Privacy Policy

1. Overview

Elara EOR L.L.C. ("Elara", "we", "us") respects your privacy and is committed to protecting personal data. This Privacy Policy explains how we collect, use, and safeguard personal information when operating our business and delivering our Employer of Record (EOR) and related services.

This policy applies to individuals who interact with us, including clients, prospective clients, employees engaged through Elara, candidates, business partners, and visitors to our website.

Elara EOR L.L.C. is a limited liability company registered in the Republic of Kosovo. It trades under the name Elara and supports businesses hiring and employing talent in Kosovo.

2. Who We Are

For the purposes of applicable data protection law, Elara acts as a data controller where we determine how and why personal data is processed. As the legal employer in Kosovo, we are a controller of employee and candidate data for employment purposes. We act as a data processor only for limited tasks we carry out on a client's documented instructions.

• Legal entity: Elara EOR L.L.C. (limited liability company, Republic of Kosovo)
• Registered office: Shpëtim Robaj 247, Prishtinë, Republic of Kosovo
• Registration: Kosovo Business Registration Agency (ARBK), unique identification number 812411833, registered on 4 May 2026
• Contact: info@elara-eor.com

If you have questions about this policy or how we handle personal data, you can contact us using the details above.

3. Legal Basis

We process personal data in accordance with applicable data protection legislation, including:

• Law No. 06/L-082 on Personal Data Protection of the Republic of Kosovo
• Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), where it applies to individuals in the European Union
• The UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018, where we process personal data relating to individuals located in the United Kingdom

Where relevant, we also comply with Kosovo employment and labour laws when processing employee data.

4. Personal Data We Handle

The personal data we collect depends on the nature of your relationship with Elara.

Business and Client Contacts

This may include names, job titles, business contact details, contractual information, billing details, and communications.

Employees and Candidates

This may include identification documents, contact details, employment history, qualifications, payroll and tax information, bank details, right-to-work documentation, and information required to manage employment relationships.

Candidate Applications on Our Website

When you apply through the form on our Candidates page, we collect the information you enter, which may include your name, email address, phone number, country and city, nationality, right-to-work status, LinkedIn profile, desired role, experience, current employment status, salary expectations, earliest start date, preferred work type, languages, your CV and any additional information you choose to share. The form is part of GoHighLevel, the customer relationship management (CRM) system we use, which stores the application on our behalf (see section 7).

Follow-up Information and Profile Confirmation

We may email you to ask for more information about your application, for example about your experience, skills or availability, or to ask you to confirm that the profile we hold about you is accurate. We keep your replies with your application.

Enquiries and Messages

When you contact us, or we contact you, by email, WhatsApp or SMS, we keep your contact details and the messages we exchange in our CRM, so that we can reply, keep a record of what was agreed and stay in touch about the role or service you asked about.

Booking a Call

When you book a call with us, you do so on a Google Calendar booking page. Google collects the details you enter, such as your name, email address and any notes, and shares them with us so we can hold the meeting.

Website and Technical Information

When you use our website, we may collect technical information such as IP address, browser type, device information, and usage data. We only use analytics to collect usage data if you accept analytics cookies. See our Cookie Policy.

5. How We Collect Data

We collect personal data directly from you (including through the candidate application form and the booking page linked from our website), from our clients where necessary to provide EOR services, from third-party providers such as payroll or compliance partners, and automatically through our website and systems.

6. Why We Use Personal Data

We process personal data only where permitted by law, including where it is necessary:

• To enter into or perform contracts
• To provide EOR, payroll, HR, and employment services
• To consider candidates for roles with companies hiring through Elara
• To reply to enquiries and stay in touch with clients, prospective clients and candidates by email, WhatsApp or SMS
• To carry out right-to-work and background checks, which candidates pass before onboarding
• To meet legal, tax, and regulatory obligations
• To operate, manage, and improve our business
• To protect our systems, people, and clients

Legal Basis for Candidate Applications

For candidates, we rely on the following under Law No. 06/L-082 and, where it applies, the GDPR and UK GDPR:

• taking steps at your request before a possible employment contract, when you apply and we consider you for roles;
• our legitimate interest in matching candidates to suitable roles, including with the help of AI as described below, which we balance against your rights and interests; and
• your consent, which you give on the application form, before we share your Elara candidate profile with a client company (see section 7).

