The small print, kept legible.
Legal and data
Buyers of this service ask about data before they sign, so it sits here in full rather than in a footer. What follows is a template with specimen copy. Counsel should settle the final text before launch, and the transfer paperwork described below is written for your own adviser to test rather than to take on trust.
Specimen copy · not yet settled by counsel
This page is a working template written by the firm, not legal advice, and it has not been reviewed by a solicitor. It must be settled before launch. The open questions are recorded in RESEARCH.md in the repository.
Data and access · the part that matters
The work stays in your systems. The transfer rules still apply.
The attractive version of this page would say that because nothing is exported, no international transfer takes place. That would be wrong, and the person who would notice is whoever your firm asks to review us. So here is the harder answer.
Accounts you issue
Our people work on credentials you create, under your access policy, on hardware agreed in the engagement letter. We do not hold a master account and we cannot create one.
Nothing copied out
There is no Deane & Hallaçi portal and no export. Client data is not taken out of client systems, and access is revocable by you at any time, in one action, without notice and without penalty.
The transfer, stated plainly
Remote access from outside the United Kingdom to personal data held in the United Kingdom is a restricted transfer under UK GDPR. It does not matter where the server sits. We say so rather than implying otherwise, and we hand you the paperwork that makes it lawful.
The paperwork, completed
Kosovo is not covered by UK adequacy regulations, so transfers run on the ICO’s International Data Transfer Agreement, or the UK Addendum to the EU standard clauses, together with a transfer risk assessment. We supply both, drafted and evidenced, for your firm to review and sign.
Your clients are told
We give you wording for your engagement letter and your privacy notice, naming this firm and naming Kosovo, and we expect you to use it. A firm that needs the arrangement kept quiet has picked the wrong arrangement.
Logs are yours
Access logs are kept and available on request, with a written data-handling summary covering vetting, training, premises and equipment.
The entity
Deane & Hallaçi is the trading name of Artana Group Sh.P.K., a company registered in Pristina, Kosovo, with its office at Dukagjini Centre, Lokal 24. Engagements are made with the registered entity, in writing, and governed by the law named in the engagement letter.
Data protection in Kosovo
Kosovo’s Law No. 06/L-082 on the Protection of Personal Data has applied since 13 February 2019 and transposes the European General Data Protection Regulation. Supervision sits with the Information and Privacy Agency, an independent authority with powers of inspection and sanction. Kosovo’s own regulator recognises the United Kingdom as providing an adequate level of protection. The United Kingdom has not yet reciprocated, which is why the transfer paperwork above exists.
What our people do not do
They do not authorise or release payments, and they hold no banking credentials with payment-initiation rights. They do not give professional advice. They do not conduct reserved legal activities. Where your regulator requires a named individual inside your own firm, that individual stays inside your own firm.
Privacy on this site
This site sets no analytics cookies, runs no trackers and loads no third-party script. The enquiry form collects your name, your firm, your email address and your message. They are used to reply to you and for nothing else, and they are not added to any list.
Deletion
To have your enquiry deleted, write to enquiries@deanehallaci.com and it will be done within two working days, with confirmation.
Last revised 1 August 2026. Earlier versions available on request. Write to enquiries@deanehallaci.com with any question about this page.