Privacy Policy
How MAXTV collects, uses and protects your personal data.
Last updated
This policy explains what personal data MAXTV processes when you use the MAXTV mobile app, the customer portal, and our internet and television services. It is written to be read, not to be signed unread.
Processing is carried out under Law No. 06/L-082 on the Protection of Personal Data of the Republic of Kosovo, which follows the GDPR.
1. Who is responsible for your data
The data controller — the party that decides why and how your data is processed — is:
| Registered name | MaxTV SHPK |
| Business number (ARBK/NUI) | 810200501 |
| Fiscal / VAT number | 601730220 |
| Address | Rr. Ilaz Kodra Nr. 134, Skenderaj, Republic of Kosovo |
| info@maxtv-ks.net | |
| Phone | +383 44 991 992 · +383 44 943 005 · +383 48 991 992 |
| Privacy contact | info@maxtv-ks.net |
MAXTV is licensed by ARKEP (Regulatory Authority of Electronic and Postal Communications) and by the IMC (Independent Media Commission).
2. In short
- Your identity with us is your phone number. There is no signup form and we do not ask for a name in order to sign in.
- We do not sell your data. To anyone, ever.
- There is no advertising, no ad tracking and no advertising profiling in the app.
- Your bank card details never pass through our servers.
- You can request deletion of your account at any time.
3. What we process, and why
| Category | What it actually contains | Why | Legal basis |
|---|---|---|---|
| Identity and sign-in | Your phone number in international format, the one-time code (stored hashed), your password (stored only as a bcrypt hash — never in the clear) | To let you into your account, and to keep everyone else out of it | Performance of the contract; our legitimate interest in security |
| Customer details | Name, email, address. These are mirrored from our subscription system (AlbiSmart) — the authoritative source is your contract, not what you type into the app | To know who you are as a customer and to issue valid invoices | Performance of the contract; legal obligation (tax) |
| Subscription and service | Package, price, billing cycle, installation address, start and renewal dates, service status | To provide the service and show you its state | Performance of the contract |
| Billing | Invoice number, period, subtotal, VAT, total, payment status, any promotional codes used | To bill you and to keep our accounting records | Performance of the contract; legal obligation |
| Payments | Transaction reference, amount, status and the payment processor’s response. For saved cards: a processor token — a string that is meaningless outside their system — and a label such as the brand and last four digits. Never the full card number, never the CVV | To take payment and reconcile it against the invoice | Performance of the contract |
| Support cases | Case number, type, description, the whole conversation on the case timeline, and any photos you attach yourself | To resolve your problem and keep a record of what was done | Performance of the contract; our legitimate interest in service quality |
| Notifications | Push notification device token, platform (iOS/Android), preferred language | To tell you about invoices coming due, outages and replies to your cases | Performance of the contract; your consent at the operating-system level |
| Sessions | A hash of the refresh token, device or browser type, expiry time | To keep you signed in safely and to let you sign out | Our legitimate interest in security |
| Usage and measurements | Speed tests you run yourself, and the daily usage figures shown in the app | To show you how your connection is behaving | Performance of the contract |
| Enquiries without an account | The name, phone number, address and note you enter in the coverage or order form | To contact you about your request for service | Steps taken at your request prior to entering a contract |
4. What we do NOT do
- We do not collect your device location. The app never asks for GPS permission.
- We do not read your contacts, calendar, microphone or photo library. Photos are accessed only at the moment you pick one to attach to a case.
- There is no advertising identifier, social-network pixel or third-party analytics SDK in the app.
- We do not process special categories of data (health, political opinions, biometrics).
- We do not make automated decisions with legal effect on you, with one declared exception: suspension of service for unpaid invoices, described below.
5. The automated service-suspension decision
Our system suspends service automatically when an invoice remains unpaid past its due date, and restores it automatically as soon as the debt is settled. There is no grace period.
This acts on a single verifiable fact — whether the invoice is paid — and not on profiling. You have the right to ask for human intervention by opening a case in the app or calling us.
6. Where the data comes from
- From you: your phone number, what you write in cases, the photos you attach, and the coverage and order forms.
- From our subscription system (AlbiSmart): name, email, address, package and service expiry date. This is the authoritative source for your contract details.
- From your device, automatically: the notification token, device or browser type, and your IP address in technical server logs.
