Privacy Policy
1. Who we are and how to reach us
BookingPilot (the "Service") is a hospitality operations platform operated by the BookingPilot project (legal entity registration in progress, Albania), trading as BookingPilot ("we", "us", the "Company"). Our correspondence address is in Tirana, Albania. Questions concerning this notice or our handling of personal data may be directed to privacy@bookingpilot.al.
The bookingpilot.al mailboxes published on these pages are being provisioned and will be active before the Service opens to the public; until then these documents describe the practices the Service will operate under at launch.
In view of our establishment outside the European Economic Area, data subjects located in the EEA may direct requests, questions or complaints to privacy@bookingpilot.al, our point of contact for European data-protection matters. We have not yet appointed a representative in the Union under Article 27 GDPR; before any EEA-based Property is onboarded, such a representative will be appointed and their details published in this section.
This notice describes our practices under Regulation (EU) 2016/679 (the "GDPR"), the United Kingdom GDPR where applicable, and Albanian Law No. 124/2024 on Personal Data Protection, which applies to the processing we perform as a data controller.
2. The two roles we operate in
Processor. In respect of guest data entered by an accommodation provider using the Service (a "Property"), the Property is the data controller and we act strictly as a data processor, handling that data only on the Property's documented instructions under the Data Processing Agreement (/dpa). This includes reservation details, guest contact and identity information, communications, and any payment card details the Property elects to record. Guest data may equally be submitted by the guest directly, where the Property makes use of the online pre-check-in facility described in section 3; in either case the Property remains the controller and we process the submission only on its behalf.
Controller. In respect of data relating to the Service itself, including account registration, billing and the commercial relationship, support correspondence, security telemetry and consent records, we act as the data controller and determine the purposes and means of the processing described below. Each purchase of a paid plan is nonetheless concluded with our online reseller Paddle.com, which acts as Merchant of Record and as an independent controller for the transaction it processes.
3. Categories of personal data we process
The categories of personal data processed through the Service are the following: (a) account and staff data, comprising name, email address, telephone number, password credentials held only as a salted hash, role within a Property and account preferences; (b) guest data entered by a Property or submitted by the guest through the online pre-check-in facility, comprising name, email address, telephone number, postal address, city, country, nationality, date of birth, identity document type and numbers (encrypted at rest), party composition and children's ages, estimated arrival information, stay details, special requests and free-text notes; (c) financial and reservation data, comprising reservation dates, amounts, payment status and history, deposit records and, where a Property elects to record it, payment card details held exclusively in encrypted form as described in our Security notice (/security); (d) operational data, comprising housekeeping and maintenance tasks, staff shifts and roles, lost-and-found records, internal notes, and support tickets and their attachments; (e) communications data, comprising messages exchanged between a Property and its guests through the Service, automation emails and our records of email opt-outs; (f) technical data, comprising authentication session records, device identifiers, approximate city/region-level location and timezone derived from IP address for security monitoring (the IP address itself not being persisted), push-notification subscription endpoints and keys, and diagnostic logs; (g) support data, comprising messages sent to us through the public support chat, including the visitor's name and email address where provided, message content, the page from which the chat began and an anonymous visitor session identifier; and (h) purchase and subscription data, comprising billing contact details, order and invoice references and subscription status exchanged with Paddle.com, our online reseller, which acts as an independent controller for each purchase as described in section 5.
Where personal data has not been obtained from you directly, for example where a Property enters the details of its staff members for the purpose of creating their accounts, the source of the data is that Property, and the categories concerned are those described above. This notice is made available to such individuals within one month of our receipt of the data and at the latest upon our first communication with them.
Online pre-check-in. Where a Property elects to use online pre-check-in, the guest receives a reservation-specific link, ordinarily delivered by email or message at the Property's instruction, through which the guest may submit identity-document, arrival and contact details before arrival. The link identifies only the reservation to which it belongs; it discloses no previously stored personal data beyond the minimum booking context needed to display the form, it ceases to function once the stay has ended or the reservation has been cancelled, and details submitted through it are written to the same reservation and guest records described above, identity document numbers being encrypted at rest in the manner described on our Security page (/security). Resubmission through the same link updates the recorded details. The form itself displays a link to this notice at the point of collection, in accordance with Article 13 GDPR.
