Privacy

Last updated on

Privacy Policy

Last updated: July 9, 2026

Our privacy policy is short because we collect almost nothing. No accounts, no newsletter, no ad tracking, no analytics, no cookies. You browse, you message us or book, you ride. That’s the whole data story.

Who is responsible

BikeTirana, operated by [TO CONFIRM: registered legal name] ([TO CONFIRM: NIPT/NUIS]), Rruga Qemal Stafa (8RJG+73W), New Bazaar (Pazari i Ri), Tirana, Albania. Email: biketirana@gmail.com. Phone/WhatsApp: +355 69 280 8181.

We process personal data under Albania’s Law No. 124/2024 “On Personal Data Protection”. If you are in the EU or UK, the GDPR / UK GDPR also protects you when you book with us, and we apply that standard to everyone.

  • No cookies. Our website sets zero cookies. That’s why there is no cookie banner.
  • No analytics or trackers. We don’t measure you, fingerprint you, or profile you.
  • Hosting. The site is served by Cloudflare, our hosting provider. Like any web server, Cloudflare processes your IP address transiently to deliver pages and block attacks. Cloudflare is certified under the EU-US Data Privacy Framework (their privacy policy).

When you contact or book us

Here is what we actually receive, and why:

  • WhatsApp: your phone number, name, and what you write to us. We use it to answer you and arrange your booking. Legal basis: taking steps at your request before a contract, and performing it. WhatsApp itself is run by Meta, which has its own privacy policy and processes your data under its own responsibility (WhatsApp privacy policy).
  • Bokun checkout (our direct booking system): your name, contact details, and booking details. Payment goes through Bokun’s payment processor; we never see or store your card number. Bokun is an Icelandic company operating under EEA data protection law (Bokun privacy policy).
  • GetYourGuide, Viator, Tripadvisor: if you book there, they are the controller of your checkout data and send us the manifest we need to run your tour: names, party size, and contact detail. Their policies: GetYourGuide (Germany), Viator and Tripadvisor (US, certified under the EU-US Data Privacy Framework).
  • Email: whatever you send us, used only to reply.
  • In the shop, for rentals: we photograph your ID document and, for e-bikes, record a deposit. This is security for the bike. It stays in your rental record and we delete the ID photo on request once the bike is back.

We never sell data or share it for marketing, and there is no newsletter. We may message you once after your tour or rental, to check how it went or ask for a review. Reply “stop” and that’s the end of it.

For US customers: we do not “sell” or “share” personal information as California’s CCPA and similar state laws define those terms, and we honor access and deletion requests from anyone, anywhere, without asking where you live first.

What we keep, and for how long

  • Booking records and invoices: kept as long as Albanian tax and accounting law requires.
  • WhatsApp and email conversations: kept so we can help you when you come back, unless you ask us to delete them. One message does it. Copies held by WhatsApp, Bokun, GetYourGuide, or Viator live under their own policies.
  • ID photos from rentals: deleted on request once the bike is back.
  • Nothing else. There is no marketing database.

Your rights

Under Law No. 124/2024 (and GDPR, if it applies to you) you can ask us for access, correction, deletion, restriction, portability, or object to processing. Email biketirana@gmail.com and we’ll handle it, usually within days, at most within 30. Deleting a chat is a one-message request.

If we ever have a data breach that puts you at risk, we notify the Commissioner within 72 hours and tell you directly.

You can also complain to the Albanian supervisory authority: Commissioner for the Right to Information and Personal Data Protection (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale), Rr. “Abdi Toptani”, Nd. 5, Tirana, www.idp.al.

Changes

If our data practices ever change (for example, if we add analytics), this page changes first and the date at the top moves. The promise stands: we collect the least we can get away with, and we’d rather rent you a bike than mine your data.