Privacy Policy
Effective date: April 13, 2026. Controller for Platform services: LookAlbania. NIPT L92110501A. Address: Durrës, Albania. Privacy contact: info@lookalbania.al.
1. Scope and who we are
This Privacy Policy explains how LookAlbania collects and uses personal data when you browse lookalbania.al, use our mobile apps, create an account, make or manage a booking, contact us, or use a business account. It also explains what happens when a Partner uses LookAlbania's management tools to maintain its own guest records. The specific activities described below apply only where the relevant features are enabled.
Our core business is connecting Guests with independent restaurants, bars, hospitality businesses and, where available, tours, experiences and events (“Partners”). We aim to collect only the information reasonably needed for our services. This Policy should be read with our Terms and Conditions and, where relevant, the Partner's own privacy notice.
2. Our different data protection roles
Bookings started through LookAlbania. LookAlbania generally determines how it operates user accounts, search, recommendations, Platform communications, booking facilitation, security and support. For these activities, the operator identified above is a data controller. When we send your booking information to the chosen Partner, that Partner will ordinarily act as its own controller for delivering the booking, managing its premises, meeting legal obligations and communicating with you about the visit. Each party is responsible for its own processing.
Guest records entered independently by a Partner. If a Partner enters customer records or notes obtained outside LookAlbania into its management dashboard and we merely host or process that information under its instructions, the Partner is normally the controller and LookAlbania is its processor. That processing is governed by a separate data processing agreement where required. Requests concerning the Partner's independently collected information may need to be handled by the Partner; we will assist it as required by law and contract.
The precise allocation of roles depends on the actual function and purposes. No wording in this Policy makes LookAlbania solely a processor for all reservations or removes a Partner's legal obligations.
3. Personal data we may collect
We collect the following categories of personal data where the relevant feature is used.
Guest and account information.
Name, email address, phone number, login credentials or authentication identifiers, account preferences, language and support requests.
Reservations and experiences.
Partner selected, date and time, number of people, booking status and reference, cancellation or no-show records where relevant, messages with the Partner and any optional special requests. If reviews are supported, we may also collect your ratings, written reviews and permitted uploads.
Partner representatives.
Business name, NIPT and billing information where needed, contact details, authorized users, contractual and operational correspondence, venue listing information and account activity.
Device and usage data.
IP address, browser and device information, approximate location inferred from IP, app or website activity, timestamps, security events, cookie and SDK identifiers and diagnostics, to the extent collected by our systems.
Location.
A city or location you manually choose and, only if the relevant feature is offered and you grant device or browser permission, more precise location data needed to provide location-based results. You can revoke device permissions at any time.
Payment-related information.
If a payment feature is offered, booking amount, status, transaction reference and information received from payment providers. Full card credentials are handled by the identified payment provider and are not stored by LookAlbania.
Optional sensitive information.
Special requests may disclose allergies, dietary or accessibility needs, which can reveal health or other sensitive data. Providing this information is optional. Do not include sensitive details unless needed for your booking. Where special-category data is processed, we rely on an appropriate legal ground and additional condition, including explicit consent where required.
4. Where we obtain the data
We obtain information directly from you, from a person making a booking on your behalf, from Partners recording or updating reservation status, and from technology providers used to deliver our services. If another person supplies your contact information for a group booking, we use it only for legitimate booking-related purposes and provide legally required information when appropriate.
5. Why we use data and our legal bases
We use personal data for the following activities, relying on the legal bases available under Albanian Law No. 124/2024 and, where it applies, the EU General Data Protection Regulation (GDPR).
Accounts, reservations and requested services.
To register and authenticate you, process bookings, show you the booking status and respond to your requests. This is normally necessary to provide a service or take steps at your request before a contract. For restaurants and bars, a completed booking is confirmed on the Platform. Experiences, tours and beach reservations stay pending until the Partner accepts them.
Partner operations and administration.
To administer commercial accounts, invoices and support. This is normally contractual necessity, a legal obligation or a legitimate interest, as applicable.
Security, fraud prevention and service integrity.
To investigate suspicious activity, prevent abuse, protect our systems and resolve booking disputes. This is normally a legitimate interest or a legal obligation, subject to applicable safeguards.
Service improvement and statistics.
To measure reliability, understand aggregate booking patterns and improve search and usability. We rely on legitimate interests for limited necessary analytics, or on consent where required for non-essential technologies.
Legal compliance.
To meet tax, accounting, regulatory, law-enforcement and lawful dispute-resolution duties. The basis is a legal obligation, or the establishment, exercise or defence of legal claims where permitted.
Marketing and personalized promotions.
Newsletters, optional offers or non-essential tracking are used only on an applicable lawful basis, including consent when required. You can withdraw consent or object to direct marketing at any time.
Special requests revealing sensitive data.
Used only as needed to communicate your request to the selected Partner, subject to the additional safeguards and legal conditions that apply to such data. These requests are not part of a confirmed booking unless the Partner confirms them.
Information required for a booking.
Where personal data is necessary to create an account or complete a booking, failing to provide it may prevent that feature from working. Providing marketing preferences, precise location and sensitive special requests is optional.
6. When booking information is shared with a Partner
To arrange your requested reservation, we share relevant information with the specific Partner, such as your name, contact details, booking date and time, party size, booking status and the comments or special requests you choose to provide. The Partner needs this information to deliver the booking and to contact you about the visit. Where a booking stays pending until the Partner accepts it, the Partner also uses this information to decide that request.
