Privacy & Cookies Policy

This Privacy & Cookies Policy explains how Albaways (“we”, “us”, “our”) collects, uses, stores, shares, and protects your personal data when you use our website and services. It also explains how we use cookies and similar technologies, including Google tags, for analytics, advertising, security, and website functionality.

We aim to process personal data in accordance with applicable privacy laws, including the General Data Protection Regulation (GDPR), and to provide clear information about your choices and rights.

1. Who we are

Albaways operates an online platform that allows users to browse and book rental cars from participating car rental companies.

For privacy-related questions, you can contact us at support@albaways.al.

2. Data we collect

• Identity and contact data, such as name and email address
• Account data, such as login information and account type (customer/company)
• Booking and transaction data, such as rental dates, selected cars, locations, pricing, and booking history
• Company account information submitted by rental partners for account creation, verification, and operation
• Payment-related data, which may be processed by third-party payment providers
• Technical and usage data, such as IP address, browser type, device information, pages visited, referral source, and interactions on the site
• Cookie and similar technology data, including identifiers used for preferences, analytics, advertising, fraud prevention, and security

3. How we use your data

We may use personal data to:

• Create and manage user and company accounts
• Process and manage bookings and related transactions
• Provide customer support and partner support
• Communicate important service and transactional updates
• Monitor, secure, and improve our platform and services
• Prevent fraud, abuse, misuse, and unauthorized access
• Measure website traffic, conversions, and service performance
• Show, measure, and optimize advertising, where permitted by law and based on your consent choices where required
• Comply with legal, regulatory, tax, and accounting obligations

4. Legal basis under GDPR

• Art. 6(1)(b) — contract performance, for example to create accounts, process bookings, and provide requested services
• Art. 6(1)(c) — compliance with legal obligations, including tax, accounting, and regulatory requirements
• Art. 6(1)(f) — legitimate interests, including website security, fraud prevention, service improvement, and operational administration
• Art. 6(1)(a) — consent, where required, including for non-essential cookies, analytics, advertising, and ads personalisation

5. Cookies and similar technologies

We use cookies, pixels, tags, local storage, and similar technologies to operate our website, remember preferences, understand how visitors use our site, measure performance, improve our services, and support advertising and conversion measurement.

These technologies may be classified as:

• Strictly necessary cookies — required for site functionality, security, authentication, and fraud prevention
• Preference cookies — used to remember settings and choices
• Analytics cookies — used to understand website traffic, usage patterns, and performance
• Advertising cookies — used to measure ad performance, limit repetitive ads, support conversion tracking, and, where permitted, personalize ads

6. Google tags, analytics, and advertising

We may use Google services such as Google Tag Manager, Google Analytics, and Google Ads-related measurement or remarketing tools. These services may use cookies and similar technologies to collect information about how you interact with our website and to measure the effectiveness of our advertising.

Google and its partners may use cookies to serve ads based on your visits to this website and/or other websites. Depending on your consent choices, this may include ads measurement, conversion tracking, and ads personalisation.

Where required by law, we ask for your consent before using non-essential Google tags or cookies. Your consent choices may be communicated to Google through consent mode or similar consent signalling mechanisms. If you decline non-essential cookies, Google tags may operate in a limited mode or remain blocked, depending on our configuration and the consent choices you make.

You can also learn more about how Google uses information in relation to advertising and cookies through Google’s own privacy and ad settings information.

7. Consent management

When you first visit our website, you may be shown a consent banner or similar consent interface that allows you to accept, reject, or manage categories of non-essential cookies and technologies.

You can update your preferences later through our cookie settings, if available, or by changing your browser settings. Please note that disabling certain technologies may affect some site features or functionality.

8. Third-party service providers

We may share personal data with trusted service providers who process data on our behalf and only where necessary for the purposes described in this policy, including:

• AWS and related cloud infrastructure providers
• Payment service providers
• Analytics, tag management, and advertising providers
• Email and communication service providers
• Security, monitoring, and fraud-prevention providers

Where required, we take steps to ensure these providers are subject to appropriate contractual and data protection obligations.

9. International data transfers

Some of our service providers may process personal data outside your country or outside the European Economic Area. Where this happens, we aim to use appropriate safeguards where required, such as contractual protections or other lawful transfer mechanisms.

10. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this policy, including to provide services, maintain booking history, resolve disputes, enforce agreements, comply with legal obligations, and protect our legitimate interests.

11. Your rights

Depending on applicable law, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your personal data
• Request restriction of processing
• Object to certain processing activities
• Withdraw consent at any time where processing is based on consent
• Request data portability where applicable
• Lodge a complaint with a supervisory authority

12. Security

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. However, no method of transmission or storage is completely secure.

13. Changes to this policy

We may update this policy from time to time to reflect legal, technical, or business changes. The updated version will be posted on this page with a revised “Last updated” date.

14. Contact

If you have questions about this Privacy & Cookies Policy or want to exercise your rights, contact us at support@albaways.al.