Privacy Policy

What we collect

When you book or sign up we collect the details needed to run your trip: name, email, phone number, party size, and trip/booking details. For transfers this also includes pick-up and drop-off points, date and time, passengers and luggage, and your flight number if you give it.

WhatsApp messages

If you give a phone number and leave “Send me updates on WhatsApp” ticked, we send messages about that booking only — request received, confirmation, changes, driver on the way, completion or cancellation — through the WhatsApp Business Platform operated by Meta Platforms. These messages contain your name, booking reference, route, date, time and price. Replies you send us on WhatsApp are stored with your booking so we can answer you.

We never send marketing or promotional messages on WhatsApp. To stop the messages, untick the box when booking, or reply “STOP” or ask us on WhatsApp at any time. WhatsApp’s own handling of messages is described in WhatsApp’s privacy policy.

Photos & trip material

We do not use any guest’s pictures in public channels without written permission.

Trip material (photos/videos) is shared only in private and member channels, with the consent of the user.

Privacy within the group

Guests are required to respect the privacy of other guests in the group; any conflicts are handled according to the local laws of the country where the trip operates.

Consent

Signing up requires explicit consent to the clauses above; your consent is recorded with your account. Guests who book without an account give the same consent on the booking form, and the grant is recorded with the booking. Accounts created before this policy was introduced are asked to re-confirm consent at their next login or booking.

Data protection

Processing of personal data follows the data-protection law applicable to you and to the country where the trip operates.

Who controls your data

BZNomad is the data controller for the information described in this policy. Controller details: BZNomad sh.p.k., Rruga "Plazh", apartment Nr. 51, Lagjia Nr. 13 Plazh, Durrës, Albania (NIPT M32101503M). Contact: privacy@bznomad.com or WhatsApp +355 68 497 5392.

Why we process your data (legal basis)

We process your data on the following legal bases: to perform the contract you enter when you book (booking, confirmation, scheduling, payment and refunds); with your consent where consent is required (photo use, marketing, optional communications — consent can be withdrawn at any time); and for our legitimate interests (keeping the site secure, preventing fraud, and improving our services).

Who we share data with (processors)

We use a small number of service providers to operate the site and deliver trips, including: WhatsApp (WhatsApp Business Platform by Meta Platforms) for booking notifications, trip communication and support; Google Maps and Leaflet for map and location display; Cloudflare for hosting and content delivery; and payment providers for processing payments when you pay online. Each provider receives only the data needed for its task. We do not sell your data, and we do not use third-party analytics or advertising trackers on this site.

Cookies & similar technologies

This site uses two preference cookies: one remembers your selected currency and one remembers your selected language. They are set only when you choose those preferences and are not used for tracking or advertising. We also use your browser’s local storage for preferences such as the colour theme. You can clear or block cookies and local storage in your browser settings at any time; the site will still work, and you may need to re-select your preferences.

How long we keep data

Booking records are kept as long as needed to operate the trip and to meet legal, tax and accounting obligations (generally the period required by applicable law). Account data is kept while your account is active and for a reasonable period after you close it. You can ask us to delete your data at any time (see Your rights below).

International transfers

BZNomad is based in Albania (Law No. 9887/2008 on the Protection of Personal Data applies). Where we or our providers transfer data outside Albania or the EEA, we rely on appropriate safeguards, such as standard contractual clauses, to keep your data protected.

Your rights

You have the right to access the data we hold about you, to ask for it to be corrected or deleted, to restrict or object to processing, to receive your data in a portable form, and to withdraw any consent you have given. To exercise any of these rights, contact us at privacy@bznomad.com or WhatsApp +355 68 497 5392. We will respond within the period required by law.

Right to complain

If you believe your data has been handled improperly, you may lodge a complaint with the Albanian Commissioner for the Right to Information and Protection of Personal Data (IDP), or with the data-protection authority where you live if you are in the EU or UK.

Security

We protect your data with appropriate technical and organisational measures, including encrypted connections (HTTPS) to the site, access controls, and restricting staff access to the minimum needed for their role.