We do not provide unrelated Partners with your full booking history merely because they use LookAlbania. Group-wide access, if enabled for venues under common ownership, must be appropriately disclosed and restricted to an authorized and lawful purpose. Partners must not assume that receiving booking details entitles them to send unsolicited marketing.
7. Other recipients
We may disclose personal data to vendors supporting our operations, such as hosting and infrastructure providers, email, SMS and push notification systems, customer support services, analytics providers, technical security services and payment processors, but only to the extent actually used and needed. These providers must be subject to appropriate contractual, confidentiality and security obligations. We may also disclose data where law requires it, to protect rights or safety, or as part of a legitimate business reorganization subject to applicable safeguards.
We do not sell Guest personal data. We do not share your reservation information with unrelated venues for their independent marketing merely because they participate on our Platform.
8. Payments
Some Partner services may require a deposit, prepayment or other charge where the Platform provides such functionality. The checkout should identify the payee, payment service provider and related conditions. Payment providers may act as independent controllers for their own compliance and fraud checks and publish their own notices. We retain only transaction details needed for the booking, reconciliation, support or legal obligations. This Policy does not claim that online payments are available for every booking.
9. Cookies and mobile technologies
We may use strictly necessary cookies or similar technologies for sessions, authentication, load balancing and security. Where used, analytics, personalization or advertising cookies and mobile SDKs are explained through the appropriate consent or preference mechanism where legally required. Non-essential technologies should not be activated before consent when consent is legally required.
You can manage eligible choices through the consent mechanism provided on the Platform, if available, and through browser or device settings. Disabling necessary cookies may affect login or reservation functions.
10. Communications and marketing
We may send transactional notifications such as booking status, reminders, security messages and relevant operational updates when needed to provide the service. For restaurants and bars, the status shown on the Platform is the confirmation. These messages are separate from promotional emails, SMS, push messages or tailored offers. Marketing is sent only where the law permits and with consent where required, and you may opt out using the method provided in a message or by contacting us. Opting out of marketing does not stop essential reservation notifications.
11. Children and information about others
Our booking and business account services are intended for adults. We do not knowingly solicit accounts from children under 18. Adults making a booking for a group should avoid disclosing unnecessary information about other guests and must have an appropriate basis for giving any contact details or special requests concerning them.
12. How long data is retained
We retain personal data only while it is needed for the purposes described above, including providing an active account, completing reservations, resolving disputes, maintaining security, and complying with applicable legal obligations. The retention period depends on the type of record, the user's relationship with us and any legally required accounting or limitation period.
Marketing preference and suppression records may be kept for as long as reasonably necessary to honour your choices. Legally required financial records are held for the statutory period.
Where we act as processor for Partner-controlled records, retention and deletion are governed by the Partner's lawful instructions and the applicable data processing agreement, subject to legal obligations. Data may remain temporarily in protected backups until normal rotation, with restricted access.
13. Security
We use appropriate technical and organizational measures designed for the risks involved, such as access controls, authenticated accounts, transmission protections, staff authorization, security monitoring and backup procedures where implemented. No online service can guarantee absolute security. Please contact us if you believe your account or booking data has been exposed or misused.
14. Your rights and how to exercise them
Depending on the processing and applicable law, you may have the right to be informed, access your information, request correction or deletion, restrict or object to processing, request portability, withdraw consent, and challenge certain solely automated decisions. These rights are subject to lawful limitations and do not automatically require deletion of legally necessary records.
Send requests to info@lookalbania.al, indicating that they concern privacy. We may request proportionate information to verify your identity. Under the relevant Albanian framework, we ordinarily respond without undue delay and within 30 days, with a permitted extension where justified and notified. If a request concerns information controlled by a Partner, we may refer or coordinate it with that Partner.
You may complain to Albania's Commissioner for the Right to Information and Protection of Personal Data at https://idp.al/ or use other available legal remedies. Residents of other jurisdictions may have additional rights under applicable law.
15. Profiling and automated decisions
We may use booking patterns or selected preferences to improve discovery and ranking, if those features are enabled. We do not describe such personalization as a legally significant solely automated decision. If we introduce decisions that produce legal or similarly significant effects through automated processing, we will provide the additional information and safeguards required by law before doing so.
16. International transfers
Some contracted technology providers may store or access personal data outside Albania. Where a transfer is subject to international-transfer restrictions, we rely on a legally valid mechanism, such as an applicable adequacy decision or suitable safeguards under Albanian law and, where relevant, GDPR. Use of the Platform is not treated as consent that overrides statutory transfer requirements. Information on the relevant countries, processors and safeguards can be requested using our privacy contact.
17. External services and changes to this Policy
Partner websites, social networks, maps, payment gateways and other linked sites may operate under separate privacy notices. We are not responsible for their independent practices. We may revise this Policy to reflect changes to our services, vendors or law, and will publish a new effective date and provide additional notice when required.
18. Contact
- Responsible operator:
- LookAlbania
- NIPT:
- L92110501A
- Registered office:
- Durrës, Albania
- Privacy contact:
- info@lookalbania.al
- Website:
- https://lookalbania.al
- Effective date:
- April 13, 2026