Privacy Policy

Last updated: September 2026

This Privacy Policy explains how personal data is collected, used, stored and protected when you visit penafellowship.al, contact the PENA team, or submit an application for the Press Education and Newsroom Access (PENA) Fellowship.

PENA is a nine-month fellowship for Albanian journalists that includes professional training in Tirana, media experience in the United States, mentorship and the development of a journalism project.

We are committed to handling personal data responsibly, transparently and securely in accordance with applicable data protection legislation, including Albanian Law No. 124/2024 “On Personal Data Protection”.

1. Who is responsible for your personal data?

The controller responsible for personal data processed through this website and the PENA Fellowship is:

Albanian-American Development Foundation (AADF)

“Ibrahim Rugova” Street
Building no. 42, Entrance no. 7
Apartment no. 60
1019 Tirana, Albania

For questions about this Privacy Policy, your application or the use of your personal data, please contact:

Email: [email protected]

2. Personal data we collect

Fellowship applications

When you apply for the PENA Fellowship, we collect the information necessary to assess and manage your application.

This may include:

• First name and surname
• Email address
• Curriculum vitae (CV)
• Motivation letter
• Journalism portfolio and work samples
• Copy of your completed undergraduate degree
• Copy of your Albanian passport
• Education and professional experience
• Nationality and citizenship information
• Date of birth and other information contained in your passport
• Information contained in documents or materials you choose to submit

Your portfolio or other submitted materials may also contain information relating to other individuals.

Please submit only information that is relevant to your PENA application and avoid including unnecessary sensitive or confidential personal information.

Required fields and documents are identified in the application form. Applications that do not contain the required information may not be submitted or considered.

Communications with us

If you contact the PENA team by email or another communication channel, we may collect:

• Your name
• Your email address
• The content of your message
• Any information or documents that you choose to provide

Technical and security information

When you use the website, certain technical information may be processed automatically, including:

• IP address or a protected representation of your IP address
• Browser and device information
• Date and time of requests
• Server and security logs
• Information required to detect errors, abusive activity or attempted unauthorized access

We do not use this technical information to make fellowship selection decisions.

3. Why we use your personal data

Managing fellowship applications

We use application information to:

• Verify that applicants meet the fellowship eligibility requirements
• Assess applicants’ education and professional experience
• Review motivation letters and journalism work samples
• Verify identity, citizenship and eligibility where required
• Evaluate and select fellowship participants
• Communicate with applicants about their application
• Arrange interviews or other stages of the selection process
• Notify applicants about selection outcomes
• Administer the fellowship for successful applicants

Submitting an application does not guarantee selection for the fellowship.

Administering selected fellows

For applicants who are selected, additional processing may be necessary to organize and administer the fellowship.

This may include processing information required for:

• Professional training
• Travel arrangements
• Insurance
• Accommodation
• Media placements
• Mentorship
• Fellowship activities
• Journalism projects
• Administrative and reporting requirements

Where additional personal information is required for these purposes, selected fellows may receive further information about how that data will be processed.

Operating and protecting the website

Technical information may be processed to:

• Operate and maintain the website
• Process application submissions
• Prevent spam and automated submissions
• Detect and investigate security incidents
• Troubleshoot technical problems
• Protect the website and application system against unauthorized access

Responding to enquiries

Information submitted through email or other communication channels is used to respond to enquiries and provide information about PENA.

4. Legal basis for processing

We process personal data only where there is an appropriate legal basis under applicable data protection legislation.

Depending on the particular processing activity, this may include:

• Processing necessary to take steps at your request in connection with your fellowship application
• Processing necessary for the administration of the fellowship
• Compliance with applicable legal obligations
• Our legitimate interests in operating, protecting and administering the PENA Fellowship and website
• Your consent, where consent is specifically requested and is the appropriate legal basis

Where we rely on consent, you may withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Certain information, including identity documentation, is requested only where it is considered necessary to verify eligibility or administer the fellowship.

5. Who has access to your personal data?

Access to fellowship applications and uploaded documents is restricted to authorized persons who require access for application review or fellowship administration.

Application documents are not intended to be publicly accessible and are not published in the website’s public Media Library.

Authorized administrators must authenticate before accessing or downloading protected application documents.

Depending on the stage of your application or participation in PENA, information may also be shared with organizations or service providers involved in operating the fellowship, such as:

• Authorized members of the PENA selection and administration team
• Albanian-American Development Foundation (AADF) personnel involved in the program
• Organizations involved in fellowship selection where applicable
• Hosting and infrastructure providers
• Email delivery providers
• IT and security service providers
• Fellowship partners
• Training or mentorship providers
• U.S. media placement organizations for selected fellows
• Travel, accommodation or insurance providers where necessary
• Professional advisers
• Public authorities where disclosure is required by law

These recipients should receive only the information reasonably necessary for the relevant purpose.

6. Service providers

We may use third-party service providers to help operate the website and fellowship.

Website hosting

Our hosting provider may process technical information, website files, application information and server logs as necessary to provide hosting, security, backup and infrastructure services.

Transactional email

PENA uses Postmark for transactional email delivery.