Community profile and posts

If you join the BZNomad community we keep the username, name, photo, bio, home base, languages and links you choose to show; what you post (text, photos, place tags, comments, likes and reactions), who you follow, and who you block or mute; and a yes/no that you confirmed you are 16 or older and how (you confirmed it, or Facebook’s age range said so). We do not keep your year of birth.

Your profile, posts, comments and likes are public: anyone can see them, also without an account, and they can be shared as links. Who you block or mute, and any reports you send, are private.

We re-save every photo you upload. This removes hidden data such as GPS location, camera model and serial number before anyone else can see the photo.

We repost a community post on BZNomad’s Facebook, Instagram or Threads pages only if you ticked “BZNomad may share this on its Facebook and Instagram pages” on that post. You can untick it or delete the post at any time; we then remove the copies we posted.

Signing in with Facebook

If you use “Continue with Facebook”, Facebook sends us your name, email address and a Facebook account ID. If you agree to it in the Facebook dialog, Facebook can also send your profile link, your age range, your profile photo, and the list of your Facebook friends who also use BZNomad and agreed to share it. We do not get your password, your posts or your full friends list, and we never post on Facebook for you.

We use this to sign you in, show your Facebook link if you choose to, confirm your age, and show you which of your Facebook friends are here. It is based on your consent, which you can withdraw at any time.

You can disconnect Facebook under Community → Settings, or remove BZNomad in your Facebook settings (Settings & privacy → Apps and websites) and ask for your data to be deleted. We then delete everything we received from Facebook (your Facebook link, friends list, age flag and photo) and give you a confirmation code; its status is shown at bznomad.com/legal/facebook-deletion.

Groups, meetups and messages to our pages

Which groups you joined and which meetups you said you are going to are shown on the group or meetup page to everyone. Meetup tickets are bookings with BZNomad; we keep the payment record like any other booking.

If you message BZNomad on Messenger or Instagram, or comment on our Facebook or Instagram posts, Meta sends us the message or comment, your name or username, and an ID Meta assigns for our page. We use it only to answer you and to moderate comments, and keep it up to 24 months.

Direct messages and moments

Messages you send to another member are private between the two of you. We store them so you can both read them. Deleting a chat removes it from your side only; “Unsend” removes a message for both of you. You choose who may start a conversation with you (everyone, only people you follow, or no one), and a first message from someone you don’t follow waits as a request until you accept it or reply.

We do not read your messages. A moderator sees a conversation only when one of you reports a message, or when our word filter holds a message for review — and then only that message and the ten before it. This is based on our legitimate interest in a safe community and our legal duty to act on unlawful content we are told about.

Moments are photos shown in the bar at the top of the community feed for 24 hours, and their author can see who viewed them. We delete a moment’s photo two days after it disappears, or straight away if you delete it, unless it was reported, in which case we keep it until a moderator has reviewed it. A reply to a moment is a direct message.

Messages are kept until either of you deletes your account. Reported messages and moments are kept up to 12 months for moderation records.

Community safety and moderation

To keep the community safe we review reports, filter certain words, limit how often accounts can post, and can hide content or suspend accounts that break the rules; we keep a record of these decisions. This is based on our legitimate interest in a safe community and our legal duty to act on unlawful content we are told about.

Posts and comments stay until you delete them or your account; deleting a post deletes its photos from our servers at once. Removed content and reports are kept up to 12 months for moderation records, then deleted. Facebook data is kept while your Facebook account is connected.

Children

The BZNomad community is for people aged 16 and over. We ask everyone who joins to confirm their age, and refuse people who say they are younger or whom Facebook shows as younger. If we learn a member is under 16 we delete their community profile and content. Anyone can report a concern about a child’s safety from any post, profile, message or moment; such reports hide the content at once until we have reviewed it.

This site and its trips are not directed at children under 16. Age and eligibility requirements for trips are stated on each experience page, and bookings involving minors are made by an adult.