Privacy and Cookie Policy

1. About this policy

This Privacy and Cookie Policy explains how Wonder Albania collects, uses, shares and protects personal information when you:

• visit wonderalbania.com;
• contact us or request a quotation;
• book or participate in a tour, package, transfer, accommodation or other travel service;
• create an account, save an itinerary or use a Wishlist;
• subscribe to marketing communications; or
• otherwise interact with our team.

This policy also explains the limited use of cookies and similar technologies on our website.

2. Who is responsible for your information

The controller responsible for deciding how and why your personal information is processed is:

• Legal entity: Wonder Albania SH.P.K.
• NUIS/NIPT: M62028029S
• Trading name: Wonder Albania
• Business address: Rruga e Dibrës, Ndërtesa II, Nr. 225, Pasuria 7/91, Zona Kadastrale 8300, 1007 Tirana, Albania
• Privacy email: hello@wonderalbania.com
• Telephone: +355 692290036
• Emergency assistance: +355 682778037

In this policy, “Wonder Albania”, “we”, “us” and “our” refer to the legal entity identified above.

3. Information we collect

The information we collect depends on how you use our services.

Information you provide directly

We may collect:

• your name, date of birth, nationality and contact details;
• the names and details of other Travellers included in your booking;
• booking preferences, travel dates, destination, accommodation and room preferences;
• billing information, payment status and transaction references;
• passport, visa or identity-document details when reasonably required for a booking;
• emergency-contact information;
• dietary requirements, allergies, accessibility needs and relevant health information;
• messages, enquiries, feedback, complaints and customer-service records;
• marketing preferences;
• photographs, reviews or other content you choose to submit; and
• account and authentication information, where accounts are available.
• tours you add to or remove from your Wishlist.

Please provide only information that is reasonably necessary for your enquiry or booking. Do not send full payment-card details by ordinary email or messaging services.

Information collected automatically

When you use our website, we may automatically receive:

• IP address;
• browser and device type;
• operating system;
• approximate location derived from IP address;
• pages visited, referring page, dates and times;
• website errors, security events and performance information; and
• cookie or consent preferences.

Information received from other sources

We may receive information from:

• the Lead Traveller making a booking for a group;
• travel agents and business partners;
• hotels, guides, transport providers, activity operators and other suppliers;
• payment and fraud-prevention providers;
• analytics, authentication and website-service providers; and
• public authorities where legally permitted or required.

If you provide information about another person, you must have authority to do so and should make this policy available to them.

4. Why we use personal information

We process personal information for the following purposes:

• answering enquiries and preparing quotations or itineraries;
• confirming, administering and delivering bookings;
• coordinating hotels, guides, transport, activities and other suppliers;
• processing and recording payments, refunds and cancellations;
• communicating changes, safety information and travel assistance;
• handling accessibility, dietary, allergy or health-related needs;
• preventing fraud, misuse and security incidents;
• keeping financial, booking and legal records;
• responding to complaints and enforcing agreements;
• improving our website and services;
• sending marketing where permitted; and
• complying with legal and regulatory obligations.

We do not sell personal information.

5. Legal bases for processing

Depending on the circumstances, we rely on one or more of the following legal bases:

• Contract: processing is necessary to prepare, enter into or perform your travel booking or another agreement with you.
• Legal obligation: processing is necessary to comply with tax, accounting, consumer-protection, security or other applicable law.
• Legitimate interests: processing is necessary for reasonable business purposes such as responding to enquiries, securing our website, preventing fraud, managing suppliers, improving services and defending legal claims, where those interests are not overridden by your rights.
• Consent: you have clearly agreed to a specific use, such as optional marketing cookies or email marketing, and may withdraw that consent.
• Vital interests: processing is reasonably necessary to protect someone’s life or physical safety in an emergency.

6. Health, accessibility and other sensitive information

Information about health, allergies, accessibility or dietary requirements may reveal sensitive personal information. We process it only when necessary to safely arrange or provide your requested service and when a lawful condition permits, including explicit consent where required, protection of vital interests, or establishment and defence of legal claims.

We limit this information to what is reasonably necessary and share it only with people who need it to arrange or safely provide the service. You may withdraw consent where consent is the legal basis, but this may prevent us or a supplier from safely providing part of the booking.

7. Payment information

Payments may be processed by banks, payment processors or booking partners. We generally receive payment confirmation, transaction references and limited billing information rather than complete card details.

When you use a third-party payment service, that provider may process your information under its own privacy policy. You should review the information shown by the provider before submitting payment.

8. When we share information

We may share personal information, where reasonably necessary, with:

• hotels and accommodation providers;
• guides, drivers, transport companies and carriers;
• restaurants, activity operators and local partners;
• booking, payment, accounting and fraud-prevention providers;
• website hosting, database, storage, email, analytics, authentication and customer-support providers;
• insurers and professional advisers;
• government, border, law-enforcement or regulatory authorities where legally required; and
• a buyer, investor or successor involved in a legitimate business restructuring, subject to appropriate confidentiality and legal safeguards.

Suppliers may act as our processors, independent controllers or joint controllers depending on the service and applicable law. Where a supplier independently determines how it uses information, its own privacy policy may also apply.

