Privacy policy

We only collect the data we need to answer you:

• Room booking request: name, email, phone, country (optional), dates of stay, number of rooms and guests (adults and children), expected arrival time and any special requests you write to us.
• Table reservation: name, email, phone, date and time, party size, preferred area, the occasion (if you mention one) and your notes.
• Event enquiry: name, email, phone, type of event, preferred venue, dates, number of guests, indicative budget, the services you are interested in and your message.
• Contact form: name, email, phone (optional), topic, subject and message.
• Technical data: with every request we store a keyed hash of your IP address, never the address itself, and the language of the page. We also use technical signals to tell people apart from automated programs.

Please do not send us sensitive data, such as health information, unless your request needs it, for example a food allergy.

• To answer and manage your request (room, table, event or message): processing is necessary to take steps at your request before entering into a contract and, once confirmed, to perform it. For general messages we rely on the consent you give in the form and on our legitimate interest in replying to you.
• To send you confirmation emails about your request, on the same basis. We never send you marketing without your separate consent.
• To keep the website secure (limiting repeated requests, protecting against spam and abuse, keeping security logs): our legitimate interest in protecting the service and our guests.
• To meet legal obligations, for example keeping accounting and tax records once a booking goes ahead.

You may withdraw your consent at any time; this does not affect the lawfulness of processing carried out before.

We keep data only for as long as it is needed. Our standard policy periods are:

• Requests and messages (rooms, tables, events, contact): up to 24 months from our last contact with you.
• Bookings that go ahead: for as long as accounting and tax law requires.
• Security logs of the administration panel: up to 12 months.
• Anti-abuse counters (hashed): deleted automatically within a few days.

These are standard periods and we may shorten them when the data is no longer needed. Afterwards, data is deleted or anonymised.

Your data is seen only by the members of our team who handle your request. We share it only with providers who help us run this service and who process it on our instructions:

• our hosting provider, where the website and database are kept;
• our email provider, through which notifications and confirmations are sent;
• Cloudflare Turnstile, only if bot protection is active on a form, to check that a request comes from a person;
• Google, only if you choose to show the map on the contact page.

We do not sell your data and we use no advertising or analytics trackers. Data may be disclosed to authorities only where the law requires it.

Some of our providers may process data outside Albania, for example in the European Union or the United States. In such cases we make sure the transfer is lawful: to countries with an adequate level of protection, or with appropriate safeguards such as standard contractual clauses.

At any time you have the right to:

• access the data we hold about you and receive a copy;
• ask for rectification of inaccurate or incomplete data;
• ask for erasure when there is no longer a legal reason to keep it;
• ask for restriction of processing;
• object to processing based on our legitimate interest;
• ask for portability of the data you have given us, in a common electronic format;
• withdraw your consent where processing is based on it.

To exercise them, write to us at info@kompleksiunivers.com. We will reply without undue delay and within the legal deadlines; we may ask you to confirm your identity.

If you believe your data is not being handled properly, you have the right to complain to the Commissioner for the Right to Information and Personal Data Protection (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale, www.idp.al (opens in a new window)).

• All communication with the website is encrypted (HTTPS/TLS).
• IP addresses are stored only as one-way keyed hashes, never as readable addresses.
• The administration panel is available only to authorised staff, with strong passwords stored hashed and two-factor authentication (2FA).
• Each team member sees only what they need for their work, and important actions are logged.
• Our forms are protected against spam and automated repeat requests.

We use only essential cookies: one to remember the language you chose and, for staff only, a session cookie for the administration panel. We use no analytics or advertising cookies. You will find the details in our cookie policy.

Our forms are intended for adults. For children staying with you, we only need their number and, where necessary, their age, for a cot for example.

We may update this policy when our services or the law change. The date of the latest update is shown at the top of the page; we will flag important changes clearly on the website.