Privacy Policy

How we process your personal data under the GDPR.

1. Controller

ATHS Sh.p.k, Rruga e Durrësit, Pallati 102, 1000 Tirana, Albania.
Email: [email protected] · Phone: +355 42 233 997

2. What data we process

Booking data: name, email, phone, pick-up and drop-off address, flight number/airline, date/time, number of passengers.
Payment data: payments are processed via the 3-D Secure service of Banka Kombëtare Tregtare (BKT). We never see or store your full card details.
Usage data: IP address, browser, access times and similar technical data (server logs).

3. Cookies

Necessary cookies: session (laravel_session), CSRF protection (XSRF-TOKEN) and your language choice (pref_lang, 1 year). Legal basis: legitimate interest / performance of a contract.
Analytics & marketing: Google Analytics and Google Ads (see section 4). Legal basis: your consent (Art. 6(1)(a) GDPR).

4. Google services

We use Google Analytics and Google Ads (Google Ireland Ltd.) for audience measurement and advertising. Usage data is processed and may be transmitted to Google. You can opt out of Google Analytics via this browser add-on. More: policies.google.com/privacy.

5. Maps

We use OpenStreetMap (Leaflet) to display maps. Your IP address is transmitted to the OpenStreetMap Foundation.

6. Processors

We use service providers to deliver our services, including plazh.com (booking and data processing within the ATHS group), BKT (payment) and Google. They process data only on our instructions.

7. Transfers outside the EEA

As a company based in Albania, processing may take place outside the EEA. We ensure an adequate level of protection through appropriate safeguards (e.g. standard contractual clauses).

8. Retention

We keep booking and invoice data for as long as required by statutory retention obligations; otherwise we delete data once the purpose no longer applies.

9. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent. You may also lodge a complaint with a data protection authority. Send requests to [email protected].