We disclose only information reasonably necessary for the relevant purpose.

9. International transfers

Some Travellers, suppliers or technology providers may be located outside Albania or the country where you live. As a result, personal information may be processed in another country whose laws differ from those in your country.

Where required, we use an appropriate transfer mechanism, such as an adequacy decision, approved standard contractual clauses, contractual safeguards or another mechanism permitted by applicable data-protection law. You may contact us for further information about the safeguards relevant to your information.

10. How long we keep information

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including legal, accounting, tax, safety and dispute-resolution requirements.

Typical retention periods are:

These periods may be extended where required by law, necessary for a dispute or requested by a competent authority. Information may be deleted or anonymised earlier when it is no longer needed.

11. Marketing

We may send marketing emails only where permitted by law, such as when you have consented or where another lawful basis applies. Marketing consent is optional and is not a condition of booking.

You can unsubscribe using the link in an email or by contacting hello@wonderalbania.com. We may keep a minimal suppression record so that we do not accidentally contact you again.

Service messages about an enquiry, booking, payment, safety issue or itinerary are not marketing and may still be sent when necessary.

12. Your privacy rights

Subject to applicable law and any relevant exceptions, you may have the right to:

• receive information about how we process your data;
• request access to your personal information;
• correct inaccurate or incomplete information;
• request deletion;
• restrict certain processing;
• object to processing based on legitimate interests or to direct marketing;
• withdraw consent at any time where processing relies on consent;
• receive certain information in a portable format;
• object to certain decisions based solely on automated processing; and
• lodge a complaint with a competent data-protection authority.

To exercise a right, email hello@wonderalbania.com. We may request information reasonably necessary to verify your identity and protect your information. We will respond within the period required by applicable law.

If you are in Albania, you may complain to the Commissioner for the Right to Information and Protection of Personal Data at idp.al. If another authority has jurisdiction where you live, you may also have the right to contact that authority.

13. Children and minors

Our booking services are directed to adults. A person under 18 may travel only with the consent and supervision required by law and our Booking Terms.

Where a parent, guardian or Lead Traveller provides a minor’s information for a booking, we use it only as reasonably necessary to arrange and safely provide the travel service or comply with law. We do not knowingly use a minor’s information for behavioural advertising.

If you believe a minor has submitted information without appropriate authorisation, contact us.

14. Automated tools and Wonder AI

If Wonder AI or another automated trip-planning feature is available, do not enter passport numbers, payment-card details, medical records or other highly sensitive information unless the feature expressly requests it through a secure process.

Automated recommendations may assist with travel planning but should not be treated as authoritative legal, visa, medical or safety advice. Where required by law, we will provide information about significant automated decision-making and the rights available to you.

15. Security

We use reasonable technical and organisational measures designed to protect personal information, including access controls, secure connections, service-provider controls, backups and staff access limited to legitimate business needs.

No internet or storage system is completely secure. You are responsible for keeping account credentials confidential and notifying us if you suspect unauthorised access.

If a personal-data breach occurs, we will investigate and notify affected people and competent authorities where required by law.

16. Cookies and similar technologies

We use cookies and browser storage to keep the site secure, support bookings and enquiries, and remember choices you make. Our Cookie Policy explains the purposes and how long storage lasts.

If you agree to site insights, Vercel Web Analytics and Microsoft Clarity help us understand visits and improve the booking experience. This includes broad traffic trends and masked interaction recordings. We do not use these tools for advertising, and our analytics events do not include names, contact details, booking references or form content. Vercel's daily visitor identifier resets after 24 hours. Microsoft states that ordinary Clarity playback is normally retained for 30 days, while some aggregated interaction data may be kept for up to nine months.

If you separately agree to offers for you, we use the titles and travel themes of trips saved in this browser to put similar collections first on our homepage. This happens on your device and does not subscribe you to marketing email or send those interests to advertising networks. Turning this choice off restores the usual order.

Our analytics providers may process data outside your country. Where required for transfers from the European Economic Area or United Kingdom, we rely on applicable contractual or other lawful safeguards; contact us for information about the relevant mechanism. You can withdraw analytics consent at any time using Cookie settings on our Cookie Policy page. This stops future analytics in your browser and does not affect processing already lawfully carried out. You can also clear stored data in your browser settings.

17. Managing cookies

The first-visit panel lets you choose site insights and offers for you separately, accept both or continue with neither. Ignoring it does not count as consent. We remember your choices for up to 183 days and ask again after a material change. Necessary storage remains available for functions you request; blocking it may make those functions unavailable. See the Cookie Policy for more detail.

18. Third-party websites

Our website may link to airlines, hotels, payment services, social networks and other third-party websites. Those organisations control their own services and privacy practices. This policy does not govern their independent processing.

19. Changes to this policy

We may update this policy when our services, suppliers, technologies or legal obligations change. We will publish the updated version with a revised date and provide additional notice where a change is material or consent is required.

20. Contact us

For privacy questions or requests:

Wonder Albania
Email: hello@wonderalbania.com
Telephone: +355 692290036
Emergency assistance: +355 682778037