4. Purposes and legal bases
We process personal data only where a legal basis under Article 6 GDPR applies. The purposes of the processing and the corresponding legal bases are the following: (a) operating the Service, maintaining accounts and delivering configured features, on the basis of performance of a contract (Article 6(1)(b)); (b) securing the Service, including session monitoring, abuse prevention and sign-in integrity, on the basis of our legitimate interests (Article 6(1)(f)); (c) maintaining and improving the product, including by means of aggregated and anonymised statistics, on the basis of our legitimate interests (Article 6(1)(f)); (d) maintaining suppression lists honouring opt-out requests, on the basis of our legitimate interests (Article 6(1)(f)); (e) performing the transient, rate-limited check whether an email address is already registered, which is not retained beyond the request, on the basis of our legitimate interests (Article 6(1)(f)); (f) keeping accounting and tax records, on the basis of legal obligation (Article 6(1)(c)); (g) administering purchases and subscriptions through our reseller Paddle.com, on the basis of performance of a contract (Article 6(1)(b)) and of legal obligations (Article 6(1)(c)); and (h) sending optional marketing communications, on the basis of consent (Article 6(1)(a)), which may be withdrawn at any time and is recorded with version and date.
We have assessed that the legitimate interests referred to above are not overridden by the rights and freedoms of the individuals concerned. Where we act as processor for a Property, the legal basis for the processing of guest data is determined and documented by that Property as controller.
The provision of the account and staff data described in section 3(a) is a contractual requirement necessary for the creation and operation of an account; failure to provide it prevents registration. The provision of guest and operational data is determined by the Property in accordance with its own legal obligations, and is not a requirement imposed by us.
5. Recipients and sub-processors
We engage a limited number of third-party service providers in the operation of the Service. Each such provider is bound by a data processing agreement or equivalent contractual safeguards, and each receives only the minimum data necessary for the performance of its designated function.
The categories of provider so engaged are the following: (a) database hosting, authentication, file storage and realtime messaging, with processing performed in the European Union (Ireland) and access to all Service data at rest, under a data processing agreement incorporating Standard Contractual Clauses and with the primary processing site located within the European Union; (b) transactional and guest-facing email delivery, with processing in the United States, receiving recipient address, message content and delivery telemetry, under a data processing agreement supported by certification under the EU-US Data Privacy Framework and Standard Contractual Clauses; (c) artificial intelligence inference for the staff assistant and the public support chat, with processing in the United States, receiving prompts and responses submitted through those features, under a data processing agreement incorporating Standard Contractual Clauses, configured for zero data retention and without training on customer data; (d) channel-management synchronisation of availability, rates and bookings with online travel agencies, with processing in the United Kingdom, receiving guest and reservation data for the channels selected by the Controller, under a data protection addendum and on the basis of the United Kingdom adequacy decision; (e) push-notification delivery effected through the service operated by the recipient's browser vendor, which may be located outside the European Economic Area, receiving the push endpoint, cryptographic keys and notification payload, under the browser vendor's own terms, the endpoint being generated by the user's device; and (f) optional third-party sign-in (OAuth), with processing in a location dependent on the provider, transmitting the authentication request and returning basic account attributes such as email address, under the provider's own terms and only at the user's initiative; and (g) content delivery, static-site hosting, automated-traffic screening and IP geolocation for session security, with processing on a global edge network including the United States, receiving visitor IP addresses and browser request data on every page load, of which solely a coarse city-level location derived from the IP address is retained in session records, under a data processing addendum incorporating Standard Contractual Clauses.
The identity of each provider comprised within the categories described above, together with a copy of the safeguards applicable to it, is made available to Controllers upon request addressed to privacy@bookingpilot.al and accompanies the Data Processing Agreement. We notify Controllers at the email address registered on the account before engaging or replacing any provider, and the Controller may object on reasonable data-protection grounds; where we cannot reasonably accommodate a justified objection, the Controller may terminate the account. We do not sell personal data, and we do not disclose it to third parties for their own purposes, save that our online reseller Paddle.com acts as an independent controller in respect of each purchase, receiving the billing and order details necessary to complete the transaction and to meet its own legal obligations; Paddle's own privacy notice governs that processing.
6. International transfers
Where personal data is transferred outside the EEA or the United Kingdom, principally to providers established in the United States, the transfer relies on an adequacy decision (including the EU-US Data Privacy Framework where the recipient is certified) or on Standard Contractual Clauses approved by the European Commission and incorporated into the provider's data processing terms. Transfers to the United Kingdom rely on the United Kingdom adequacy decisions.
