1. Introduction

Arka Art Hotel is an art boutique hotel in Tirana, offering accommodation, event and conference spaces, a restaurant and bars, a wellness centre, a gym, a swimming pool and a theatre. This website is administered on behalf of the “Arka Art Hotel” trademark.

This Privacy Policy explains how your personal data is collected, used, stored and protected when you visit arkahotel.al or when you interact with us through it. The processing of data is carried out in accordance with Law No. 124/2024 “On the Protection of Personal Data”, which is harmonised with the EU General Data Protection Regulation (GDPR 2016/679), as well as with the sub-legal acts in force in the Republic of Albania. By using this website, you confirm that you have read and understood this Policy. If you do not agree with it, please do not use the website.

2. Who we are (the Data Controller)

The controller of the personal data collected through this website is “ART & TOURISM DEVELOPMENT GROUP” SHPK, with NUIS L83705802U, having its registered office at “Hoteleri – Turizëm” Zone, Kanali i Çukës, Cadastral Zone 8642, Sarandë, Albania (hereinafter “we”, “ATDG SHPK” or the “Controller”).

For any matter relating to this Policy or to your personal data, you may contact us at:

• Email: info@arkahotel.al
• Phone: +355 (0) 68 60 82 970
• Address: “Kodra e Diellit” Residence 2, Rruga e Ftonjve 98, Tirana, Albania, 1001

3. What personal data we collect

We collect only the data that is necessary for the purposes described in this Policy. Specifically, we may process the following categories:

3.1. Data you provide voluntarily

• Through the contact form / request for information: first name, last name, email address, telephone number and the content of your message or request.
• Through communications with us: any data you choose to share when you write to us by email, call us or contact us on social networks.

3.2. Data collected automatically

When you visit the website, certain technical data is collected automatically through cookies and the analytics tool (see section 8). This includes the IP address (in anonymised form where possible), the type of device and browser, the operating system, the pages visited, the duration of the visit and the source from which you arrived at the website.

3.3. Reservations (external system)

This website does not process reservations directly. Reservations are made through an external third-party reservation system (StayGrid), which operates outside this website. The data you fill in during the reservation process is collected and processed by the provider of that system, in accordance with its own terms and privacy policy, and not by this website. We recommend that you read the privacy policy of the reservation platform before using it.

We do not intentionally collect special categories of data (sensitive data, such as health data, political or religious beliefs). Please do not include such data in the messages you send us, except where strictly necessary.

4. Legal basis and purposes of processing

We process your personal data on the legal bases provided for by Law No. 124/2024 “On the Protection of Personal Data”, as follows:

• Your consent — for newsletter subscription (where applicable) and for non-essential/analytical cookies. Consent may be withdrawn at any time.
• Pre-contractual measures / performance of your request — to respond to questions, requests for information or reservations that you initiate.
• Our legitimate interest — to ensure the functioning, security and improvement of the website, as well as general statistical measurement of usage.
• Legal obligation — where processing is required to fulfil an obligation arising from the legislation in force.

The purposes for which the data is used include: responding to your communications and requests; managing and facilitating reservations; sending you marketing communications only where you have given consent; analysing and improving the content and performance of the website; and maintaining the security of the website.

5. Google Analytics

This website uses Google Analytics, an analytics service provided by Google Ireland Limited, to understand how visitors interact with the website. This is the only third-party tool installed for measurement and analytics. Google Analytics uses cookies to generate statistical information about the use of the website, such as the number of visitors, the most visited pages and the duration of visits.

This data is used in aggregated form and is not intended to identify you personally. Analytical cookies are activated only after you give consent through the cookie banner. You may refuse or withdraw consent at any time.

For more information on how Google processes data, visit: policies.google.com/privacy. You may also install the official browser add-on to opt out of Google Analytics: tools.google.com/dlpage/gaoptout.

6. Sharing data with third parties

We do not sell or trade your personal data. The hosting infrastructure and the servers on which the website is stored are the property of ATDG SHPK and are administered by us. Data may be made available only to the following parties, and only to the extent necessary:

• The technical maintenance provider — which acts as a processor on our behalf, in accordance with our instructions and under a confidentiality obligation.
• Google (Google Analytics) — for analytical purposes, as per section 5.
• The external reservation system provider — to facilitate reservations, as per section 3.3.
• Competent authorities — only where required by law or to protect our legal rights.

Where processors are engaged, the relationship is governed by a written agreement that guarantees the protection and confidentiality of the data, in accordance with the legislation in force.

7. International data transfers

Some of our service providers (for example Google) may process data on servers located outside the Republic of Albania. In such cases, the transfer is carried out only where an adequate level of protection is guaranteed, through standard contractual clauses or other legally recognised mechanisms, in accordance with the requirements of Albanian personal data protection legislation.

8. Cookies

Cookies are small text files that are stored on your device when you visit a website. This website uses cookies as follows:

• Essential cookies — necessary for the basic functioning of the website and to save your cookie preferences. These do not require consent.
• Analytical cookies — related to Google Analytics, which are activated only after your consent.

When you visit the website for the first time, a cookie banner is displayed that allows you to: accept all cookies; reject non-essential cookies; or manage preferences by category. You may change your preferences at any time through the banner or the cookie settings on the website. You may also manage or delete cookies directly from your browser settings.

9. How long we keep the data

We keep personal data only for as long as is necessary for the purposes for which it was collected, or as required by legal retention periods. Specifically:

• Messages and requests for information are kept for as long as is necessary to handle the request and for a reasonable period thereafter for evidentiary purposes.
• Analytical data is kept in accordance with the Google Analytics retention settings.

At the end of the relevant period, the data is deleted or anonymised securely.

10. Your rights

In accordance with Law No. 124/2024 “On the Protection of Personal Data”, you have the following rights over your personal data:

• The right to information and access — to know whether we process your data and to obtain a copy of it.
• The right to rectification — to request the correction of inaccurate or incomplete data.
• The right to erasure (the “right to be forgotten”) — to request the deletion of data in the cases provided for by law.
• The right to restriction of processing — to request the restriction of processing in certain circumstances.
• The right to object — to object to processing based on legitimate interest or for marketing purposes.
• The right to data portability — to receive your data in a structured, machine-readable format.
• The right to withdraw consent — at any time, without affecting the lawfulness of processing carried out before withdrawal.
• The right to lodge a complaint — to lodge a complaint with the Commissioner for the Right to Information and Protection of Personal Data (IDP).

To exercise these rights, contact us at info@arkahotel.al. We will respond to your request within the timeframes provided for by law. We may request verification of your identity before acting.

11. Data security

We take appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or unlawful disclosure. These measures include access controls, the use of secure credentials and periodic updates to the security of the website. However, no system of transmission or storage over the internet can be guaranteed to be 100% secure.

12. Children’s privacy

This website is not directed at children, and we do not knowingly collect their personal data without the consent of a parent or legal guardian. If you believe that a child has provided us with data, please contact us so that we can delete it.

13. Changes to this Policy

We may update this Privacy Policy from time to time to reflect legal changes or changes in our practices. The most recent version is always published on this website, with the relevant effective date. We encourage you to review it periodically.

14. Contact

For any question, request or complaint regarding this Privacy Policy or the processing of your personal data, you may contact us:

• “ART & TOURISM DEVELOPMENT GROUP” SHPK
• Email: info@arkahotel.al
• Phone: +355 (0) 68 60 82 970
• Address: “Kodra e Diellit” Residence 2, Rruga e Ftonjve 98, Tirana, Albania, 1001