Last updated: 14 October 2026

1. Who we are

Olympia Villas & Hotel (“Olympia”, “we”, “us”) operates the hotel and villas at Radhima beach, 9426 Vlorë, Albania, including the restaurant, pool and beach area, and the website https://olympiahotel.al. We are the controller of the personal data described in this policy.

This policy explains what personal data we collect, why, on what legal basis, how long we keep it and how you can exercise your rights. It applies to website visitors, people who contact us, guests who book or stay with us, and restaurant guests.

2. Legal framework

We process personal data in accordance with Albanian Law No. 124/2024 “On the Protection of Personal Data”, which is aligned with the EU General Data Protection Regulation (GDPR), and with the guidance of the Albanian Commissioner for the Right to Information and Personal Data Protection. We also comply with Albanian laws that require accommodation providers to register guests and keep accounting and tax records.

We follow the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

3. What data we collect

Category What it includes How we get it
Booking data Name, email, phone number, country, dates of stay, number of guests, room or villa booked, price, special requests, payment details as processed by the booking engine When you book on our website, by phone or email, or through an online travel platform
Guest registration Full name, nationality, date of birth, identity document or passport number, dates of stay At check-in, as required by Albanian law
Stay and payment data Room, restaurant and other charges, invoices, payment method During your stay
Allergies and special requests Dietary requirements, allergies or accessibility needs Only if you choose to tell us
Messages Name, contact details and your message When you contact us by email, phone or social media
Technical data IP address, browser and device type, date and time of visit, pages visited Automatically, from our web server

Information about allergies or health needs is health data. We use it only to meet your request, and only with your explicit consent, which you give by sharing it with us.

4. Why we use your data and on what legal basis

Purpose Legal basis
Managing your booking and stay, check-in, check-out and payment Performance of a contract with you
Registering guests and reporting foreign guests to the authorities Legal obligation
Invoicing, accounting and tax Legal obligation
Meeting dietary, allergy or accessibility requests Your explicit consent
Answering your questions Our legitimate interest in replying to enquiries, or steps taken at your request before a contract
Security of guests and property Our legitimate interest in safety and crime prevention
Running and securing the website Our legitimate interest in a working and secure website
Handling complaints and legal claims Our legitimate interest in defending our rights

We do not sell your data, we do not send marketing messages without your consent, we do not use analytics or advertising tracking tools, and we do not make automated decisions that have legal effects on you.

5. Bookings and booking platforms

Reservations made through our website are handled by our booking engine providers, HotelBee and Beds24, which process your booking and payment data on our behalf. If you book through an online travel platform such as Booking.com, that platform collects your data first under its own privacy policy and passes us what we need to provide your stay. For the data they hold, such platforms are separate controllers.

6. Security cameras

Where security cameras are used, they cover only common areas such as entrances, reception, parking and outdoor areas, for the safety of guests and property. There are never cameras in rooms, villas, bathrooms or changing areas. Monitored areas are marked with signs. Footage is kept for up to 30 days, unless needed to investigate a specific incident, and is shared only with the police or courts when required by law.

7. Cookies and third-party content

Our website uses only cookies that are necessary for it to work and to keep it secure. We do not use analytics, advertising or tracking cookies.

  • Booking engines – when you click “Book Your Stay” or a room link, you go to the booking page of HotelBee or Beds24, which have their own cookies and privacy policies.
  • Google Fonts – fonts may be loaded from Google’s servers, which receive your IP address.
  • Facebook and Instagram – our social media links are simple links. Meta receives data only if you click them or message us there.

You can block or delete cookies at any time in your browser settings.

8. Who we share data with

  • Public authorities – the State Police (registration of foreign guests), tax authorities, courts and other authorities when the law requires it.
  • Booking providers – HotelBee, Beds24 and any online travel platform you booked through.
  • Payment providers and banks – to process payments and refunds.
  • Technical providers – our website hosting provider, our web developer Park Studios for website maintenance, and our email service provider. They act only on our instructions.
  • Accountants and advisers – under a duty of confidentiality.

9. International transfers

Some providers, such as booking engines, online travel platforms, Google and Meta, may process data outside Albania, including in the European Union and the United States. Such transfers take place only to countries with an adequate level of protection or with appropriate safeguards such as standard contractual clauses, as required by Law No. 124/2024.

10. How long we keep your data

Data Retention period
Messages and enquiries 1 year after the last contact
Booking and stay records For the period needed for the stay and any claims, and as long as required by law
Guest registration data For the period required by Albanian law
Allergy and special request information Until the end of your stay
Invoices and accounting records 10 years, as required by Albanian accounting law
Security camera footage Up to 30 days, unless needed for a specific incident
Website server logs 6 months

After these periods, data is securely deleted or anonymised.

11. Security

We use appropriate technical and organisational measures to protect your data, including an encrypted connection (HTTPS), restricted access to guest data and regular updates of our website software. If a data breach is likely to put your rights at risk, we will notify the Commissioner within 72 hours and, where the risk is high, inform you without undue delay.

12. Your rights

Under Law No. 124/2024 you have the right to:

  • access your personal data and receive a copy;
  • correct inaccurate or incomplete data;
  • erasure, where we no longer need the data and are not legally required to keep it;
  • restrict processing in certain cases;
  • object to processing based on our legitimate interests;
  • data portability for data you gave us under a contract or consent;
  • withdraw consent at any time, without affecting earlier processing.

To exercise your rights, email info@olympiahotel.al with the subject “Personal data request”. We may ask you to confirm your identity. It is free of charge and we will reply within 30 days.

13. Children

Our website is not directed at children under 16. Children’s data is processed only when they stay with a parent or guardian, and only as required for registration and their stay.

14. Complaints and changes

If you believe your data is processed unlawfully, please contact us first so we can resolve it. You also have the right to lodge a complaint with the Albanian supervisory authority:

  • Commissioner for the Right to Information and Personal Data Protection
  • Address: Rr. “Abdi Toptani”, Nd. 5, Tirana, Albania
  • Website: www.idp.al
  • Email: info@idp.al

We may update this policy when the law or our practices change. The current version is always published on this page with the date of the last update at the top.