Email addresses, recipient information and the content of transactional messages may therefore be processed by Postmark for email delivery purposes.

Application documents are not attached to automated staff notification emails.

Transactional notifications generated by the application system are designed without advertising tracking and do not request open or link tracking.

7. International transfers

Some organizations or service providers involved in the PENA Fellowship may operate outside Albania.

This is particularly relevant to the United States component of the fellowship and to international technology providers.

Where personal data is transferred outside Albania, appropriate measures will be used as required by applicable data protection legislation.

Depending on the destination and circumstances, these measures may include:

• Transfers to jurisdictions recognized as providing an adequate level of data protection
• Appropriate contractual safeguards
• Technical and organizational safeguards
• Other legally permitted transfer mechanisms

Applicants selected for a U.S. placement may receive additional information regarding personal data that needs to be shared with placement organizations or other service providers.

8. Cookies and similar technologies

Application form

The PENA application system may use a short-lived cookie to:

• Display the result of an application submission
• Restore certain entered contact information following an application error

The cookie contains a random identifier rather than uploaded application documents and expires after approximately 10 minutes.

Abuse prevention

The website may temporarily generate and store a protected, keyed representation of an IP address in order to limit repeated or abusive application submissions.

This information may be retained for up to approximately one hour.

WordPress

WordPress uses authentication and related cookies for authorized users who sign in to the website administration dashboard.

These cookies are necessary for administrative functionality and security.

Analytics and advertising

At the date of this Privacy Policy, the PENA website does not intentionally use advertising trackers through the PENA theme.

If analytics, advertising or other non-essential tracking technologies are introduced in the future, this Privacy Policy and, where required, the website’s consent mechanisms will be updated accordingly.

9. External links and social media

The website may contain links to third-party websites or social-media platforms.

These links do not mean that PENA or AADF controls how those third parties process personal data.

When you leave penafellowship.al and visit another website or platform, that organization’s own privacy policy and terms apply.

We encourage you to review the privacy information provided by those services.

10. How long we keep personal data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to comply with applicable legal, administrative or record-keeping requirements.

Retention periods may vary depending on the type of information, the purpose for which it was collected and any applicable legal obligations.

Information relating to fellowship applications should be reviewed periodically and deleted or anonymized when it is no longer necessary for the application process, fellowship administration or applicable legal and record-keeping requirements.

Identity documents, including passport copies, should not be retained for longer than necessary for eligibility verification and fellowship administration unless continued retention is required by law or for another legitimate purpose.

Information relating to selected fellows may be retained for longer where necessary for fellowship administration, reporting, financial, legal or record-keeping purposes.

Technical and security logs may be retained for a limited period where necessary for website operation, troubleshooting, fraud prevention and security.

Backup copies may remain temporarily within normal backup cycles after information has been removed from active systems.

Personal data should be securely deleted or anonymized when it is no longer required, unless continued retention is required by law or necessary for the establishment, exercise or defence of legal claims.

Deleting an application permanently from the website’s administration system removes its associated stored application documents according to the system’s deletion process.

Moving an application to the WordPress Trash alone may not constitute permanent deletion.

11. How we protect personal data

We use appropriate technical and organizational measures intended to protect personal information from unauthorized access, disclosure, alteration, loss or destruction.

Measures implemented through the website include, where applicable:

• HTTPS encrypted connections
• Restricted administrative access
• Authentication for administrative users
• Protected application-document downloads
• Storage of application documents outside publicly accessible website directories
• File type and file size validation
• Submission-rate limiting
• Server and application security controls
• Access limited to personnel who require the information for their role

Despite these measures, no internet transmission or electronic storage system can be guaranteed to be completely secure.

Applicants should not send additional passports or other sensitive identity documents by ordinary email unless specifically requested by the PENA team and an appropriate method has been agreed.

12. Your data protection rights

Subject to the conditions and exceptions provided by applicable law, you may have the right to:

• Request confirmation that we process personal data about you
• Request access to your personal data
• Request correction of inaccurate or incomplete personal data
• Request deletion of your personal data
• Request restriction of certain processing
• Object to certain processing
• Request portability of your personal data where applicable
• Withdraw consent where processing is based on consent
• Obtain information about recipients of your personal data where applicable
• Lodge a complaint with the competent data protection authority

Some of these rights depend on the legal basis and circumstances of the processing and may not apply in every situation.

To exercise your rights, contact:

[email protected]

We may need to verify your identity before responding to a request in order to protect your information from unauthorized disclosure.

13. Complaints

If you have concerns about how your personal data is processed, we encourage you to contact us first at:

[email protected]

You also have the right to lodge a complaint with the Albanian supervisory authority:

Commissioner for the Right to Information and Protection of Personal Data

Website: https://idp.al/

The exercise of your right to complain does not prevent you from pursuing other remedies available under applicable law.

14. Changes to this Privacy Policy

We may update this Privacy Policy when our practices, fellowship activities, service providers or legal obligations change.

The current version will always be published on this page.

Where a change materially affects how existing personal data is processed, we will take additional steps to provide notice where required by applicable law.

Last updated: September 2026