Last updated: 12 October 2026
1. Who we are
Royal East Hotel (“we”, “us”) operates the hotel, bar and restaurant at Autostrada Tiranë – Elbasan, 1001 Tirana, Albania, and the website https://royaleastresort.al. We are the controller of the personal data described in this policy.
This policy explains what personal data we collect, why, on what legal basis, how long we keep it and how you can exercise your rights. It applies to website visitors, people who contact us, guests who book or stay with us, and restaurant customers.
- Address: Autostrada Tiranë – Elbasan, 1001 Tirana, Albania
- Email: resort.royal.east@gmail.com
- Phone: +355 69 20 60 690
2. Legal framework
We process personal data in accordance with Albanian Law No. 124/2024 “On the Protection of Personal Data”, which is aligned with the EU General Data Protection Regulation (GDPR), and with the guidance of the Albanian Commissioner for the Right to Information and Personal Data Protection. We also comply with Albanian laws that require hotels to register guests and keep accounting and tax records.
We follow the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.
3. What data we collect
| Category | What it includes | How we get it |
|---|---|---|
| Technical data | IP address, browser and device type, date and time of visit, pages visited | Automatically, from our web server |
| Contact form and email | Full name, email, phone number, preferred contact method, your message | When you fill in the contact form or write to us |
| Booking data | Name, contact details, dates of stay, number of guests, room type, price, special requests | From you, or from the booking platform you used (see section 5) |
| Guest registration | Full name, nationality, date of birth, identity document or passport number, dates of stay | At check-in, as required by Albanian law |
| Payment data | Amount paid, payment method, invoice details. Card details are processed by the payment provider or booking platform; we do not store full card numbers. | At booking, check-in or check-out |
| Stay and restaurant data | Room charges, restaurant orders, reservations, preferences you share with us | During your stay or visit |
| Special requests | Accessibility needs, dietary requirements or allergies | Only if you choose to tell us |
| CCTV footage | Images of people in monitored areas | From security cameras on the premises (see section 6) |
Information about allergies or accessibility needs may be health data. We use it only to meet your request, and only with your explicit consent, which you give by sharing it with us.
4. Why we use your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Managing your booking and stay, check-in, check-out, invoicing | Performance of a contract with you |
| Registering guests and reporting foreign guests to the authorities | Legal obligation |
| Accounting, tax and fiscal invoicing | Legal obligation |
| Answering your messages and requests | Steps taken at your request before a contract, or our legitimate interest in replying to enquiries |
| Meeting dietary or accessibility requests | Your explicit consent |
| Security of guests, staff and property (CCTV) | Our legitimate interest in safety and crime prevention |
| Running and securing the website | Our legitimate interest in a working and secure website |
| Handling complaints and legal claims | Our legitimate interest in defending our rights |
We do not sell your data, we do not send marketing messages without your consent, and we do not make automated decisions that have legal effects on you.
5. Booking platforms
Reservations made with the “Book Now” button are handled by our booking engine provider, BookersPro, which processes your data on our behalf. If you book through Booking.com or Expedia, that platform collects your data first under its own privacy policy and passes us what we need to provide your stay. For the data they hold, these platforms are separate controllers.
6. CCTV
For the safety of guests, staff and property, we use security cameras in public areas such as entrances, reception, corridors and the parking area. There are never cameras in rooms, bathrooms or other private areas. Monitored areas are marked with signs. Footage is accessed only by authorised staff and is shared only with the police or courts when required by law or needed to investigate an incident.
7. Cookies and third-party content
Our website uses only cookies that are necessary for it to work and to keep it secure. We do not use advertising or tracking cookies.
Some content is loaded from third parties:
- Google Fonts – fonts may be loaded from Google’s servers, which receive your IP address.
- Booking engine – when you click “Book Now” you leave our site for BookersPro’s booking page, which has its own cookies and privacy policy.
- Social media – our Facebook and Instagram icons are simple links. Meta receives data only if you click them.
You can block or delete cookies at any time in your browser settings.
8. Who we share data with
- Public authorities – the State Police (registration of foreign guests), tax authorities, courts and other authorities when the law requires it.
- Booking platforms – BookersPro, Booking.com and Expedia, as described in section 5.
- Payment providers and banks – to process payments and refunds.
- Technical providers – our website hosting provider, our web developer Park Studios for website maintenance, and Google for email services. They act only on our instructions.
- Professional advisers – accountants and lawyers, under a duty of confidentiality.
9. International transfers
Some providers, such as Google, Booking.com and Expedia, may process data outside Albania, including in the European Union and the United States. Such transfers take place only to countries with an adequate level of protection or with appropriate safeguards such as standard contractual clauses, as required by Law No. 124/2024.
10. How long we keep your data
| Data | Retention period |
|---|---|
| Contact form messages and emails | 2 years after the enquiry is closed |
| Booking and stay records | Until the end of your stay plus the period needed for any claims, but no longer than legally required |
| Guest registration data | For the period required by Albanian law |
| Invoices and accounting records | 10 years, as required by Albanian accounting law |
| CCTV footage | Up to 30 days, unless needed to investigate a specific incident |
| Dietary or accessibility information | Until the end of your stay |
| Website server logs | 6 months |
After these periods, data is securely deleted or anonymised.
11. Security
We use appropriate technical and organisational measures to protect your data, including an encrypted connection (HTTPS), restricted access for authorised staff only, regular updates of our website software and staff confidentiality obligations. If a data breach is likely to put your rights at risk, we will notify the Commissioner within 72 hours and, where the risk is high, inform you without undue delay.
12. Your rights
Under Law No. 124/2024 you have the right to:
- access your personal data and receive a copy;
- correct inaccurate or incomplete data;
- erasure, where we no longer need the data and are not legally required to keep it;
- restrict processing in certain cases;
- object to processing based on our legitimate interests;
- data portability for data you gave us under a contract or consent;
- withdraw consent at any time, without affecting earlier processing.
To exercise your rights, email resort.royal.east@gmail.com with the subject “Personal data request”. We may ask you to confirm your identity. It is free of charge and we will reply within 30 days.
13. Children
Our website is not directed at children under 16. Children’s data is processed only when they stay with a parent or guardian, and only as required for registration and their stay.
14. Complaints and changes
If you believe your data is processed unlawfully, please contact us first so we can resolve it. You also have the right to lodge a complaint with the Albanian supervisory authority:
- Commissioner for the Right to Information and Personal Data Protection
- Address: Rr. “Abdi Toptani”, Nd. 5, Tirana, Albania
- Website: www.idp.al
- Email: info@idp.al
We may update this policy when the law or our practices change. The current version is always published on this page with the date of the last update at the top.