This notice explains which personal data the website viaggiaconsorriso.it collects, for what purposes, for how long it is kept and which rights you can exercise. It covers only the use of the website, its forms and its reserved areas. It does not describe the activities the website presents, which are governed by separate agreements.
Who is the data controller?
The data controller is Viaggia Con Sorriso, based in Tirana, Albania. For any question about your data you can call +39 06 9763 9463 or write to ciao [@] viaggiaconsorriso [.] it, replacing the brackets with the corresponding symbols. Data is processed in accordance with Law No. 124/2024 "On Personal Data Protection" of the Republic of Albania and the other applicable Albanian rules. The supervisory authority is the Commissioner for the Right to Information and Personal Data Protection, based in Tirana.
Which data does the website collect?
Browsing data. When you visit the website, the systems that host it automatically record some technical information: IP address, browser and device type, pages visited, date and time of the visit and the referring page. This data keeps the website running, protects it from abuse and produces statistics in aggregate form.
Data sent through the forms. When you fill in a contact or consultation request form, we collect the data you enter: first and last name, telephone number, email address, preferred language, the text of your message and any files you choose to attach. If your message describes your health or you attach diagnostic images, you are sharing special categories of data. We process them only to answer your request, on the basis of your explicit consent, which you can withdraw at any time.
Reserved area data. If you create an account, we keep your login credentials, the profile details you complete and the history of what you do in the reserved area, for example the documents you upload and the messages you send or receive.
Social network forms. If you fill in a contact form we publish on Facebook or Instagram, Meta sends us the data you entered in that form. From that moment on we process it under this notice.
Cookies and similar tools. The information collected through cookies is described in the Cookie Policy, which complements this notice.
For which purposes and on which legal basis do we process data?
To answer your requests and get back to you in the way you chose, by phone, email or WhatsApp. The legal basis is carrying out what you ask us to do before any agreement and, for health related data, your explicit consent.
To manage your account and the functions of the reserved area. The legal basis is the performance of the relationship created by your registration.
To keep the website secure, prevent abuse, fraud and unauthorised access, and keep technical logs. The legal basis is our legitimate interest in protecting the website and the people who use it.
To measure how the website is used and how effective our campaigns are, with statistics and marketing tools. The legal basis is the consent you give through the cookie banner, which you can withdraw at any time.
To comply with legal obligations, for example keeping proof of consent or answering requests from Albanian authorities. The legal basis is the legal obligation.
We do not use your data for automated decisions that produce legal effects on you and we never sell it to anyone.
Who can access the data?
Data is handled by the authorised staff of Viaggia Con Sorriso, who are trained in confidentiality. We also rely on technical providers that act on our behalf and under our instructions: the hosting service of the website, email services, messaging systems, statistics tools and the advertising platforms from which we receive the forms filled in on social networks. Some of these providers may be located outside Albania. In that case the transfer takes place under the conditions set by Law No. 124/2024, that is to countries that ensure an adequate level of protection or with appropriate safeguards. Data may also be disclosed to the competent authorities when the law requires it.
For how long do we keep the data?
Requests sent through the forms and data received from social networks are kept for twenty four months from the last contact, unless a relationship that requires longer retention arises in the meantime. Technical security logs are kept for twelve months. Account data stays for as long as the account is active and for twelve months after it is closed. The record of your cookie consent is kept for twelve months. Where an Albanian rule sets different terms, for example in accounting or tax matters, we follow those terms.
What are your rights?
Law No. 124/2024 gives you the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a machine readable format, to object to processing based on legitimate interest and to withdraw your consent at any time, without affecting the lawfulness of the processing already carried out. To exercise these rights write to ciao [@] viaggiaconsorriso [.] it or call +39 06 9763 9463. We reply within the time limits set by law. If you believe the processing breaches the rules, you can lodge a complaint with the Commissioner for the Right to Information and Personal Data Protection of the Republic of Albania, Tirana, website idp.al.
How do we protect the data?
The website is served over an encrypted HTTPS connection. Account passwords are stored in encrypted form and cannot be read even by us. Access to data is limited to the people who need it for their work, systems are kept updated and monitored, and regular backups are made. No system is absolutely secure: in the event of a breach that poses a risk to your rights, we will inform you and the supervisory authority as required by law.
Is the website intended for minors?
The website is not intended for people under eighteen years of age and we do not knowingly collect data from minors. If you believe a minor has sent us personal data, contact us and we will delete it.
Changes to this notice
We may update this notice to reflect changes in the law or in the website. The version published on this page is the one in force. Last updated: 10 September 2026.