Last updated: September 26, 2026
This Privacy Policy explains how personal data is collected, used, disclosed and protected when you visit or interact with Wonderful Albania at wonderfulalbania.com. It is intended to provide the information required by applicable data-protection rules, including Articles 12–14 of the EU General Data Protection Regulation (GDPR) where the GDPR applies. It should be read together with our Cookie Policy.
1. Data controller and contact details
The data controller for this website is the person or entity operating Wonderful Albania. Privacy enquiries and requests may be sent to wonderfulalbania.com@gmail.com. If additional formal controller details are required by the law applicable to a particular processing activity, they will be provided upon a valid request. No Data Protection Officer is identified on this website unless one is expressly appointed and published.
For the purposes of this Policy, “we”, “us” and “our” refer to Wonderful Albania as website operator; “you” and “user” refer to visitors, readers, subscribers, commenters and people who contact the site.
2. Scope of this Privacy Policy
This Policy applies to personal data processed through this website, including ordinary browsing, server logs, comments where enabled, contact or form submissions where enabled, subscriptions, security and anti-spam services, website statistics, affiliate links and third-party widgets. It does not govern the independent processing carried out by third-party websites after you leave Wonderful Albania or when a third party acts as a separate data controller.
3. Categories of personal data we may process
- Technical and connection data: IP address, approximate country or region derived from the connection, date and time of access, requested URL, referring URL, browser and operating-system information, device characteristics, language, protocol data, error logs and security events.
- Usage data: page and post views, outbound-link interactions, referrers, search terms, performance information and aggregated audience statistics where the relevant feature is enabled.
- Contact data: name, email address and any information you include in an email, contact form or other message.
- Comment data: information entered in a comment form, comment content, IP address, user agent and related anti-spam information where comments are enabled.
- Subscription data: email address, subscription status and related technical records where a subscription feature is used.
- Consent and preference data: cookie or tracking choices and the technical information needed to record or respect those choices where a consent mechanism is used.
- Affiliate and third-party interaction data: referral identifiers or interaction information that may be generated when you click an affiliate link or interact with a third-party widget. The third party may act as an independent controller for its own processing.
4. Sources of personal data
We obtain data directly from you when you contact us, comment or subscribe; automatically from your browser, device and server connection when you visit the site; and from service providers that support the operation, security, statistics or communication functions of the site. We do not intentionally purchase lists of personal data for direct marketing through this website.
5. Purposes, legal bases and main categories of data
Where the GDPR applies, we rely on one or more of the legal bases described below. The applicable basis depends on the specific processing activity.
| Purpose | Typical data | Legal basis where GDPR applies |
|---|---|---|
| Deliver pages and core website functions | Technical, connection and limited device data | Art. 6(1)(f) GDPR — legitimate interest in operating a secure, functional website; where strictly necessary to provide a service requested by the user, processing may also be necessary to take steps at the user’s request. |
| Security, abuse prevention and troubleshooting | IP address, logs, user agent, security events | Art. 6(1)(f) GDPR — legitimate interest in protecting the website, users and infrastructure from abuse, attacks, fraud and technical failures. |
| Respond to enquiries | Name, email address, message content | Art. 6(1)(f) GDPR for ordinary correspondence; Art. 6(1)(b) GDPR when the communication concerns steps requested before a contract; Art. 6(1)(c) GDPR where retention or disclosure is legally required. |
| Comments and anti-spam, where enabled | Comment, contact details, IP address, user agent, anti-spam signals | Art. 6(1)(f) GDPR — legitimate interest in enabling discussion and preventing spam or abuse; consent where a separate optional feature legally requires it. |
| Subscriptions requested by the user | Email address, subscription status and technical delivery records | Art. 6(1)(a) GDPR where consent is the appropriate basis, or Art. 6(1)(b) GDPR where the user expressly requests the subscription service. |
| Audience measurement and site improvement | Usage, referrer, device and performance data | Art. 6(1)(f) GDPR only where the configuration and applicable law permit legitimate-interest measurement without consent; otherwise Art. 6(1)(a) GDPR and prior consent. |
| Optional third-party widgets or non-essential tracking | Cookie identifiers, interaction and referral data | Art. 6(1)(a) GDPR where consent is required. Such technologies should not be activated before valid consent where the law requires prior consent. |
| Compliance with law and legal claims | Relevant account, message, log or transaction-related records | Art. 6(1)(c) GDPR for legal obligations and Art. 6(1)(f) GDPR for establishing, exercising or defending legal claims where appropriate. |
6. Legitimate interests
Where we rely on legitimate interests, those interests may include maintaining and improving a secure website, preventing fraud, spam and abuse, diagnosing technical problems, understanding aggregate readership, responding to ordinary correspondence, protecting our rights and maintaining editorial and business operations. We consider the nature of the data, the reasonable expectations of users and the impact on individuals. You may have the right to object to processing based on legitimate interests, as explained below.
7. Website hosting, server logs and technical operation
Like most websites, the hosting environment and web server may automatically create logs when a page or resource is requested. Logs may include IP address, date and time, requested resource, response code, referrer, browser information and diagnostic data. These records are used to deliver the site, maintain availability, investigate errors, detect malicious activity and protect the infrastructure. Log retention is determined by operational necessity, security needs and the hosting provider’s configuration, and records are deleted, anonymised or rotated when no longer required for those purposes unless a longer period is necessary for a specific security incident or legal obligation.