AI-Assisted Screening

We use AI to help us review applications. We analyse your application, meaning your CV, your answers on the form and any answers you send us when we follow up, with Anthropic’s Claude, an AI model, which we access through Anthropic’s API. The AI is used to pick out your skills, languages and experience, to suggest roles that may suit you, and to prepare a standard Elara candidate profile. Your data passes through our automation service, which runs on Cloudflare, to reach Anthropic. Anthropic does not use this data to train its AI models.

The AI’s output is a suggestion only. A member of our team reviews every application and makes every decision. We do not make any decision that has legal or similarly significant effects on you solely by automated means.

You can ask us to review your application by a person only, without AI, and you can object to AI-assisted processing of your application. Email info@elara-eor.com (see also section 11). Doing so will not count against you.

Where consent is required, such as for analytics cookies, we will seek it explicitly and it can be withdrawn at any time.

You can ask us to stop contacting you at any time, by replying to the message or emailing info@elara-eor.com. We do not sell personal data.

7. Sharing Personal Data

We share personal data only where necessary and proportionate. This may include sharing data with:

• Clients, where required to deliver EOR services or to consider a candidate for a role. With your consent, given on the application form, we may share an Elara candidate profile with a client company for a specific role. The profile does not include your surname or contact details.
• Payroll, benefits, HR, and compliance providers
• Professional advisers such as lawyers and accountants
• Regulators or authorities where legally required

All third parties are required to protect personal data appropriately and to use it only for agreed purposes.

Service Providers We Use

These companies process personal data for us so that we can run our website, keep our records and communicate with you:

• GoHighLevel (HighLevel Inc., United States) – our CRM. It holds candidate applications sent through our website, the contact details of candidates, clients and prospective clients, and the messages we send and receive by email, WhatsApp and SMS. GoHighLevel uses its own delivery providers to send emails and text messages. Our account is a sub-account of an agency account run by Onsync, the agency that manages GoHighLevel for us. Onsync’s administrators are technically able to access our account; they may do so only to set up and maintain it, on our instructions.
• WhatsApp (Meta) – if you message us on WhatsApp, or agree to be contacted there, your phone number and the messages pass through WhatsApp, which is operated by Meta. WhatsApp’s own privacy policy applies to its service.
• Anthropic (Anthropic PBC, United States) – provides Claude, the AI model we use to analyse candidate applications as described in section 6. Your application data is sent to Anthropic through its API for that purpose.
• Cloudflare (Cloudflare, Inc., United States) – runs the automation service that collects candidate application data from our CRM, sends it to Anthropic, and returns the results to us.
• Google Workspace (Google) – our email, calendar and documents, including the page where you book a call with us.
• Google Analytics (Google) – website statistics, only if you accept analytics cookies.
• Vercel (Vercel Inc., United States) – hosts our website. Like any web host, it processes technical data such as IP addresses to deliver pages and keep the site secure.

8. International Transfers

Elara is based in Kosovo. Some of our service providers store or access personal data in other countries, mainly the United States:

• GoHighLevel stores the data in our CRM in the United States (on Google Cloud and Amazon Web Services) and has support staff in India.
• Anthropic processes candidate application data in the United States, and Cloudflare runs our automation service on its global network.
• Google, Vercel and WhatsApp (Meta) operate internationally, including in the United States.

Kosovo’s Law No. 06/L-082 on Personal Data Protection (Articles 44 to 49) allows personal data to be sent abroad only where it is adequately protected. We rely on the following safeguards:

• the list of countries with adequate protection kept by the Information and Privacy Agency, which applies the European Commission’s adequacy decisions;
• the EU–U.S. Data Privacy Framework and its UK extension, where the provider takes part in it. HighLevel states that it is certified;
• standard contractual clauses and the other commitments in each provider’s data processing terms; and
• where none of these applies, your consent or the Agency’s authorisation, as the law requires.

Personal data may also move between Kosovo, the European Economic Area and the United Kingdom, and to the country where a client is based, when that is needed to provide our services. You can ask us for more information about these safeguards at info@elara-eor.com.

9. Data Security

Elara maintains safeguards including access controls, encryption, staff training, and incident response procedures appropriate to the nature of the data processed.

If a personal data breach occurs, Elara and its client tell each other within 24 hours of becoming aware of it. Where Elara is the controller, we notify the Information and Privacy Agency within 72 hours where the law requires, and tell affected people without undue delay where the breach is likely to put their rights at high risk.

