The data controller responsible for your personal data is:

Hani i Pazarit
Old Bazaar, Korçë, Albania
Email: privacy@haniipazarit.al
Reservations: reservations@haniipazarit.al

We may collect and process the following categories of personal data:

• Identification data: full name, date of birth, nationality, passport or identity card number (as required by Albanian law for guest registration).
• Contact data: postal address, email address, telephone number.
• Reservation data: arrival and departure dates, room preferences, number of guests, special requests, dietary requirements.
• Payment data: credit/debit card details, billing address, transaction history (processed through secure third-party payment processors).
• Stay data: information related to services used during your stay, including restaurant, spa, or concierge requests.
• Marketing data: communication preferences and consent records.
• Technical data: IP address, browser type, device information, pages visited, cookies and similar tracking technologies.
• Group reservation data: organization name, requester type, group size, and related correspondence.
• CCTV footage: for security purposes in public areas of the Hotel.

We do not intentionally collect special categories of personal data (e.g. health, religion, political opinions) unless strictly necessary and with your explicit consent (e.g. dietary or accessibility needs).

We process your personal data on one or more of the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR): to process reservations, provide accommodation, dining, and related services.
• Legal obligation (Art. 6(1)(c) GDPR): to comply with Albanian hospitality, tax, accounting, and immigration laws, including mandatory guest registration with the relevant authorities.
• Legitimate interests (Art. 6(1)(f) GDPR): to ensure the security of our premises, prevent fraud, improve our services, and conduct internal administration.
• Consent (Art. 6(1)(a) GDPR): for marketing communications, optional cookies, and any processing requiring your explicit agreement.
• Vital interests (Art. 6(1)(d) GDPR): in case of emergency situations affecting your health or safety.

We use your personal data to:

• Manage bookings, check-in/check-out, and provide hotel and restaurant services;
• Process payments and issue invoices;
• Comply with legal obligations (guest registration, tax records, anti-money laundering);
• Respond to inquiries, group reservation requests, and customer service matters;
• Send transactional communications (booking confirmations, pre-arrival information);
• Send marketing communications, where you have consented;
• Personalize your experience and remember your preferences;
• Ensure security of guests, staff, and property (including CCTV);
• Analyze website traffic and improve our digital services;
• Defend our legal rights and comply with court orders.

We may share your personal data with:

• Service providers: booking engines, payment processors, IT and hosting providers, email and marketing platforms, all bound by data processing agreements.
• Public authorities: Albanian police, tax authorities, and other competent bodies, where required by law.
• Professional advisors: auditors, accountants, and lawyers, under confidentiality obligations.
• Travel agencies and corporate clients: in connection with reservations made on your behalf.
• Successors in interest: in case of merger, acquisition, or sale of all or part of our business.

We do not sell your personal data to third parties.

Where personal data is transferred outside the European Economic Area (EEA) or Albania, we ensure appropriate safeguards are in place, such as European Commission adequacy decisions, Standard Contractual Clauses, or other lawful transfer mechanisms recognized under the GDPR and Albanian law.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for satisfying any legal, accounting, or reporting requirements.

• Guest registration data: as required by Albanian law (typically 5 years).
• Accounting and tax records: 10 years.
• Reservation and stay records: up to 5 years after your last stay.
• Marketing data: until you withdraw your consent.
• CCTV footage: typically up to 30 days, unless required for an investigation.
• Website cookies: as specified in our Cookie Policy.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data (“right to be forgotten”), subject to legal retention obligations;
• Restrict processing of your data;
• Object to processing based on legitimate interests or for direct marketing;
• Data portability – receive your data in a structured, commonly used format;
• Withdraw consent at any time, without affecting the lawfulness of prior processing;
• Lodge a complaint with the Information and Data Protection Commissioner of Albania (IDP) at www.idp.al, or with your local data protection authority within the EU.

To exercise any of these rights, please contact us at privacy@haniipazarit.al. We will respond within 30 days, extendable by a further two months for complex requests.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These include encrypted transmission (TLS), restricted access controls, staff confidentiality obligations, secure payment processing (PCI-DSS compliant providers), and regular review of our security practices.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and, where required, inform affected individuals without undue delay.

Our website uses cookies and similar technologies to provide essential functionality, analyze traffic, and (with your consent) deliver personalized content. You may manage your cookie preferences through our cookie banner or your browser settings. Disabling certain cookies may affect site functionality.

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children without parental or guardian consent. If you believe we have collected such data, please contact us to have it removed.

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of such external sites. We encourage you to review their privacy policies before providing any personal information.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on this page with a revised “Last updated” date. Material changes will be communicated to you where required by law.

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of your personal data, please contact us at:

Hani i Pazarit — Data Protection
Old Bazaar, Korçë, Albania
Email: privacy@haniipazarit.al
Phone: available upon request via reservations@haniipazarit.al