Privacy Policy

What we collect

When you book or sign up we collect the details needed to run your trip: name, email, phone number, party size, and trip/booking details.

Photos & trip material

We do not use any guest’s pictures in public channels without written permission.

Trip material (photos/videos) is shared only in private and member channels, with the consent of the user.

Privacy within the group

Guests are required to respect the privacy of other guests in the group; any conflicts are handled according to the local laws of the country where the trip operates.

Consent

Signing up requires explicit consent to the clauses above; your consent is recorded with your account. Guests who book without an account give the same consent on the booking form, and the grant is recorded with the booking. Accounts created before this policy was introduced are asked to re-confirm consent at their next login or booking.

Data protection

Processing of personal data follows the data-protection law applicable to you and to the country where the trip operates.

Who controls your data

BZNomad is the data controller for the information described in this policy. Controller details: BZNomad sh.p.k., Rruga "Plazh", apartment Nr. 51, Lagjia Nr. 13 Plazh, Durrës, Albania (NIPT M32101503M). Contact: privacy@bznomad.com or WhatsApp +355 68 497 5392.

Why we process your data (legal basis)

We process your data on the following legal bases: to perform the contract you enter when you book (booking, confirmation, scheduling, payment and refunds); with your consent where consent is required (photo use, marketing, optional communications — consent can be withdrawn at any time); and for our legitimate interests (keeping the site secure, preventing fraud, and improving our services).

Who we share data with (processors)

We use a small number of service providers to operate the site and deliver trips, including: WhatsApp for trip communication and support; Google Maps and Leaflet for map and location display; Cloudflare for hosting and content delivery; and payment providers for processing payments when you pay online. Each provider receives only the data needed for its task. We do not sell your data, and we do not use third-party analytics or advertising trackers on this site.

Cookies & similar technologies

This site uses two preference cookies: one remembers your selected currency and one remembers your selected language. They are set only when you choose those preferences and are not used for tracking or advertising. We also use your browser’s local storage for preferences such as the colour theme and your Dreampass membership state. You can clear or block cookies and local storage in your browser settings at any time; the site will still work, and you may need to re-select your preferences.

How long we keep data

Booking records are kept as long as needed to operate the trip and to meet legal, tax and accounting obligations (generally the period required by applicable law). Account data is kept while your account is active and for a reasonable period after you close it. You can ask us to delete your data at any time (see Your rights below).

International transfers

BZNomad is based in Albania (Law No. 9887/2008 on the Protection of Personal Data applies). Where we or our providers transfer data outside Albania or the EEA, we rely on appropriate safeguards, such as standard contractual clauses, to keep your data protected.

Your rights

You have the right to access the data we hold about you, to ask for it to be corrected or deleted, to restrict or object to processing, to receive your data in a portable form, and to withdraw any consent you have given. To exercise any of these rights, contact us at [privacy contact email] or WhatsApp +355 68 497 5392. We will respond within the period required by law.

Right to complain

If you believe your data has been handled improperly, you may lodge a complaint with the Albanian Commissioner for the Right to Information and Protection of Personal Data (IDP), or with the data-protection authority where you live if you are in the EU or UK.

Security

We protect your data with appropriate technical and organisational measures, including encrypted connections (HTTPS) to the site, access controls, and restricting staff access to the minimum needed for their role.

Children

This site and its trips are not directed at children under 16. Age and eligibility requirements for trips are stated on each experience page, and bookings involving minors are made by an adult.