the website: hosting, preventing abuse, fixing errors, and understanding overall traffic through aggregated analytics.
Legal basis: legitimate interests in operating a secure and working website (GDPR/UK GDPR Art 6(1)(f); Kosovo Art 5(1.6); Albania Art 7(1)(dh)).
(e) Answering your messages and requests, including privacy requests.
Legal basis: legitimate interests, and where it applies, our legal obligation to respond to rights requests.
(f) Hire board: to show your public profile or job post and to let employers contact you through a private form.
Legal basis: your consent for publishing your profile, photo and résumé (you can withdraw it at any time by hiding or deleting your profile); performance of a contract for running your account and sign-in (GDPR/UK GDPR Art 6(1)(a) and (b); Kosovo Art 5(1.1) and 5(1.2); Albania Art 7(1)(a) and (b)).
(g) Meet a local: to review hosts, check their identity, introduce guests and hosts who both agree, and deal with reports.
Legal basis: legitimate interests, namely the safety of guests and hosts (GDPR/UK GDPR Art 6(1)(f); Kosovo Art 5(1.6); Albania Art 7(1)(dh)), and your consent to be listed as a host.
(h) Photo submissions: to publish your photos on the site and our social pages with the credit you asked for.
Legal basis: your consent, which you can withdraw at any time by asking us to remove the photos.
We do not make decisions about you based solely on automated processing, and we do not profile you.
4. Who processes data for us (service providers)
We use these service providers, who process data on our behalf:
- Google (Gmail): sends and stores our outreach email and correspondence. Data is stored by Google, including in the United States.
- Resend (Plus Five Five, Inc., USA): sends the newsletter and stores subscriber data (email address, signup source, signup language). Resend's privacy policy states that it transfers data to the United States and processes it there.
- Vercel Inc. (USA): hosts the website, processes server logs, and provides Vercel Web Analytics.
- Upstash (via the Vercel Marketplace, USA) and Vercel Blob: store hire board accounts, profiles, job posts, photos and résumés.
- Resend also sends our sign-in codes and form confirmations, and delivers the forms you send us (meet a local, photo submissions, hire board) to our team inbox at Google (Gmail).
- Other services that receive your IP address only if you use them: YouTube (Google), when you choose to play a video; GetYourGuide, when you choose to load its tour widget; and OpenStreetMap, which sends the map images on pages with a map. See Cookies below.
We do not give your personal data to anyone else unless the law requires it (for example, a valid court order).
5. International transfers (to the United States)
We are based in the United States, and our providers process data in the United States. If you are in the EU/EEA, the UK, Kosovo or Albania, your data is therefore transferred to the US. The safeguards are:
- Google LLC states that it complies with the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
- Vercel states that it complies with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
- Resend's Data Processing Addendum includes the EU Standard Contractual Clauses (Commission Decision 2021/914) and, for UK data, the UK Addendum to those clauses.
You can ask us for more information about these safeguards.
6. How long we keep data
- Outreach contacts who never reply: deleted 12 months after our last email.
- Outreach correspondence where you replied but did not object: kept for as long as the conversation or link relationship is active, then 12 months after the last contact.
- Outreach suppression list ("do not contact"): kept indefinitely, with only the minimum needed to honour your objection (your email address, the date you objected, and a note that you objected). This is the only way we can make sure we never contact you again.
- Newsletter: kept until you unsubscribe. After that we keep only your email address and the unsubscribe date on a suppression list, so that we don't email you again.
- Server logs: kept by Vercel for 1 hour on the Hobby plan.
- Web Analytics: the visitor session is discarded after 24 hours; only aggregated statistics are kept.
- Hire board: your profile, photo and résumé are kept until you delete them in your account or ask us to; job posts until you delete them or ask us to. Sign-in codes expire after 10 minutes and sessions after 30 days.
- Meet a local: we delete ID images as soon as the check is done and keep only a note that you were verified and when. Host applications, meeting requests and reports are kept only as long as we need them to handle them, or until you ask us to delete them.
- Photo submissions: kept for as long as the photos are published, or until you ask us to remove them.
7. Your rights
Depending on where you live, you have the right to:
- access: get a copy of the personal data we hold about you;
- rectification: have inaccurate data corrected;
- erasure: have your data deleted (we will keep a minimal suppression record if you have also asked us not to contact you);
- restriction: ask us to limit how we use your data;
- portability: receive data you gave us in a machine-readable format, where processing is based on consent;
- objection: object to processing based on legitimate interests. Your objection to direct marketing (including our outreach) is absolute: once you object, we stop;
- withdrawal of consent: withdraw consent at any time (for example, unsubscribe from the newsletter).
8. How to exercise your rights
Email news@mireseerdhet.com, or for outreach just reply "STOP". We may ask for reasonable information to confirm your identity before we release or delete data, but never to process a simple "stop" request. Exercising your rights is free.
- We respond to rights requests without undue delay and in any case within one month (GDPR/UK GDPR Art 12(3)). In complex cases this can be extended as the law allows, and we will tell you if it is.
- Outreach objections: we stop processing your data for outreach within 8 days of receiving your objection, and confirm this to you in writing within the following 5 days (as required by Kosovo Law 06/L-082, Art 74). In practice we aim to act within 2 business days.
9. Complaints
We'd be grateful if you contacted us first, but you have the right to complain to a data protection supervisory authority:
- United Kingdom: Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint
- EU/EEA: the authority in your country. A list of national authorities is on the European Data Protection Board's members page: www.edpb.europa.eu/about-edpb/about-edpb/members_en
- Kosovo: Information and Privacy Agency (Agjencia për Informim dhe Privatësi, AIP): aip.rks-gov.net
- Albania: Information and Data Protection Commissioner (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale, IDP): idp.al
10. Children
mireseerdhet.com and our newsletter are not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child under 16 has given us personal data, contact us and we will delete it.
11. No sale of personal data
We do not sell your personal data, and we do not share it for cross-context behavioural (targeted) advertising, as those terms are used in US state privacy laws.
12. Affiliate links and sponsors
Some links to Expedia, DiscoverCars and GetYourGuide are paid links: if you book through them we may earn a commission. We don't send these companies your name or email address. They see that you clicked our link and any booking you make with them, under their own privacy policies. Sponsored content, if any, is always labelled "Sponsored".
14. Security
We protect personal data with reasonable measures. These include using reputable providers, enabling two-factor authentication on the accounts we use, limiting access to Bati Rexha only, encrypting connections to the website (HTTPS), and keeping only the data we need. No method of transmission or storage is completely secure.
15. Changes to this notice
We may update this notice. We will publish the new version on this page with a new effective date and, if a change is significant, tell newsletter subscribers by email.
Effective date: 23 October 2026