Privacy policy
Last updated 13 October 2026
This text is a draft written from how the site technically works and has not yet been reviewed by a lawyer. It must be approved by legal counsel before final publication.
This page explains which personal data we collect when you use shemo-pharm, why we collect it and what you can ask of us. It is short, because the site collects little.
Who is responsible
The controller for this processing is SHEMO PHARM, Rr. Raif Elezi 34, 20000 Prizren, Kosovo.
For any question about your data, write to info@shemopharm.com or call +383 (0) 49 600 934.
What we collect, and when
Contact form: the name, company, phone number, email address, subject and message you write. We keep these so we can answer you and so the enquiry is not lost.
Partner registration: name, company, phone, email and a password. The password is never stored as you typed it — only a value derived from it is kept, and the password cannot be recovered from that value.
Orders: the products and quantities you put in the basket, the channel you choose (WhatsApp or email) and, if you are signed in, your account's name and email.
We collect no health data, and we never ask for data that is not needed for the business relationship.
Legal basis
Contact-form and registration data are processed in order to prepare or perform a business relationship with you or your company.
The minimal technical data described below is processed on our legitimate interest in keeping the site working and protected from abuse.
Cookies and browser storage
We use a single cookie, shemo_session. It is created only when you sign in, keeps your session for seven days and cannot be read by scripts on the page. Without it you cannot sign in — which is what makes it strictly necessary.
The basket and the wishlist are stored in your own browser, under shemo-cart and shemo-wishlist. They hold only product identifiers and quantities, contain no personal data, and are sent nowhere until you send an order yourself.
We use no analytics tool, no advertising pixel and no third-party script. That is why this site shows no cookie consent banner: there is nothing to consent to.
Who processes data for us
The site is hosted on Vercel, the database runs on Neon and photographs are served from Vercel Blob. Transactional email — address verification and password reset — is sent through Resend.
When you send an order over WhatsApp, the order text passes through WhatsApp and is subject to Meta's terms. If you would rather avoid that, use email or the phone.
IP addresses
To stop the forms and the sign-in from being abused, we count requests per visitor. Your IP address is not stored in full: only a hashed value derived from it is kept, which cannot be turned back into an address and identifies no one.
How long we keep it
Contact messages and orders are kept for as long as they are needed for the business relationship and for statutory record-keeping obligations.
Partner accounts are kept until you ask for the account to be deleted.
Your rights
You have the right to request access to your data, its correction, its deletion, a restriction of processing, and to object to processing.
To exercise these rights, write to info@shemopharm.com. We answer within the periods set by data-protection law.
If you believe your data has not been handled properly, you may complain to the Information and Privacy Agency of the Republic of Kosovo.
Changes to this policy
If we change how we process data, we update this page and the date above.