7. Who we share it with
We do not sell or rent your data. We share it only with the providers the service needs to function, each of them contractually bound to use it only on our instructions:
| Provider | Role | What it receives |
|---|---|---|
| AlbiSmart | Subscription management system | Customer and subscription details, and confirmation of payment when you renew |
| ProcardPay / Paysera Kosovo | Card payment processor | The amount, the order reference, and the card details you enter directly on their secure page |
| Google — Firebase Cloud Messaging | Push notification delivery | The device token and the text of the notification |
| iletimx | SMS gateway | Your phone number and the one-time code, at the moment of sending only |
| Resend | Email delivery | Your email address and the contents of the invoice or payment confirmation |
| Trello (Atlassian) | Internal dispatch board for the field team | Case number, description, installation address and the correspondence about the job |
| MaxTV SHPK — self-managed infrastructure | Server and database hosting | All stored data, at rest |
We may also disclose data to public authorities where we are legally required to, and to our legal or accounting advisers where necessary.
8. Payments and saved cards
You enter your full card number, expiry date and CVV on the payment processor’s page, not in our app. That data never reaches MAXTV’s servers and we have no technical means of reading it.
If you choose to save a card for future payments, the processor returns a token — a string with no meaning outside their system — and a label such as “Visa ···· 4242”. Those two are all we store. Deleting the card in the app removes the token and, if it was your last card, switches auto-renewal off.
9. Notifications
We notify you about invoices coming due, service suspension and restoration, replies to your cases, outages in your area, and general announcements from MAXTV.
You can turn push notifications off at any time in your phone’s settings. That does not stop in-app notifications, because some of them concern billing and you need to see them.
10. How long we keep it
| Data | Retention period |
|---|---|
| Invoices and payment records | As required by Kosovo tax legislation — 6 years |
| Account and subscription data | For as long as you are a customer, plus 12 months after the contract ends |
| Cases and attached photos | 24 months after the case is closed |
| One-time codes | Five minutes, then deleted or marked used |
| Sessions | Until you sign out or the session expires |
| Coverage enquiries without an account | 12 months after last contact |
| Technical server logs | 12 months |
11. Security
- Traffic between the app and our servers is encrypted with TLS.
- Passwords are stored only as bcrypt hashes. Nobody at MAXTV can read your password.
- Session tokens are stored hashed, so a stolen copy of the database is not a usable credential.
- One-time codes expire within minutes, allow a limited number of attempts, and are single-use.
- Staff access to customer data goes through individual accounts with short-lived sessions.
No system is perfectly secure. If a breach occurs that puts your rights at risk, we will notify you and the Information and Privacy Agency within the legal deadlines.
12. Your rights
Under Law No. 06/L-082 you have the right:
- To know what data we hold about you and to receive a copy of it.
- To have inaccurate data corrected.
- To have data erased, where we are not legally required to keep it.
- To have processing restricted while a dispute is resolved.
- To object to processing based on our legitimate interest.
- To receive your data in a machine-readable format and take it to another provider.
- To withdraw consent where processing relies on it. Withdrawal does not affect processing already carried out.
- To ask for human intervention in an automated decision.
- To lodge a complaint with the supervisory authority.
To exercise these rights, write to info@maxtv-ks.net from the address we hold for you, or call +383 44 991 992. We respond within 30 days. To protect your account we may ask you to verify your identity — usually with a code sent to your number.
The supervisory authority is the Information and Privacy Agency of the Republic of Kosovo (AIP), Pristina.
13. Account deletion
You can request deletion of your app account at any time. The procedure, what is deleted and what has to be kept for legal reasons are set out on the separate “Account deletion” page.
14. Children
The app is intended for people who hold, or want to hold, a service contract with MAXTV — that is, people aged 18 and over. We do not knowingly collect children’s data. If you believe a child has created an account, write to us and we will delete it.
15. Transfers outside Kosovo
Some of the providers listed above run servers outside the Republic of Kosovo, mainly within the European Union. Where data is transferred abroad we do so on the basis of standard contractual clauses or an adequacy decision, under Article 39 and following of Law No. 06/L-082.
16. Changes to this policy
When we change this policy we update the date at the top of the page. For changes that materially affect your rights we will notify you in the app or by email before they take effect.
17. Contact
For any privacy question: info@maxtv-ks.net, +383 44 991 992, or in writing to Rr. Ilaz Kodra Nr. 134, Skenderaj, Republic of Kosovo.