Privacy Policy

This Privacy Policy explains how Vegza Business Hub (“Vegza”, “we”, “us”) collects, uses, stores and protects personal data through its website, booking platform and related communications.

Vegza Business Hub is operated by VHub Business SH.P.K., registered in Kosovo under unique identification number (NUI) 812467521, with its registered address at Robert Doll, 2, Prishtinë, Republic of Kosovo. VHub Business SH.P.K. is the data controller responsible for the processing described in this policy. Privacy enquiries may be sent to info@vegzahub.com.

1. Personal Data We Collect

We collect information you provide when submitting a booking request, completing a contact form or communicating with us. This may include:

• Your name, email address, telephone number and company name.
• Billing details for payment requests and invoices: your company’s name and business number (NUI), or your address.
• The space, dates and other booking details you request.
• Your messages, notes and any attachments you send.

Our website and service providers also process technical information automatically, including IP addresses, request times, browser and connection information, and requested page addresses. This information supports website operation, security and abuse prevention.

If you accept analytics cookies, we also collect information about how you use the public website, as described in section 4.

Providing booking or contact information is voluntary. However, we may be unable to assess or respond to your request without the information required for that purpose. Optional fields do not need to be completed.

2. Purposes and Legal Bases

We process personal data for the following purposes:

• Booking requests and bookings: to assess availability, respond to your request and administer a booking. Where you are the contracting party, this processing is necessary to take steps at your request before entering into a contract or to perform that contract.
• Business enquiries and administration: to answer questions, communicate with company representatives and organise space availability, based on our legitimate interest in managing our services and business communications.
• Security and accountability: to prevent automated abuse, protect accounts, investigate incidents and maintain appropriate activity records, based on our legitimate interest in operating a secure and reliable platform.
• Website analytics: to understand how visitors use the public website and to improve it, based on your consent. You may withdraw your consent at any time, as described in section 4.
• Legal requirements and claims: where necessary to comply with applicable legal obligations or establish, exercise or defend legal claims.

Where we rely on legitimate interests, we consider your rights and interests when assessing whether the processing is necessary and proportionate.

We do not sell personal data or use it for advertising or third-party marketing.

3. Form Protection

Our forms use Cloudflare Turnstile to distinguish legitimate visitors from automated abuse. Turnstile loads when you interact with a form, rather than during ordinary browsing of other pages.

Cloudflare processes technical signals such as your IP address and browser and connection information. It processes these signals on our behalf to provide protection and also under its own responsibility to improve its bot-detection capabilities.

Further information is available in the Cloudflare Turnstile Privacy Addendum and Cloudflare Privacy Policy.

4. Cookies and External Links

With your consent, we use analytics cookies to understand how visitors use the public website, such as which pages are viewed and how visitors arrive at the website. We do not use them for advertising.

Analytics cookies are set only after you select Accept in the cookie banner. If you select Reject or make no choice, they are not set. Your choice does not affect your use of the website or the booking platform.

You can change your choice at any time under Cookie settings in the website footer. If you withdraw your consent, the analytics cookies are deleted from your browser for this website.

Apart from these analytics cookies, which are set only with your consent, the public website does not set visitor cookies during ordinary browsing.

Essential platform cookies support staff sign-in, two-factor authentication and remembered devices. Where access to the website is restricted by a password, an additional essential cookie remembers successful access.

Space pages do not embed a third-party map. Selecting the location banner or “Open in Google Maps” opens an external Google Maps page, where Google’s privacy policy applies.

5. Access and Service Providers

Access to booking requests, correspondence and administrative records is limited to authorised Vegza staff according to their roles.

Service providers may process relevant personal data to supply hosting, storage, communications, security and other platform functions. Cloudflare provides platform infrastructure and security services.

An authorised staff member may connect Claude, an AI service provided by Anthropic, to the staff area. When this connection is used, records accessible through it may be transmitted to Anthropic for processing. The connection is limited by the permissions of the staff member who authorises it.

International providers may process personal data outside Kosovo. Such transfers must satisfy applicable data protection requirements. You may contact us for information about the relevant processing locations and transfer safeguards.

We may also disclose personal data where required by law or where necessary to establish, exercise or defend legal claims.

6. Email Activity Records and Technical Logs

For correspondence handled through info@vegzahub.com, the staff area records which team member opens, downloads, moves or replies to an email. These activity records contain the email subject, email addresses, folder information, and attachment names and sizes. They do not contain copies of email bodies or attachment contents. The correspondence itself is handled separately.

Cloudflare request logs may record page and request addresses, including a private booking-status link or search terms entered by staff in the inbox. These records are used for platform operation, troubleshooting and security.

7. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy:

• Booking requests and correspondence: while assessing and responding to the request and, where a booking follows, while administering that booking and resolving related enquiries.
• Records needed for legal obligations or claims: for the applicable statutory period or for as long as necessary to establish, exercise or defend the relevant claim.
• Security and staff activity records: for the period needed to investigate incidents, verify authorised activity and resolve operational issues. Cloudflare logs are subject to the retention settings applicable to the services used.

When retention is no longer necessary, the relevant data is deleted or anonymised.

Encrypted platform backups may contain booking requests and related records. Daily backups are retained for 30 days, and monthly backups for 365 days. Data removed from live systems may remain in existing backups until those backups expire under this schedule.

8. Data Security

We use role-based access, staff authentication and encrypted backups to help protect personal data against unauthorised access, loss, alteration or disclosure. Access is limited according to operational responsibilities.

9. Your Rights

Subject to the conditions and exceptions in applicable law, you may request:

• Access to your personal data and a copy of it.
• Correction of inaccurate or incomplete data.
• Deletion of your data.
• Restriction of processing.
• Data portability, where applicable.

You may also object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent without affecting the lawfulness of earlier processing.

To exercise your rights, email info@vegzahub.com. We may request information reasonably necessary to verify your identity. Requests are normally handled free of charge and answered within one month of receipt. Where a lawful extension is necessary, we will explain the reason within that initial month.

You may lodge a complaint with Kosovo’s Information and Privacy Agency or another competent supervisory authority where applicable.

10. Changes to This Policy

We may update this policy to reflect changes to our services, processing practices or legal requirements. The current version will be published on this page with its updated date. Where required by law, we will provide additional notice of material changes.

11. Contact

For questions about this policy or the handling of your personal data, contact:

Vegza Business Hub — VHub Business SH.P.K.

Unique identification number (NUI): 812467521

Registered address: Robert Doll, 2, Prishtinë, Republic of Kosovo

Email: info@vegzahub.com