Privacy and cookie policy

Who we are and what this policy covers

Adriatik Hotel, Rruga Pavarësia, Plazh, Durrës 2000, Albania (“Adriatik Hotel”, “we”) runs this website, adriatikhotel.com, and is the data controller for the personal data described here. You can reach us at info@adriatikhotel.com or on +355 69 202 1778.

This policy explains what personal data the website collects when you browse, book a room, send us an enquiry, apply for a job, sign up for our newsletter or message us; why we collect it; who processes it on our behalf; how long we keep it; and the rights you have over it. It is written for guests everywhere: Albania’s Law No. 124/2024 on personal data protection, the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act and comparable laws elsewhere give you broadly the same rights, and we honour them wherever you live.

The website is available in English and Albanian; both versions of this policy say the same thing. If anything is unclear, write to us.

Visiting the website

The site is hosted on Cloudflare’s network. Like every web server, Cloudflare records technical details of each request so that pages can be delivered and attacks blocked: your IP address, the page requested, the time, your browser and operating system, and the page that referred you. We see these only as short-lived logs and aggregated statistics and do not use them to identify you. Legal basis: our legitimate interest in running a secure, reliable website. Retention: Cloudflare keeps the request logs for a few days.

Fonts, images and videos are served from our own site. No third-party fonts, analytics scripts, advertising pixels or social media plug-ins run on our pages. The Instagram, Facebook and YouTube icons in the footer are plain links: nothing is sent to those companies until you click them.

Contact and event enquiries

The contact page and the Meetings & Events pages carry a form asking for your name, e-mail address and message. Our server passes the submission, together with the language you were browsing in and the page you sent it from, to Resend, an e-mail delivery service, which delivers it as an e-mail to our reception (info@adriatikhotel.com) or to our events team (events@adriatikhotel.com). Our mailboxes are hosted by Google Workspace.

We use the details only to answer you and, if you go ahead, to prepare your stay or event. Legal basis: the steps you ask us to take before a contract, and our legitimate interest in answering enquiries. Retention: we keep the correspondence for up to two years after our last exchange; if it leads to a booking or an event contract, the retention periods for bookings apply.

Job and internship applications

The form on the careers page asks for your name, e-mail address, a few lines about your interest and your CV as a PDF of up to 5 MB. Our server checks the file type and size, attaches the CV to an e-mail and sends it through Resend to our human resources team (humanresources@adriatikhotel.com). The CV is not stored on the website, and Resend keeps it only for as long as delivering the e-mail requires.

Please include in your CV only what is relevant to the role. We do not ask for, and ask you not to send, information about your health, religion, ethnic origin, political opinions or trade union membership, or an identity number. If your CV does contain such details, we treat them as confidential and use them for nothing beyond assessing your application.

Legal basis: the steps you ask us to take towards an employment or internship contract, and your consent for anything you volunteer beyond that. Retention: six months after we have decided on the application, unless you ask us to keep your CV longer for future openings, or you join the team, in which case it becomes part of your personnel file.

Newsletter

If you enter your e-mail address in the newsletter box in the footer, it reaches our reception inbox through Resend and we add it to our mailing list. We use it only to send you news and offers from Adriatik Hotel, never more than a few times a year, and we do not pass it to anyone else.

Legal basis: your consent. You can withdraw it at any time with the unsubscribe link in any newsletter or by writing to info@adriatikhotel.com, and we will remove your address. Retention: until you unsubscribe.

Booking a room

The booking engine on the Book page, and the dates you enter in the Book Now bar, are provided by Sirvoy Limited, a hotel reservation system company registered in Ireland, which processes bookings on our behalf. The engine runs inside a frame served from secured.sirvoy.com. Sirvoy sets the cookies it needs to hold your booking session; it loads no advertising or analytics code for us.

To complete a booking you enter your name, e-mail address, phone number, country, the dates and guests of your stay, any special requests and your payment card details. Card details go to Sirvoy and its payment provider only; the hotel never sees your full card number. The rest of the booking appears in our reservation system so that reception can prepare your stay, and we use your e-mail address and phone number to confirm the booking and to contact you about it.

Legal basis: the contract for your stay, and our legal obligations: Albanian tax and accounting law requires us to keep invoices and booking records, and Albanian law requires accommodation providers to register the identity details of their guests and make them available to the competent authorities. Retention: for your stay and for the period those laws prescribe.

Sirvoy’s own privacy policy, at sirvoy.com/privacy-policy, describes how it handles the data.

WhatsApp, Viber and phone

The green WhatsApp button and the WhatsApp links open a chat with the hotel’s number, +355 69 202 1778, in the WhatsApp app or website. Nothing is sent to WhatsApp until you click; from then on WhatsApp (Meta Platforms Ireland Ltd for users in Europe, Meta Platforms, Inc. elsewhere) processes your phone number, profile name and messages under its own privacy policy, which you accepted when you installed WhatsApp. The same applies to Viber (Rakuten Viber).

On our side, the staff member answering sees your number, name and messages and uses them only to help you. Please do not send payment card details or identity documents over chat; we will tell you a safer way. We keep chat histories for as long as the enquiry or stay they relate to, and delete them with the correspondence.

