Privacy Policy

The data controller is Prontoalb, operating prontoalb.com, based in Albania.

Contact: info@prontoalb.com · +355 69 457 7986

2.1 Data you provide directly:

• Account registration: name, email address, password (hashed).
• Booking information: name, phone number, preferred date/time, service selections, special notes.
• Business application (per-bizneset): business name, business type, city, contact name, phone, email, Google Maps link, message.
• Payments: billing details are processed directly by PayPal. We receive only a transaction reference and status — never your full card number.
• Communications: any messages, support requests, or emails you send us.

2.2 Data we collect automatically:

• Usage data: pages visited, search queries, features used, time and duration of visits.
• Device and log data: IP address, browser type, operating system, referrer URL.
• Cookies and similar technologies: see our Cookie Policy for full details.

2.3 Data from third parties:

• If you connect via a third-party login (e.g. Google), we receive only the data you authorise that service to share (typically name and email).

We use your personal data to:

• Provide the service: create and manage your account, process and confirm bookings, send booking confirmations and reminders.
• Process payments: facilitate transactions between you and Businesses through PayPal.
• Communicate with you: respond to enquiries, send service notifications, and provide customer support.
• Improve the platform: analyse usage patterns to fix bugs, improve features, and personalise your experience.
• Marketing (with consent only): send promotional emails about new features or offers — you can unsubscribe at any time.
• Legal compliance: fulfil our obligations under Albanian law, prevent fraud, and enforce our Terms of Service.

We process your personal data on the following legal bases:

• Contract: processing necessary to fulfil a booking or account agreement with you (Art. 6(1)(b) GDPR-equivalent).
• Legitimate interests: platform security, fraud prevention, and improving our services (Art. 6(1)(f)).
• Consent: marketing communications and non-essential cookies (Art. 6(1)(a)) — withdrawable at any time.
• Legal obligation: compliance with Albanian law, tax, and financial regulations (Art. 6(1)(c)).

We do not sell your personal data. We share it only as follows:

• Businesses you book with: we share your name, phone number, and booking details with the Business you book, solely to fulfil your appointment.
• PayPal: payment data is processed by PayPal Inc. under their own privacy policy.
• Hosting & infrastructure providers: our servers and database are hosted by trusted providers who process data on our behalf under strict data processing agreements.
• Email delivery: transactional emails (confirmations, reminders) are sent via a third-party email service provider.
• Legal authorities: when required by Albanian law, court order, or to protect the rights and safety of users.

All third-party processors are contractually bound to protect your data and use it only as directed by us.

• Account data: retained for the duration of your account plus 2 years after closure.
• Booking records: retained for 5 years for tax, legal, and dispute-resolution purposes.
• Marketing consent: retained until you withdraw consent.
• Log data: retained for up to 12 months.

After these periods, data is securely deleted or anonymised.

Under Albanian data protection law (Law No. 9887/2008 as amended, aligned with GDPR), you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request deletion of your data, subject to our legal retention obligations.
• Restriction: ask us to temporarily stop processing your data in certain circumstances.
• Data portability: receive your data in a machine-readable format.
• Object: object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: at any time, for processing based on consent (e.g. marketing emails), without affecting prior processing.

To exercise any of these rights, email info@prontoalb.com with subject line "Data Rights Request". We will respond within 30 days. You also have the right to lodge a complaint with the Albanian Information and Data Protection Commissioner (idp.al).

We use cookies and similar technologies to operate the platform, remember your preferences, and analyse usage. For full details, see our Cookie Policy. You can manage cookie preferences at any time through your browser settings.

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or destruction. These include:

• HTTPS/TLS encryption for all data in transit.
• Hashed (bcrypt) storage of passwords — we never store plaintext passwords.
• Access controls limiting who within our team can access personal data.
• Regular security reviews of our systems.

No system is 100% secure. If we become aware of a data breach affecting your rights, we will notify you and the relevant supervisory authority as required by law.

Our primary servers are located in the EU/EEA. If any data transfer occurs to a country outside the EEA that does not have an adequacy decision, we ensure appropriate safeguards are in place (such as standard contractual clauses).

Prontoalb is not intended for children under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected such data, please contact us immediately at info@prontoalb.com and we will delete it promptly.

We may update this Privacy Policy periodically. We will update the "Last updated" date and, for material changes, notify registered users by email. Continued use of the platform after changes take effect constitutes acceptance of the revised Policy.

For any privacy-related questions or to exercise your rights:

• Email: info@prontoalb.com
• Phone: +355 69 457 7986
• Hours: Monday – Saturday, 09:00 – 20:00

If you are not satisfied with our response, you may escalate your complaint to the Albanian Information and Data Protection Commissioner at idp.al.