Privacy policy
Updated on 12 October 2026
The Institute of Certified Accountants of Albania (IKM) attaches importance to protecting the personal data of its members, candidates and all persons who visit ikm.org.al or communicate with the Institute. Personal data are processed in accordance with Law No. 124/2024, dated 19.12.2024, “On personal data protection”, which aligns Albanian legislation with the European Union General Data Protection Regulation (GDPR).
1. Data controller
- Controller
- Institute of Certified Accountants of Albania (IKM)
- Address
- Rruga e Elbasanit, Pallati Edil AL-IT, Kati i II-të, Nr. 323, Tiranë
- Personal data
- info@ikm.org.al
- Telephone
- +355 42 347 585
2. Scope
This policy applies to ikm.org.al, to the membership, registration and training forms opened from it, to the Member Portal and to the Public Register published on the site.
3. Data processed and purposes
3.1 Site visits and security
During a visit, the site’s server and security tools (the firewall and protection against unauthorised login attempts) record the IP address, the date and time of access, the page requested and basic information about the browser. These data are used only for the security and operation of the site, on the basis of IKM’s legitimate interest (Article 7, paragraph 1, letter “dh” of Law No. 124/2024).
3.2 Usage statistics
IKM uses Google Analytics 4 to understand how the site is used: the pages visited, the duration of the visit, the type of device and the source of the visit. Google Analytics places cookies in the browser and processes the data on Google’s servers. IKM uses these statistics only in aggregate form, to improve the site, on the basis of its legitimate interest. This processing can be limited through browser settings or with Google’s browser add-on for disabling Google Analytics.
3.3 Fonts and map
The site’s fonts are loaded from IKM’s own server, with no connection to external services. The Contact page displays a Google Maps map: when the map loads, the browser connects directly to Google’s servers, which receive the IP address, and the map may also place its own cookies. This processing is based on the legitimate interest in directing visitors to IKM’s offices.
3.4 Correspondence
When a person writes to IKM by email, at ikm.alb@gmail.com or at info@ikm.org.al, or contacts it by telephone, their name, contact details and the content of the message are processed solely in order to respond to the request. The address ikm.alb@gmail.com relies on Google’s Gmail service.
3.5 Membership and the Member Portal
Applications for membership as a Certified Accountant, as an Accounting Firm or as a candidate are made through online forms. This process involves the processing of identification and contact data, the CV, the diploma and professional certificates, a photograph, criminal record certificates, the NUIS and the other documents required by law and by IKM regulations. The Member Portal is used to administer membership, annual declarations, Continuing Professional Development and licences.
This processing is carried out to fulfil IKM’s legal obligations under Law No. 10091, dated 05.03.2009, as amended, and the IKM Statute (Article 7, paragraph 1, letter “c” of Law No. 124/2024). Criminal record certificates are processed only to verify the legal conditions for practising the profession, with restricted access. Without these data, a membership application cannot be considered.
3.6 Registration for training
Registration for Continuing Professional Development training, Initial Professional Development training and certification programmes is made through forms on the JotForm platform. The name, contact details, professional status and proof of payment are processed in order to organise the training, record attendance and issue certificates. This processing is based on the legal obligations concerning Continuing Professional Development and on the relationship of participation in the training (Article 7, paragraph 1, letters “b” and “c” of Law No. 124/2024).
3.7 Public Register
In accordance with paragraph 2 of Article 51 of Law No. 10091, IKM publishes the Public Register of Certified Accountants and Accounting Firms. For each entry, the name, father’s name and surname, employment status, certificate number and year, and the NUIS are published. Publication is a legal obligation and enables clients, institutions and the public to verify registered professionals. Requests to correct data in the register may be sent to info@ikm.org.al.
3.8 User accounts
For restricted-access sections, IKM creates user accounts for authorised persons. The username, the email address and the password in encrypted form are stored, while technical cookies keep the login session active. The site does not offer the option to post comments.
