Privacy Policy

1. Who We Are (Data Controller)

Business name: Easy Go Boat Trip

Owner / Data Controller: Aeron Hysaj

NUIS: M31907014D

Address: Sea Port Terminal, Rruga Mitat Hoxha St, Sarandë, Vlorë, Albania

Email: info@easygoboattrip.com

Phone / WhatsApp: +355 69 29 58 627

2. What Personal Data We Collect

We collect personal data only when you interact with our website or services. The categories of data we process are:

Category	Data collected	Source
Contact & booking	Full name, email address, phone number, preferred tour, date, number of passengers, message	Contact / booking form
Payment	Card payment data (processed directly by Stripe — we do not store card details); bank transfer details for bank payments (name, IBAN)	Stripe payment form / bank transfer
Communications	Content of messages sent via WhatsApp, email or contact form	Direct communication
Analytics	Pages visited, browser type, device, approximate location, session duration (anonymised)	Google Analytics 4 (cookies)

3. How We Use Your Data

We process your personal data for the following purposes and on the following legal bases:

• To process your booking and confirm your tour — legal basis: performance of a contract (Art. 6(1)(b) GDPR)
• To process payments — legal basis: performance of a contract (Art. 6(1)(b) GDPR)
• To respond to your enquiries and provide customer support — legal basis: legitimate interest (Art. 6(1)(f) GDPR)
• To send booking confirmations and pre-tour information by email or WhatsApp — legal basis: performance of a contract
• To improve our website using analytics — legal basis: your consent via cookie banner (Art. 6(1)(a) GDPR)
• To comply with legal obligations (e.g. accounting, tax records) — legal basis: legal obligation (Art. 6(1)(c) GDPR)

We do not use your data for automated decision-making or profiling.

4. Stripe Payment Processing

Online card payments are processed by Stripe (Stripe Payments Europe, Ltd.). When you pay by card, your payment data (card number, expiry date, CVV) is entered directly on Stripe's secure page and is never stored on our servers. Stripe is PCI DSS compliant. For more information, see Stripe's Privacy Policy.

5. Bank Transfer Payments

If you choose to pay by bank transfer, your payment will be received at:

Your name and any reference information provided with the transfer will be retained for accounting purposes as required by law.

6. Who We Share Your Data With

We do not sell, rent or trade your personal data. We may share it with:

• Stripe — payment processing
• Google LLC — analytics (Google Analytics 4, anonymised data)
• Titan / Hostinger — email and web hosting infrastructure
• Legal authorities — if required by Albanian law or a court order

All third-party processors are bound by data processing agreements and appropriate safeguards.

7. International Transfers

Google Analytics and Stripe may process data outside the European Economic Area (EEA). Both companies are covered by adequacy decisions or Standard Contractual Clauses (SCCs) under GDPR Chapter V.

8. How Long We Keep Your Data

• Booking and payment records: 7 years (Albanian tax law requirement)
• Contact form messages: 2 years from the date of enquiry
• Analytics data: 14 months (Google Analytics default retention)
• WhatsApp / email communications: up to 2 years

After these periods, data is deleted or anonymised.

9. Your Rights

Under GDPR and Albanian data protection law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure ("right to be forgotten") — request deletion of your data (subject to legal retention obligations)
• Restriction — ask us to limit how we use your data
• Portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interest
• Withdraw consent — at any time, where processing is based on consent (e.g. analytics cookies)

To exercise any of these rights, contact us at info@easygoboattrip.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Albanian Information and Data Protection Commissioner (www.idp.al).

10. Cookies

We use cookies to improve your browsing experience and to analyse site traffic. For full details, please read our Cookie Policy. You can manage your cookie preferences at any time via our cookie banner or your browser settings.

11. Children's Privacy

Our services are not directed to children under the age of 16. We do not knowingly collect personal data from minors. If you believe a minor has submitted personal data to us, please contact us and we will delete it promptly.

12. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. All data transmitted via our website is encrypted using HTTPS/TLS. Payments are handled exclusively by Stripe's PCI-DSS compliant infrastructure.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. We encourage you to review this policy periodically. For significant changes, we will notify you by email where appropriate.

14. Contact Us

For any privacy-related questions or requests: