Privacy Policy.

We collect what we need to run your booking and the hotel — your name, contact details, dates of stay, and payment information. We don't sell your data. We share it only with the booking and payment systems we use to run the business.

You have full rights over your data under EU GDPR and Albanian Law on Protection of Personal Data (Law No. 9887). You can ask to see, correct, or delete what we hold at any time.

Harbour Hotel — Butrinti Kanali Cukes Street, 9703 Sarandë, Albania. We are the data controller for the personal information described in this policy.

Contact: [email protected] · +355 69 700 5004

When you book a room: your name, email, phone, postal address, dates of stay, number of guests, special requests, and payment information.

When you visit our site: standard analytics through Google Analytics 4 — anonymised IP, browser type, device, pages viewed, time on page, and the page you arrived from. We use this to improve the site and spot bugs. Analytics data is not linked to your name or booking details.

When you contact us: anything you share by email, WhatsApp, or phone.

Performance of a contract — to process your booking, take payment, and deliver the stay.

Legal obligation — to comply with Albanian hospitality laws, tax requirements, and guest registration.

Legitimate interest — to improve our service, prevent fraud, and respond to reviews.

Consent — for marketing emails. You can opt out at any time.

Our booking platform (reserve-online.net) — to process reservations.

Our payment processor — to handle card transactions under PCI DSS security standards.

Albanian authorities — guest registration as required by local law.

We do not sell, rent, or trade your personal data. Ever.

Some of our service providers (booking, analytics, email) are based outside Albania, including in the European Economic Area and the United States. We use providers that comply with EU GDPR standards and rely on Standard Contractual Clauses where required.

Booking records: 7 years (for tax and accounting purposes under Albanian law).

Marketing data: until you unsubscribe, then deleted within 30 days.

Analytics: up to 26 months in anonymised form.

You have the right to:

• Access — request a copy of the personal data we hold about you.

• Rectification — correct anything that's wrong.

• Erasure — ask us to delete your data (subject to legal retention).

• Restriction — limit how we use your data.

• Portability — receive your data in a machine-readable format.

• Object — to processing based on legitimate interest or marketing.

• Withdraw consent — at any time for consent-based processing.

Email [email protected] with your request. We respond within 30 days.

We use cookies in two categories: essential cookies that make the site work (no consent needed under GDPR Article 6) and analytics cookies via Google Analytics 4 (which we only set if you accept).

On your first visit you see a consent banner with two options: Accept or Reject. We default to denying analytics cookies until you choose — this is Google Consent Mode v2 behaviour. If you accept, Google Analytics sets cookies prefixed with _ga and _ga_ that count unique visitors and sessions, expiring after up to 2 years.

What Google Analytics sees when accepted: anonymised IP (Google truncates the last digits), browser, device, pages visited, referring site, and rough geographic location (city-level). It does not see your name, email, booking details, or payment information — those never leave our booking system.

You can change your mind anytime via the "Cookie Preferences" link in the footer, or by clearing harbourhotel.al cookies in your browser. We do not use cookies to track you across other websites.

HTTPS across the site, encrypted payment processing, and access controls on our internal systems. Nothing on the internet is fully secure, but we apply reasonable, industry-standard safeguards.

Bookings are for adults 18+. We don't knowingly collect data from anyone under 18 without parental consent. If you believe a minor has shared data with us, email us and we'll delete it.

If you believe we've mishandled your data, you can complain to the Albanian Commissioner for the Right to Information and Protection of Personal Data (idp.al). You also have the right to complain to your local EU data protection authority if applicable.

When we update this policy, the new version replaces this page and the "last updated" date changes. Significant changes get an email to anyone who has booked with us.