Plain English summary: We collect only what we need to process your booking and make your stay excellent. We do not sell your data to anyone. We share it only where legally required or to process your payment. You can ask us to delete your data at any time.
1. Who We Are
The Grand Hotel ("we", "us", "our") is located at Rruga Shembull 1, 9400, Vlorë 9401, Albania. We are the data controller for personal data collected through this website and in connection with stays at our property.
Privacy enquiries: info@thegrandhotel-demo.al
2. Data We Collect
We collect personal data in the following circumstances:
- When you book: Name, email, phone number, arrival/departure dates, number of guests, room preference, payment information (processed securely — we never store full card details).
- When you contact us: Name, contact details, and message content (including WhatsApp conversations).
- When you visit our website: IP address, browser type, pages visited (via analytics cookies — see Section 8).
- During your stay: Passport or ID details as required by Albanian law. Any preferences or special requests you share.
We do not collect sensitive personal data (health, political views, etc.) unless you voluntarily share it for a specific accessibility or dietary need.
3. How We Use Your Data
- Process and manage your reservation
- Communicate with you before, during, and after your stay
- Register guests with Albanian authorities as required by law
- Process payments and prevent fraud
- Improve our services using aggregated, anonymised analytics
- Send follow-up communications (where you have given consent)
We do not use your data for automated decision-making or profiling.
4. Legal Basis for Processing (GDPR)
- Contract performance (Art. 6(1)(b)): Processing needed to fulfil your reservation and provide your stay.
- Legal obligation (Art. 6(1)(c)): Guest registration with Albanian authorities.
- Legitimate interests (Art. 6(1)(f)): Fraud prevention, service improvement, website security.
- Consent (Art. 6(1)(a)): Marketing communications, where applicable. Withdrawable at any time.
5. Who We Share Data With
We do not sell your personal data. We share it only with:
- Payment processors: To handle transactions securely. PCI-DSS compliant. We never store full card numbers.
- Albanian authorities: Guest ID data as required by Albanian hospitality law.
- Service providers: Email (Google Workspace) and analytics tools. All bound by appropriate data processing terms.
6. How Long We Keep Your Data
- Booking records: 7 years (accounting and legal compliance).
- Guest registration data: As required by Albanian law (currently 5 years).
- Marketing consent data: Until withdrawn.
- Website analytics: 26 months (anonymised).
- Contact enquiries: 2 years from last contact.
7. Your Rights
Under GDPR and Albanian data protection law, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Delete your data, subject to legal retention requirements
- Restrict processing in certain circumstances
- Data portability in a machine-readable format
- Object to processing based on legitimate interests
- Withdraw consent at any time for consent-based processing
To exercise any right, email info@thegrandhotel-demo.al. We will respond within 30 days. You may also complain to the Albanian Information and Data Protection Commissioner at www.idp.al.
8. Cookies
- Strictly necessary: Required for the site to function (session, booking form). Cannot be disabled.
- Analytics: Anonymised usage data. No personal information sent to third parties. Opt out via browser settings.
- Preferences: Language settings. No personal data.
We do not use advertising or retargeting cookies.
9. Security
All data is transmitted via HTTPS. Access to booking data is restricted to authorised staff. Payment data is processed via PCI-DSS compliant systems. In the event of a breach affecting your rights, we will notify you and the relevant supervisory authority as required by law.
We aim to resolve all privacy enquiries within 30 days. If unsatisfied, you may escalate to the Albanian Information and Data Protection Commissioner.
This policy was last reviewed on 1 January 2025. We may update it periodically. Material changes will be communicated to guests with active bookings by email at the time of the change.