Security checks on our forms

Every form on the site is protected by Cloudflare Turnstile, which tells people from automated spam without puzzles. When a form is shown, your browser loads a small script from challenges.cloudflare.com, which examines technical signals (your IP address, browser characteristics and how the page behaves) and issues a token. Our server checks that token with Cloudflare before it accepts a submission. Turnstile does not track you across websites. In some configurations Cloudflare sets a cookie such as cf_clearance to remember that you have passed.

Legal basis: our legitimate interest in keeping our inboxes free of spam and abuse. Cloudflare, Inc. (United States) is our processor for this and for hosting; it is certified under the EU–US Data Privacy Framework.

Who we share data with

We share personal data only with the service providers that run parts of the website for us, under contracts that bind them to process it on our instructions alone:

• Cloudflare, Inc., United States: hosting, delivery and security of the site, and the Turnstile check on our forms.
• Resend, Inc., United States: delivery of the e-mails our forms generate, including CV attachments.
• Sirvoy Limited, Ireland: the booking engine and reservation system.
• Google (Google Ireland Ltd / Google LLC): Google Workspace, which hosts our mailboxes, and Google Maps if you allow it.
• Meta Platforms (WhatsApp) and Rakuten Viber: only when you choose to message us there.

We also disclose data when the law requires it, for example guest registration to the Albanian authorities or records to tax inspectors, or to protect our rights. We do not sell personal data, we do not share it for advertising, and we do not let third parties use it for their own purposes.

Where your data is processed

Adriatik Hotel is in Albania, and the website is operated from here. Albania is not in the European Union, but its Law No. 124/2024 on personal data protection is modelled on the GDPR and is supervised by the Commissioner for the Right to Information and Protection of Personal Data. When you send us data from the EU, the UK or anywhere else, we protect it to the standard this policy describes.

Our providers process data in the European Union (Sirvoy, Google Ireland) and in the United States (Cloudflare, Resend, Google LLC, Meta). For transfers to the United States we rely on the EU–US Data Privacy Framework and its UK and Swiss extensions where the provider is certified (Cloudflare, Google, Meta), and on the European Commission’s standard contractual clauses otherwise (Resend).

How long we keep data

• Server and security logs: a few days.
• Contact and event enquiries: up to two years after our last exchange.
• Job applications: six months after the decision, unless you ask us to keep your CV longer.
• Newsletter addresses: until you unsubscribe.
• Bookings and invoices: for the stay and for the period Albanian tax, accounting and guest-registration law requires.
• Your cookie choice: six months.

When a period ends we delete the data or anonymise it so that it no longer identifies you.

Your rights

Wherever you live, you can ask us:

• to confirm whether we hold personal data about you, and for a copy of it (access);
• to correct data that is inaccurate or incomplete (rectification);
• to delete data we no longer need or for which you have withdrawn consent (erasure);
• to limit how we use data while a question about it is resolved (restriction);
• to receive the data you gave us in a common machine-readable format (portability);
• to object to processing based on our legitimate interests, and to any direct marketing;
• to withdraw consent at any time, without affecting what was done before;
• not to be subject to decisions made solely by automated means. We make none.

To exercise a right, e-mail info@adriatikhotel.com or write to the address above. We may ask you to confirm your identity so that we give data only to the right person. We answer within one month; if a request is complex we may take up to two more months and will tell you why. We never charge for this and never treat you differently for asking.

If you believe we have handled your data wrongly, you can complain to the Albanian Commissioner for the Right to Information and Protection of Personal Data (idp.al, info@idp.al), to the data protection authority of the country where you live or work in the EU or EEA, to the Information Commissioner’s Office in the UK, or to your local regulator elsewhere. We would appreciate the chance to resolve the matter first.

Notices for specific regions

European Union, EEA, United Kingdom and Switzerland. The GDPR, the UK GDPR and the Swiss Data Protection Act apply to the data we collect from you. Our legal bases are those named in each section above: performance of a contract or steps before one, legal obligations, our legitimate interests (running and securing the website and answering enquiries) and your consent (newsletter, embedded content, anything you volunteer). Where we rely on legitimate interests, we have weighed them against your interests and found no overriding harm; you may ask us for that assessment.

California (CCPA/CPRA). In the past twelve months we have collected these categories of personal information: identifiers (name, e-mail address, phone number, IP address); customer records (booking and payment details, handled by Sirvoy); professional and employment information (CVs); and internet activity (the server logs described above). We collect them from you and from your browser, for the purposes described above, and disclose them to the service providers listed above. We do not sell personal information, we do not share it for cross-context behavioural advertising, we do not use or disclose sensitive personal information except as needed to provide the services you request, and we do not knowingly collect data from consumers under 16. You have the right to know, delete and correct your personal information, to opt out of sale or sharing (none takes place), and not to be discriminated against for using these rights. We honour Global Privacy Control signals as an opt-out. You may use an authorised agent; we will ask for proof of authority. Contact info@adriatikhotel.com or +355 69 202 1778.

Brazil (LGPD). You have the rights listed above and the right to information about the public and private entities with which we have shared your data; the legal bases are those described above. Complaints may be addressed to the Autoridade Nacional de Proteção de Dados.

Other countries. Where the law of your country (for example Canada’s PIPEDA or Australia’s Privacy Act) gives you additional rights, we honour them. Write to us and we will tell you how.

Children

The website is not directed at children. Bookings must be made by an adult, and we do not knowingly collect personal data from anyone under 16 through the site. If you believe a child has sent us data, write to us and we will delete it.