10. Data Retention

We keep personal data only for as long as we need it for the purpose it was collected for, and then delete it or make it anonymous. In particular:

• Candidate applications and talent network profiles: for as long as you want to stay in our talent network. Every 12 months we email you to ask whether you would like to stay. If you do not confirm, we send one reminder; if we still do not hear from you, we delete your details. The 12 months start again whenever you apply again or reply to us. If you are hired through Elara, your details are kept as employment records instead (see below). The candidate profile and role suggestions prepared with AI are part of your application and are kept, and deleted, with it.
• Enquiries from businesses that do not become clients: for 24 months after our last contact.
• Messages by email, WhatsApp and SMS: for the same period as the candidate or business record they belong to.
• Clients and employees: for the length of the contract or employment, and afterwards for the periods that Kosovo employment, tax and accounting law require.

You can ask us to delete your data sooner at any time (see section 11). We may need to keep some records for longer where the law requires it or to deal with a legal claim.

11. Your Rights

Depending on your location, you may have rights in relation to your personal data, including the right to access, correct, delete, restrict, or object to certain processing, and the right to data portability.

As a candidate, you can also ask for your application to be reviewed by a person only, without AI, and object to AI-assisted processing (see section 6). You can ask to see, correct or delete your application, and you can withdraw your consent to share your profile with clients at any time. Email info@elara-eor.com.

Where we rely on your consent, you can withdraw it at any time.

Requests can be made by contacting info@elara-eor.com. We will reply within one month.

You also have the right to lodge a complaint with the supervisory authority in the country where you reside, work, or where an alleged infringement has occurred. For data processing carried out by Elara as a Kosovo-registered company, the relevant authority is the Information and Privacy Agency of the Republic of Kosovo. If you are in the United Kingdom, you can also complain to the Information Commissioner's Office (ICO).

12. Cookies

We use cookies and similar technologies on our website. Further information is available in our Cookie Policy.

13. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in law or technology.

14. Contact

If you have any questions about this Privacy Policy or how we handle personal data, please contact:

Elara EOR L.L.C.
Registered office: Shpëtim Robaj 247, Prishtinë, Republic of Kosovo
UK correspondence address: 25 Oriental Square, London, NW9 0FR
Email: info@elara-eor.com

Kosovo Employment Privacy Notice (Supplement)

This supplement applies where Elara provides Employer of Record services involving individuals employed or engaged in Kosovo.

Local Legal Context

In addition to UK and EU data protection law where it applies, Elara processes employee personal data in line with:

• The Law on Labour of the Republic of Kosovo
• Law No. 06/L-082 on Personal Data Protection
• Guidance issued by the Information and Privacy Agency of the Republic of Kosovo

Where Kosovo law imposes stricter requirements, those requirements prevail.

Categories of Employee Data (Kosovo)

For employees engaged in Kosovo, Elara may process additional data required under local law, including:

• Personal identification numbers
• Employment contracts and amendments
• Salary, tax, and pension contribution records
• Health declarations where legally required
• Leave, working time, and statutory benefit records

This data is processed strictly for employment, compliance, and payroll purposes.

Local Processing & Storage

Certain employee data may be:

• Stored locally in Kosovo where required by law
• Accessed by local payroll providers, accountants, or authorities
• Retained in accordance with Kosovo statutory retention periods

All such processing is subject to confidentiality obligations and appropriate safeguards.

Disclosure to Authorities

Employee data may be disclosed to Kosovo authorities, including the Tax Administration of Kosovo, the Kosovo Pension Savings Trust and the Labour Inspectorate, where required by law or regulation.

1. Roles of the Parties

• Elara is a controller as the legal employer, for employment purposes: employment contracts, payroll, tax and pension, statutory reporting and benefits, health and safety, statutory records and disclosures to authorities.
• The client is a separate controller for personal data it uses for its own business purposes, such as directing work, managing performance and access to its own systems.
• Elara is a processor only for limited tasks it carries out on the client's documented instructions, within the client's own responsibilities. Processor terms under the UK GDPR, the EU GDPR and Kosovo law then apply.

2. Data and People Covered

Employees and candidates whose data is shared during recruitment. The data includes identification and contact details, employment and payroll data, and tax, bank and pension contribution details. Sensitive data, such as health data for sick leave, is used only where employment law requires it or with the person's explicit written consent.

3. Security and Breaches

Each party protects personal data with appropriate technical and organisational measures. Each party tells the other within 24 hours of becoming aware of a personal data breach. Where Elara is the controller, it notifies Kosovo's Information and Privacy Agency within 72 hours where the law requires.

4. International Transfers

Personal data transferred outside Kosovo is transferred only on a basis permitted by Kosovo law and, where they apply, the UK GDPR and the EU GDPR.

5. Retention

Elara keeps employment records for the periods Kosovo law requires. Each party keeps personal data only for as long as it needs it.