4. Cookies
Cookies are small files stored in the browser. The site uses technical cookies, which are necessary for its operation and security, as well as Google Analytics statistical cookies.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| _ga | Google Analytics | Distinguishes visitors in the usage statistics | 2 years |
| _ga_5V1EB5BCKJ | Google Analytics | Stores the session state for statistics | 2 years |
| wordpress_*, wfwaf-authcookie-* | IKM | Keep the login session active and protect the site; set only for authorised users | For the duration of the login session |
| Map cookies | Google Maps | Set by the map on the Contact page | According to Google’s policy |
Cookies can be deleted or blocked through browser settings. Blocking statistical cookies does not affect use of the site, while blocking technical cookies may prevent access to restricted-access sections.
5. Recipients of the data
IKM does not sell or rent out personal data. The data are disclosed only to:
- IKM staff and bodies that need them to perform their duties, such as the Registration and Licensing Committee or the Education and Professional Qualification Committee;
- service providers that process the data on IKM’s behalf, including the site’s hosting provider and the providers listed below;
- public authorities, such as the Public Oversight Board, where required by law.
| Provider | Service | Place of processing |
|---|---|---|
| Google Analytics, Google Maps, Gmail | USA and other countries | |
| Zoho | Membership forms and the Member Portal | European Union |
| JotForm | Training registration forms and candidate forms | USA |
6. Transfer of data outside Albania
Some of the above providers process data outside Albania, in the European Union or in the United States of America. Where the destination country does not provide an adequate level of protection, the transfer relies on the safeguards provided for by Law No. 124/2024, such as the standard contractual clauses that these providers include in their data processing terms.
7. Retention period
Data are kept only for as long as they are needed for the purpose for which they were collected, according to the following criteria:
- membership and register data, throughout the period of membership and thereafter for as long as required by legislation and archiving obligations;
- training and Continuing Professional Development data, for as long as they are needed to certify hours and certificates, in accordance with IKM regulations;
- correspondence, for as long as it is needed to handle and follow up the request;
- technical security logs, for a short period, according to the settings of the security tools;
- Google Analytics statistics, according to the retention period set in the service settings.
After these periods, the data are deleted or anonymised.
8. Data security
IKM takes technical and organisational measures to protect data. The site uses an encrypted connection (HTTPS) and is protected by a firewall and by limits on login attempts; access to data is granted only to authorised persons, and backup copies of the site are kept regularly.
9. Rights of data subjects
Under Articles 13–20 of Law No. 124/2024, every person whose data are processed by IKM has the right:
- to be informed about the processing of their data;
- to access their data and obtain a copy of them;
- to request the correction of inaccurate or incomplete data;
- to request the erasure of data (the right to be forgotten), where there is no longer a legal basis for retaining them;
- to request the restriction of processing;
- to request the portability of data they have provided themselves;
- to object to processing based on IKM’s legitimate interest;
- not to be subject to decisions based solely on automated processing;
- to withdraw consent at any time, where processing is based on it, without affecting the lawfulness of processing carried out before the withdrawal.
Requests to exercise these rights are sent to info@ikm.org.al. IKM responds to a request within 30 days of receiving it; where the request is complex, this period may be extended to up to 60 days, and the person is informed of the reasons for the extension within the first 30 days. To protect the data, IKM may request verification of the identity of the person submitting the request. Some rights are subject to limitations where processing is carried out in fulfilment of a legal obligation, as in the case of the Public Register.
10. Right to lodge a complaint
Where a person considers that their data are not being processed in accordance with the law, IKM invites them to make contact first at info@ikm.org.al, so that the matter can be resolved as quickly as possible. Every person also has the right to lodge a complaint with the Commissioner for the Right to Information and Personal Data Protection.
- Address
- Rr. “Abdi Toptani”, Nd. 5, 1001 Tiranë
- info@idp.al
- Telephone
- +355 42 23 7200
- Website
- idp.al
11. Minors
The site and IKM’s services are aimed at professionals and candidates for the profession, and are not intended to collect data from persons under 16 years of age.
12. Changes
The policy is updated when the services used by the site or the data protection legislation change. The date of the last update is shown at the top of the page.