This notice concerns the processing of personal data collected through photographs and audio-video recordings during the trip and, therefore, within the scope of activities included from the day of departure until the day of return. Such data will be processed for marketing and promotional purposes through publication, or transmission also in real time in the case of live events, of audio, photos, and videos on the Company’s website or related websites, or on the social media profiles (Facebook, Instagram, YouTube) of Voyyotoursalbania.com.

1. Data Controller
The Data Controller is Voyyo Tours Albania, with headquarters in Durrës, Quarter no. 3, Property Nr. 4/543ND-N2, ZK 8514 (NIPT: M51915508I).

2. Data Processed
User, customer and third-party data
• Common personal data
• Personal and contact details [e.g. name and surname, e-mail address, telephone numbers, home/residence address, tax code/VAT number]
• Payment card details
• Any other personal data provided
• Personal data pursuant to Art. 4, para. 1, EU Reg. 679/2016
• Data relating to travel preferences, interests or other information useful for the purposes provided by this notice
Special categories of personal data
• Health data where required and/or provided
• Information relating to allergies, intolerances or general pathologies if communicated
• Data relating to identification documents (e.g. passport)
• Data of third parties, provided by the client/traveler, such as emergency contacts
Registered user data
• Data of users registered on the booking portal and data of third-party customers whose bookings are made by the registered user
• Common personal data (Art. 4, para. 1, EU Reg. 679/2016): name, surname, contact information, tax code/VAT number, payment card details, other information provided
Platform usage data
• Data of platform usage
• Any other personal data provided
Special categories of data (Art. 9 GDPR)
• Health data, allergies, intolerances, pathologies (if requested and/or provided)
• Identification documents (e.g. passport)
Browsing data and cookies
• Browsing data [e.g. IP address, browser used, operating system, visited domains and web addresses]
• Personal data collected through third-party systems, software, plugins and cookies, also from third parties
Where booking/purchasing a trip/service for other people:
• Data of other participants provided by you will also be processed;
• We recommend sharing such data only after obtaining their consent;
• At the time of contract signing, Voyyo Tours Albania will send an email to the addresses of such third parties to ensure awareness and acceptance of data processing as per this Privacy Notice;
• If consent for purposes 3.5 and 3.6 is given, the third-party emails you provide will also be processed for such purposes;
• Voyyo Tours Albania may contact such subjects by phone or email for communications concerning the trip/package purchased.
In case of minors: specific parental/legal guardian authorization is required for processing.

3. Purposes of Processing
3.1 Registration on the booking portal
• Purpose: user profile creation, data storage, contract management, quotations, accounting, invoices, user information management.
• Legal basis: Contract performance/pre-contractual measures (Art. 6, para. 1, lett. b); Legitimate interest (Art. 6, para. 1, lett. f).
3.2 Pre-contractual and contractual services
• Purpose: proposals, negotiation, conclusion, execution of contracts, assistance, cancellations, organization of travel packages, accounting, invoicing, legal obligations, emergency management, financial/insurance services, visa issuance, defense of rights.
• Legal basis: Contract performance (Art. 6, para. 1, lett. b); Legal obligation (Art. 6, para. 1, lett. c); Legitimate interest (Art. 6, para. 1, lett. f).
3.3 Communications with data subjects and/or emergency contacts
• Purpose: information requests, service/product communications, emergency management, legal obligations, defense of rights.
• Legal basis: Contract performance; Legal obligation; Legitimate interest.
3.4 Travel/service/tour package organization; additional organizational purposes; communication of customer and third-party personal data to other participants
• Purpose: hotel/accommodation management, preferences, emergencies, private transfers, sharing of necessary personal data with other participants.
• Legal basis: Consent; Legal obligation; Legitimate interest.
3.5 Marketing, mailing lists, newsletters, and data transfer to third parties
• Purpose: promotional activities, information/marketing communications, anonymized statistics, satisfaction surveys, data transfer to Voyyo Tours Albania.
• Legal basis: Consent.
3.6 Profiling, marketing, and data transfer to third parties
• Purpose: analysis/profiling of preferences, automated/manual promotional activities, questionnaires, user profile management, data transfer to Voyyo Tours Albania.
• Legal basis: Consent.

4. Methods of Processing
Data are processed in compliance with EU Reg. 2016/679 (GDPR), with adequate technical and organizational measures to ensure confidentiality, integrity, and security. Data may be processed digitally, telematically, or manually. Authorized personnel and designated processors (Art. 28 GDPR) are involved.
4.1 Marketing, mailing lists, newsletters, and profiling
Emails provided are added to contact lists for communications (general or profiled). Unsubscription is possible at any time via the link in the emails.
4.2 Payment processing
Payments handled via BKT Bank (Albania). Privacy policy: https://www.bkt.com.al/politikat-e-privatesise.

5. Data Sharing and Recipients
• Data may be shared with consultants (legal, tax, IT), providers, hosting, banks, insurers, etc.
• Always in compliance with GDPR, by authorized or responsible parties.
5.1 Data transfers outside the EU
Data may be transferred outside the EU (e.g., Microsoft services). Standard Contractual Clauses or equivalent safeguards will be applied.
5.2 Travel/service/tour package organization
For organizational needs, personal data (e.g., name, surname, phone, email, departure/return airport, residence, travel companions) may be shared with other participants and staff.

6. Nature of Data Provision
• 3.1 Registration: Mandatory
• 3.2 Contractual services: Mandatory
• 3.3 Communications: Mandatory
• 3.4 Travel organization: Mandatory
• 3.5 Marketing: Optional (requires consent)
• 3.6 Profiling: Optional (requires consent)

7. Data Retention
• Registration: until registration is active, max 60 months
• Contractual services: until end of contract, max 120 months
• Communications: until interaction ends, max 60 months
• Travel organization: 60 months
• Marketing & profiling: 60 months
Retention may be extended for legal or legitimate interest reasons.

8. Data Subject Rights
Under Arts. 12 et seq. GDPR, you have the right to:
• Access your data
• Request rectification or deletion
• Restrict or oppose processing
• File a complaint with the Supervisory Authority
• Obtain details on recipients, retention, automated decision-making, and profiling

9. Contact Details
For any request, the Controller can be contacted at:
📧 info@voyyotoursalbania.com
📞 Phone numbers listed on VoyyoToursAlbania.com

10. Complaints
You have the right to file a complaint with the Albanian Data Protection Authority: https://idp.al.

11. Changes and Updates
The Controller reserves the right to make changes to this Privacy Notice at any time. Updates will be published on this page. If relevant changes affect your rights, you will be notified directly.