Privacy Policy
Effective date: 24 June 2026
Last updated: 24 June 2026
Version: 1.0
1. Who we are
This Privacy Policy explains how Saranda Boat Tours ("we", "us", "our", or "Saranda Boat Tours") collects and uses your personal data when you use sarandaboattours.al (the "Website") or book one of our tours.
We are the data controller responsible for your personal data:
- Saranda Boat Tours
- Registered office: [address to be provided], Saranda, Albania
- NIPT/VAT: [to be provided]
- Email: [email protected]
- Phone: [to be provided]
We process personal data in accordance with Law No. 124/2024 "On Personal Data Protection" (the Albanian law, in force since 31 January 2025 and fully aligned with the EU General Data Protection Regulation, "GDPR").
2. Scope
This Policy covers personal data we process about: visitors to the Website, customers who make a booking (directly or through a Distribution Partner such as GetYourGuide), and the participants named in a booking. It should be read together with our Terms and Conditions.
3. What personal data we collect
| Category | Examples |
|---|---|
| Identity and contact | Name, email address, mobile/phone number |
| Booking and participant details | Tour, date and time, number of participants, names of participants, age where a minimum age applies |
| Health and special requirements | Medical conditions, allergies, pregnancy, mobility or accessibility needs that you choose to disclose for safety (see Section 6) |
| Payment-related data | Confirmation that a payment succeeded, transaction reference, the method used (we do not receive or store full card numbers or wallet/PayPal credentials) |
| Communications | Emails, SMS, messages and support requests you send us, and our replies |
| Technical and usage | IP address, device and browser type, pages viewed, and cookie data (see Section 12) |
| Marketing preferences | Whether you have consented to receive marketing and your contact preferences |
We do not seek to collect special-category data except the health information you choose to provide for the safe delivery of a tour.
4. How we collect your data
We collect data: (a) directly from you, when you make or change a booking, contact us, or sign up for updates; (b) from a Distribution Partner (e.g. GetYourGuide) when you book through that platform, which passes us your booking and contact details so we can deliver the tour; and (c) automatically, through cookies and similar technologies when you use the Website.
5. Why we use your data, and our legal bases
| Purpose | Legal basis (Law No. 124/2024, aligned with GDPR) |
|---|---|
| Taking and managing your booking; sending booking confirmations by email (Mailgun) and SMS (Twilio); contacting you about your tour | Performance of a contract with you |
| Processing payments through POK Pay or PayPal | Performance of a contract |
| Keeping booking, invoicing and accounting records | Compliance with a legal obligation (tax, accounting, tourism and consumer law) |
| Preventing fraud, securing the Website, and resolving disputes | Our legitimate interests in operating safely and lawfully |
| Responding to your enquiries and complaints | Performance of a contract and/or our legitimate interests |
| Delivering a tour safely in light of any health or accessibility needs you disclose | Your explicit consent (special-category data — see Section 6) |
| Sending marketing about our tours and offers | Your consent (which you can withdraw at any time) |
| Using non-essential cookies and analytics | Your consent |
Where we rely on legitimate interests, we balance those interests against your rights and only proceed where yours are not overridden.
6. Health and other special-category data
If you tell us about a medical condition, allergy, pregnancy, disability or mobility need so that we can keep a participant safe, this is special-category (sensitive) data. We process it only with your explicit consent, only to assess suitability and deliver the tour safely, and we share it only with the guide or staff who need it for that purpose. You can withdraw this consent, though doing so may mean we cannot safely offer certain activities.
