PRIVACY POLICY

Notice on the processing of personal data of website visitors and guests

Prepared in accordance with Law No. 124/2024 “On the Protection of Personal Data” (Albania)

1. Who we are – The Data Controller

The controller of the personal data processed through this website is:

Company name: The Plaza Tirana sh.p.k

Registration number (NUIS/NIPT): L51930016U

Registered office/Address: Street Abdi Toptani, No. 18, Tirana, Albania

Privacy contact e-mail: controller@plazatirana.com

Website: www.plazatirana.com

This notice applies only to data collected through this website, not to other websites that may be reached via links from it.

2. Data Protection Officer (DPO)

Under Article 33 of Law 124/2024, appointing a Data Protection Officer is mandatory in certain cases (e.g. large-scale processing, systematic monitoring).

3. What data we process

• Identification and contact data: first name, last name, address, phone, e-mail (when you book, contact us, or subscribe to the newsletter)
• Booking and payment data: credit card/guarantee details (processed via the booking engine provider and/or payment processor)
• Official identification data at check-in: passport/ID card number, nationality, as required by legislation on the registration of accommodation guests
• Additional voluntary data (e.g. dietary preferences, special needs) – where these involve special categories under Article 9 (e.g. health-related information), such data is collected only with your explicit consent and used strictly to serve you during your stay
• Navigation data (IP, cookies, log files) – see Section 9
• CVs and recruitment data when you apply for a job

4. Purposes and legal bases of processing

Purpose of processing	Legal basis (Art. 6, Law 124/2024)
Responding to information requests / room availability	Pre-contractual measures at the data subject’s request
Creating and confirming a booking	Performance of a contract
Accounting, tax obligations, guest registration	Legal obligation
Commercial communications to existing guests (soft opt-in)	Legitimate interest, with an easy right to object at any time
Newsletter sign-up for others (non-guests)	Explicit consent (opt-in)
Assessing CVs for recruitment	Pre-contractual measures / consent
Protection against abuse, legal claims	Legitimate interest / legal obligation
Anonymous website usage statistics	Legitimate interest (anonymised data)

 

5. Recipients of the data

Your data may be shared with the following categories of recipients, always within the limits necessary for the purpose of processing:

• The online booking engine provider (e.g. FastBooking or equivalent), acting as data processor, under a data processing agreement pursuant to Article 28 of Law 124/2024
• The payment/credit card service provider
• The e-mail/newsletter service provider
• The website hosting provider
• Public authorities, when required by law (e.g. tax authorities, police, guest-registration authorities)
• Legal/accounting advisors, when necessary

We do NOT sell your data and do NOT share it with third parties for purposes other than those described here, without your consent or another legal basis.

6. International data transfers

Some processors (e.g. the booking engine) may be located outside Albania, including within the European Union/EEA. Under Article 39-40 of Law 124/2024, transfers abroad are permitted where: (a) the receiving country ensures an adequate level of protection (generally considered to be the case for the EU/EEA), (b) standard contractual clauses approved by the Commissioner are used, or (c) another exception expressly provided by law applies (e.g. performance of the booking contract).

For details or a copy of the relevant safeguards, contact us at controller@plazatirana.com

7. How long we keep your data

• Accounting data: up to 10 years in the company’s financial archives
• Check-in data (identity document): up to 12 months, then destroyed
• Newsletter/marketing: until you withdraw consent or object
• CVs deemed “of interest”: up to 12 months, then destroyed
• Navigation/log data: up to 12 months

At the end of the applicable period, data is securely deleted or anonymized.

8. Your rights as a data subject

Under Law No. 124/2024, you have the right, at any time, to request:

• The right to information and access to your data
• The right to rectify inaccurate or incomplete data
• The right to erasure (“the right to be forgotten”), where applicable
• The right to restriction of processing
• The right to data portability
• The right to object to processing, including for direct marketing purposes or profiling
• The right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal
• The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you
• The right to lodge a complaint with the Commissioner for the Right to Information and Protection of Personal Data (IDP)

Requests may be sent to controller@plazatirana.com. We will respond within the time frames provided by law.

Supervisory authority contact details

Commissioner for the Right to Information and Protection of Personal Data (IDP)

Website: idp.al

9. Cookies

The website and its partners set cookies or other tracking devices on your device. To learn more about our use of cookies, please see our Cookie Policy.

10. Navigation data

During your visit, our systems may automatically collect technical data (IP address, browser type, pages visited, date/time of access) for security, statistical and website-functioning purposes. This data is kept for the minimum period necessary and may only be disclosed to competent authorities where required by law.

11. Commercial communications by e-mail

If you are an existing guest, we may send you offers for services similar to those you have used, based on our legitimate interest, provided you are always offered a simple and free way to unsubscribe (opt-out) from every message. For any other person, commercial communications are sent only with your prior consent (opt-in), which may be withdrawn at any time.

12. CV management and recruitment

CVs submitted are processed to assess candidacies for current or future positions. We ask that you not include special category data (health, religious beliefs, political opinions, etc.) unless relevant to the position. CVs deemed not relevant, or kept for more than 12 months, are securely destroyed.

13. Data security

We implement appropriate technical and organizational measures to protect your data against loss, misuse, unauthorized access or alteration, in line with the security provisions of Law 124/2024, including:

• Access controls limited to authorized, trained staff
• Encryption of sensitive data (e.g. during transmission of credit card details)
• additional measures: e.g. backups, firewalls, password policies, notification of security breaches to the Commissioner within 72 hours, as applicable

14. Children’s data

This website is not intended for individuals under 18 years of age and does not knowingly collect data from minors without the consent of a parent or legal guardian.

15. Changes to this policy

This policy may be updated periodically to reflect legal or operational changes. The date of the latest update is shown below.

Last updated: 10.12.2025