Effective date: [DD/MM/YYYY]

Last updated: [DD/MM/YYYY]

1. Who we are

Tirana International Airport is the controller of your personal data.

Controller details:

• Legal name: Tirana International Airport Sh.p.k.
• NUIS/NIPT: K51612012D
• Address: Administrata e Aeroportit, Rruga e Rinasit, Tirana Business Park, Ndertesa 07, Vore, Tirane 1039
• Email: [email protected]
• Phone: 003550697087555
• Website: www.tirana-airport.com

If applicable, our Data Protection Officer / privacy contact is:

[TBD]

Albanian Law No. 124/2024 applies to controllers and processors established in Albania and may also apply to foreign controllers/processors offering goods or services to individuals in Albania or monitoring their behavior in Albania.

2. Personal data we collect

We may collect and process the following categories of personal data:

• Identity data: name, surname, date of birth, ID number, company role.
• Contact data: email address, phone number, postal address.
• Transaction data: invoices, payments.
• Technical data: IP address, device information, browser type, cookies, log data.
• Communication data: messages, support requests, feedback.
• Marketing data: newsletter preferences, consent records.
• Special categories of data: flight details, PNR.

Personal data is processed lawfully, fairly and transparently, and only where there is a valid legal ground for processing.

3. Why we process your data and legal basis

We process your personal data for the following purposes:

• To provide our products or services
• Legal Basis: Performance of a contract
• To process payments and invoices
• Legal Basis: Performance of a contract / Legal obligation
• To respond to your requests
• Legal Basis: Legitimate interest / Performance of a contract
• To send service communications
• Legal Basis: Legitimate interest
• To send marketing communications
• Legal Basis: Consent or legitimate interest (where permitted)
• To improve our website/app and services
• Legal Basis: Legitimate interest
• To comply with legal, tax, and accounting obligations
• Legal Basis: Legal obligation
• To protect our systems, prevent fraud, and ensure security
• Legal Basis: Legitimate interest / Legal obligation

Regulatory Compliance Note: Law No. 124/2024 recognizes standard GDPR legal grounds, which include consent, contract necessity, legal obligation, vital interests, public interest/official authority, and legitimate interests.

Law No. 124/2024 recognizes GDPR legal grounds such as consent, contract necessity, legal obligation, vital interests, public interest/official authority, and legitimate interests.

4. Consent

Where processing is based on consent, you may withdraw your consent at any time by contacting us at [email protected] or by using the unsubscribe/settings options provided.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Under Law No. 124/2024, consent must be freely given, informed and unambiguous, and the controller must be able to demonstrate that valid consent was obtained.

5. Cookies and similar technologies

Our website may use cookies and similar technologies to:

• enable core website functionality;
• remember user preferences;
• analyze website usage;
• personalize content;
• support marketing or advertising, where applicable.

You can manage cookie preferences through [cookie banner/settings link] or your browser settings.

If we use non-essential cookies, analytics cookies or advertising cookies, we will request your consent where required.

6. Who do we share your data with

We may share your personal data with:

• IT and hosting providers;
• payment processors and banks;
• accountants, auditors and legal advisers;
• marketing and analytics providers;
• public authorities, courts or regulators where required by law;
• business partners, only where necessary for the service requested.

Where we use processors, we require them to process personal data only on our instructions and to apply appropriate security and confidentiality measures.

Controllers and processors under Law No. 124/2024 must implement appropriate technical and organizational measures and keep records where required.

7. International data transfers

If we transfer personal data outside Albania, we will ensure that appropriate safeguards are in place, such as adequacy decisions, standard contractual clauses, binding corporate rules, or other legally recognized transfer mechanisms.

Law No. 124/2024 includes rules for international data transfers and gives the Commissioner powers relating to standard contractual clauses and transfer mechanisms.

8. How long we keep your data

We keep personal data only for as long as necessary for the purposes for which it was

collected, including satisfying legal, accounting, tax, contractual or reporting

requirements.

Retention periods:

• Identity Data
• For HR purposes: 5 years
• For all other reasons: 3 months for compliance purposes
• Invoices & Tax Records
• Retained in accordance with Albanian tax and accounting law
• Marketing Consent Records
• Until withdrawal + 3 months for compliance purposes
• Support Communications
• 5 years
• Website Logs
• 3 months for compliance purposes

The principle of storage limitation requires that personal data should not be kept longer than necessary for the relevant purpose.

9. Your rights

Subject to legal conditions and limitations, you may have the right to:

• be informed about how your data is processed;
• access your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of your data;
• request restriction of processing;
• object to processing;
• object to direct marketing;
• withdraw consent at any time;
• lodge a complaint with the Commissioner.

Law No. 124/2024 strengthens data subject rights and follows GDPR protection for

individuals.

To exercise your rights, contact us at:

[email protected]

We may need to verify your identity before responding.

10. Data security

We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration or disclosure.

These measures may include:

• access controls;
• encryption;
• secure backups;
• staff confidentiality obligations;
• logging and monitoring;
• data minimization;
• regular security reviews.

Law No. 124/2024 requires controllers and processors to apply appropriate technical and organizational measures and accountability-based compliance.

11. Data breaches

If a personal data breach occurs, we will assess the risk and, where required, notify the Commissioner within the applicable legal deadline and inform affected individuals where required.

Legal commentary on Law No. 124/2024 states that qualifying personal data breaches must be notified to the Commissioner within 72 hours.

12. Children’s data

Our services are not intended for children under 16 years old. We do not knowingly collect personal data from children without appropriate parental or legal guardian consent where required.

For services relying on consent from minors, Albanian commentary indicates that parental/legal guardian approval is required for children under 16.

13. Complaints

If you believe your personal data has been processed unlawfully, you may contact us first at:

[email protected]

You may also lodge a complaint with the Albanian Commissioner for the Right to Information and Protection of Personal Data.

The Commissioner is the independent authority responsible for monitoring and enforcing Albania’s data protection legislation.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The latest version will always be available at:

https://www.tirana-airport.com/en/article/1182/Privacy-Policy

Material changes may be notified by email or website notice where appropriate.