Privacy Policy

At Garden Boutique Hotel, we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, store, and safeguard your data when you visit our website, make a reservation, or stay with us.

1. Information We Collect

We may collect the following types of personal information:

• Identity Information: Full name, date of birth, nationality, and passport or ID details provided at check-in.
• Contact Information: Email address, phone number, and postal address.
• Booking Information: Dates of stay, room preferences, special requests, and payment details.
• Usage Data: Information about how you interact with our website, including pages visited, time spent, and referring sources.
• Communication Data: Any correspondence between you and the hotel, including emails, feedback, and enquiries.

2. How We Use Your Information

We use the information collected for the following purposes:

• Processing and managing your reservations.
• Communicating with you about your booking, including confirmations and reminders.
• Personalising your stay and fulfilling special requests.
• Sending promotional offers and newsletters, where you have opted in.
• Improving our website, services, and guest experience.
• Complying with legal obligations and local regulations.

3. Legal Basis for Processing

We process your personal data based on one or more of the following legal grounds: performance of a contract (when you make a reservation), your consent (for marketing communications), compliance with legal obligations (identity verification under Albanian law), and our legitimate interests (improving services and ensuring security).

4. Data Sharing

We do not sell your personal information. We may share your data with trusted third parties only in the following circumstances:

• Booking Management: To manage and confirm your reservation details.
• Legal Authorities: When required by Albanian law or regulation, such as guest registration with local police.
• Service Providers: Vercel Inc. (website hosting and image storage), Supabase Inc. (database hosting), and Resend Inc. (email delivery). These providers are bound by data processing agreements and process data only on our instructions.

5. Cookies & Tracking

Our website uses only essential cookies required for the website to function, such as session management and authentication. We do not use any analytics, tracking, or marketing cookies. You may accept or decline non-essential cookies via the banner displayed on your first visit.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy, or as required by law. Booking records are retained for a minimum of 5 years in accordance with Albanian fiscal and hospitality regulations. Contact form messages are retained for up to 90 days. You may request deletion of your data at any time via our My Booking page or by emailing us. Upon request, personal data in bookings will be anonymised while retaining the booking record for legal compliance. Newsletter subscribers can unsubscribe at any time via our unsubscribe page.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. This includes encrypted data transmission (SSL/TLS), secure server infrastructure, and restricted access to personal information on a need-to-know basis.

8. Third-Party Links

Our website may contain links to external websites such as social media platforms and travel review sites. We are not responsible for the privacy practices or content of these third-party websites. We encourage you to review their privacy policies before sharing any personal information.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on this page with a revised “Last updated” date. We encourage you to review this policy periodically.