7. Who we share your data with
We share personal data only as needed to take payment, contact you and deliver tours, with the following recipients:
| Recipient | Role | Purpose |
|---|---|---|
| POK Pay (operated by R PAY, licensed by the Bank of Albania) | Independent controller / payment processor | Card, wallet and QR payments for direct bookings |
| PayPal | Independent controller / payment processor | PayPal payments for direct bookings |
| Twilio | Processor | Sending SMS booking notifications on our behalf |
| Mailgun | Processor | Sending email confirmations and notifications on our behalf |
| GetYourGuide (GYG) | Independent controller / Distribution Partner | Bookings made through GetYourGuide; we exchange booking and contact data to deliver the tour |
| Hosting / IT / analytics providers, as applicable | Processor | Operating and securing the Website and systems |
| Public authorities, our accountant, lawyer or insurer | Recipients | Where required by law, to defend a legal claim, or to meet accounting/tax obligations |
We require our processors to act only on our instructions and to keep your data secure under a written data-processing agreement, as required by Law No. 124/2024. We do not sell your personal data.
8. International data transfers
Some recipients (for example PayPal, Twilio, Mailgun and GetYourGuide) are based outside Albania and the European Economic Area (EEA). Where we transfer personal data to a country that is not recognised as providing an adequate level of protection under Law No. 124/2024, we put in place an appropriate safeguard — typically Standard Contractual Clauses or another lawful transfer mechanism — so that your data remains protected. You can ask us for more information using the contact details in Section 18.
9. How long we keep your data
We keep personal data only for as long as necessary:
- Booking, invoicing and accounting records — for the period required by Albanian tax and accounting law (generally [5] years from the end of the relevant financial year).
- Health/special-requirement data — deleted shortly after the tour, once it is no longer needed for safety or to handle a related claim.
- Marketing data — until you withdraw consent or object.
- Enquiries and support messages — for a limited period needed to handle the matter and any follow-up.
- Cookie data — for the lifespan of each cookie (see Section 12).
After these periods we securely delete or anonymise the data, unless we must keep it longer to comply with the law or defend a legal claim.
10. Your rights
Subject to the conditions in Law No. 124/2024, you have the right to:
- access the personal data we hold about you;
- rectify inaccurate or incomplete data;
- erase your data ("right to be forgotten");
- restrict or object to processing in certain circumstances;
- data portability — receive certain data in a structured, machine-readable format, or have it transferred to another controller where technically feasible;
- withdraw consent at any time, where we rely on consent (this does not affect prior processing);
- lodge a complaint with the supervisory authority (Section 18).
To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe set by law. We may need to verify your identity first.
11. Marketing
We only send you marketing messages where you have consented. Every marketing email and SMS includes a simple way to opt out, and you can also unsubscribe at any time by emailing [email protected]. Withdrawing marketing consent does not stop service messages such as booking confirmations, which we must send to fulfil your booking.
12. Cookies and similar technologies
The Website uses cookies and similar technologies. These fall into the following categories:
- Strictly necessary — required for the Website and checkout to work (e.g. session and security cookies). These do not require consent.
- Functional — remember your preferences.
- Analytics — help us understand how the Website is used.
- Marketing — used to measure or deliver advertising.
We ask for your consent before setting non-essential cookies, and you can change your choices at any time.
13. Children's privacy
The Website is intended for adults. We do not knowingly collect data directly from children under 18. Where a booking includes a minor, the data is provided by the parent or guardian who makes the booking. If you believe a child has provided us data without authorisation, contact us and we will delete it.
14. How we protect your data
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse — including access controls, encryption in transit, and limiting access to staff and processors who need it. In line with Law No. 124/2024, we will notify the supervisory authority of a qualifying personal-data breach without undue delay and within 72 hours where required, and will inform affected individuals where the breach is likely to pose a high risk to them.
15. Automated decision-making
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.
16. Third-party links
The Website may link to third-party sites (for example payment providers or GetYourGuide). We are not responsible for their privacy practices; please read their own privacy notices.
17. Changes to this Policy
We may update this Policy from time to time. The current version, with its effective date, is always published on the Website. Material changes will be made clear.
18. Contact and complaints
For any privacy question or to exercise your rights:
- Saranda Boat Tours — [address to be provided], Saranda, Albania
- Email: [email protected] · Phone: [to be provided]
If you are not satisfied with our response, you may lodge a complaint with the Albanian supervisory authority:
- Commissioner for the Right to Information and Protection of Personal Data (IDP)
- Website: https://www.idp.al