7. How long we keep data
We retain personal data only for such periods as are necessary for the purposes described in this notice, after which the data is erased or anonymised. The following retention periods apply, enforced by scheduled automated jobs rather than by manual policy: card security codes (CVC) are erased no later than fourteen days after capture or on the day following checkout, whichever occurs first; full card details are erased ninety days after checkout, the last four digits being retained for reconciliation and dispute purposes; card-reveal verification codes are retained for no more than twenty-four hours, each code additionally expiring after five minutes and being usable once only, with a successful verification authorising card reveals for thirty minutes; the card-access audit trail recording every card reveal, erasure and export is retained for one year, the minimum period required for payment-card security auditing; guest conversation messages are retained for two years, and the Property may delete a conversation at any time, in which case its messages and attachments are erased immediately; erasure of a guest also erases that guest's conversation messages outright, including staff replies within the same threads; automation queue rows for ninety days; activity-log (audit) rows for one hundred and twenty days; staff session records for thirty days of inactivity or seven days following revocation, whichever occurs first; AI assistant conversations for ninety days; the email suppression list recording opt-outs and delivery failures, retained for as long as is necessary to honour the opt-out or to protect delivery integrity, on the basis of legitimate interest; consent records for the duration of the account as immutable accountability evidence; support tickets and attachments, the staff directory and channel-synchronisation data until such time as the Property deletes them or the account is closed; conversations held through the public support chat are retained only for as long as necessary to handle the enquiry and any follow-up, and are erased upon request or when the conversation is deleted; push subscriptions until the permission is withdrawn or the account is closed, stale subscriptions being additionally purged after ninety days; data-subject request records for one year following resolution; marketing campaign delivery records for one year; sign-up verification codes for one day; and guest profiles, reservations and payment records until such time as the Property deletes them or the account is closed. Diagnostic and application logs are retained only for the short operational periods determined by the hosting provider and are not used for profiling or disclosed for secondary purposes. Upon closure of an account a thirty-day deletion window applies, following which the property record and all associated data, including stored files, are deleted, save where a longer period is required by law or by the rotation schedule of encrypted backups.
8. Automated decision-making and the AI assistant
The Service does not make decisions producing legal or similarly significant effects concerning individuals based solely on automated processing within the meaning of Article 22 GDPR. The staff-facing AI assistant is a productivity tool for summaries, drafting and operational questions, and the public support chat answers visitor questions through the same AI sub-processor; no guest-facing outcome is determined by either. Staff are instructed not to enter guest personal data into the assistant, and prompts and responses, whether from staff or from visitors using the support chat, are transmitted to our AI sub-processor under a zero-data-retention configuration, without training on the content. AI conversations are retained for ninety days and thereafter erased.
9. Your rights
You have the right to request access to your personal data; rectification of inaccurate data; erasure; restriction of processing; data portability in a structured, machine-readable format; and to object to processing based on legitimate interests or for direct marketing. Where processing is based on consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal; withdrawal may be effected by means of the unsubscribe facility contained in our communications, through the request form below or, once our mailboxes are live, by writing to privacy@bookingpilot.al.
We respond to verified requests within one month, extendable where permitted by law for complex or numerous requests. In respect of guest data, the Property that holds your reservation should be contacted in the first instance, it being the controller, and it can export or erase a guest record directly within the Service. In respect of your own account data, you may use the request form below or write to privacy@bookingpilot.al.
You may lodge a complaint with the Information and Data Protection Commissioner of Albania (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale) or, if you are located in the EEA or the United Kingdom, with the supervisory authority of your place of residence or work.
10. Children
The Service is a business-to-business tool and is not directed at children. Guest records may lawfully include minors' details (such as party composition or children's ages) entered by a Property for a booking; that data is provided under the Property's own legal basis and privacy notice, and we process it only as that Property's processor.
11. Security
We apply the technical and organisational measures summarised on our Security and Data Practices page (/security), which forms part of our Data Processing Agreement. In summary, row-level security isolates each Property's data; stored card and identity-document data is encrypted with vault-held keys; card reveal is gated behind a one-time verification code and is audit-logged; and retention and deletion are enforced by scheduled jobs.
12. Breach notification
If a personal data breach occurs, we will notify affected Properties acting as controllers without undue delay so that they can meet their own notification obligations, and where we act as controller we will inform affected individuals and the competent authority where required by law.
13. Changes to this notice and contact
We may update this notice from time to time; the current version is always posted here and identified by version v2026-10, last updated October 2026. Should we intend to process personal data for a purpose other than that for which it was collected, we will provide you, prior to that further processing, with information on that other purpose and with any relevant further information required by law. Privacy questions, requests and complaints may be addressed to privacy@bookingpilot.al. General support matters may be addressed to support@bookingpilot.al.