8. WordPress
Wonderful Albania is built with WordPress. WordPress may process technical data and may use cookies for administrators, logged-in users and certain interactive functions such as comments. Ordinary visitors who do not log in or use those functions may not receive the same WordPress cookies. Further details about cookie categories are provided in the Cookie Policy.
9. Jetpack and Automattic services
The database supplied for this website indicates the use of Jetpack features, including site statistics, subscriptions and security/protection functions. Jetpack is operated by Automattic and may receive technical and usage information necessary to provide enabled features. Depending on the feature, this may include IP address, user agent, visiting and referring URLs, timestamps, browser language, country information, WordPress.com account information for logged-in WordPress.com users, subscription data and security-related data.
For Jetpack Stats, Automattic states that visitor logs containing identifiable information such as IP addresses and WordPress.com usernames, where available, are retained for 28 days for the purpose of powering the statistics feature. The site owner generally receives aggregate statistics rather than those identifiable visitor logs. Other Jetpack features can have different data flows and retention periods according to the feature and Automattic’s then-current documentation.
10. Akismet anti-spam
Akismet may be used to identify spam or abusive submissions. When comments or supported forms are processed through Akismet, information associated with the submission may be sent to Automattic for anti-spam analysis. Depending on the context, this can include the commenter’s IP address, user agent, referrer, site URL and information entered into the comment or form. This processing is used to protect the site and its users from spam and abuse.
11. Contact messages and forms
If you contact us by email or through a form, we process the information you provide to read, route and answer the request, keep an appropriate record of the conversation and protect against abuse. Please do not send special-category data, identity documents, financial credentials or other sensitive information unless it is genuinely necessary and an appropriate secure channel has been agreed.
Correspondence is retained for the period reasonably necessary to handle the request and any follow-up, and longer only where required for legal, accounting, dispute-resolution, security or evidentiary purposes. Routine messages that no longer have an operational or legal purpose may be deleted.
12. Comments
If comments are enabled, the information entered in the comment form and relevant technical data may be processed to publish and moderate the comment, detect spam, maintain the conversation and protect the site. Published comments may remain visible for as long as the related content remains online, unless deletion is appropriate or required. Moderation and anti-spam records may be retained for as long as needed to prevent repeat abuse or address disputes.
13. Subscriptions and email notifications
If you voluntarily subscribe to site updates, the email address and subscription status may be processed to deliver the requested notifications and manage opt-in or opt-out choices. You can unsubscribe using the mechanism provided in the communication or by contacting us. Withdrawal of consent does not affect processing that was lawful before withdrawal.
14. Analytics and audience measurement
Website statistics help us understand which content is useful, how visitors reach the site and whether pages perform correctly. The database supplied for Wonderful Albania indicates Jetpack Stats. The exact processing depends on the active settings and provider configuration. Where applicable law requires consent for a measurement technology or identifier, that technology should be activated only after consent. Aggregate statistics may be retained for trend analysis even after underlying identifiable logs have been deleted or anonymised.
15. Affiliate links and commercial partners
Wonderful Albania may use affiliate links and travel widgets, including services such as Booking.com and GetYourGuide. We may receive a commission if a user follows an affiliate link and completes a qualifying transaction. An ordinary outbound link does not necessarily cause the partner to place a cookie on Wonderful Albania; however, after you visit a partner website, the partner may process referral data, set its own cookies or use other technologies to attribute a booking and provide its service.
If a third-party widget is embedded directly in a page, the provider may receive technical information when the widget loads or when you interact with it. Where loading the widget would involve non-essential cookies or tracking that requires prior consent, it should be blocked until the relevant consent has been given. The partner’s own privacy notice governs its independent processing.
16. Embedded content and external websites
Articles may contain embedded maps, videos, booking tools, social or other third-party content. Embedded content can behave as if the visitor had accessed the third party directly. The third party may receive IP address, browser and device data, set or read cookies, associate the interaction with an existing account, or measure engagement. Optional embeds that involve non-essential tracking should be subject to consent where required. External websites have their own privacy practices and are not controlled by Wonderful Albania.
17. Cookies and similar technologies
We use or may use cookies, local storage and comparable technologies for strictly necessary functions, security, preferences, analytics, consent management and third-party features. The applicable categories, purposes, typical durations, third parties and user controls are described in the Cookie Policy.
18. Recipients and categories of processors
Personal data may be made available only where necessary to categories of recipients such as hosting and infrastructure providers, website and security providers, anti-spam providers, email or subscription providers, analytics providers, consent-management providers if implemented, technical consultants, professional advisers, and competent public authorities where disclosure is required by law. Service providers that process data on our behalf should process it under appropriate contractual and confidentiality obligations. Some third parties, particularly travel partners and external platforms, may act as independent controllers rather than processors.
19. International data transfers
Some providers may process personal data outside the European Economic Area. Where the GDPR applies, transfers to a third country should rely on a lawful transfer mechanism, such as a European Commission adequacy decision, Standard Contractual Clauses together with any necessary supplementary measures, or another mechanism permitted by Chapter V of the GDPR. A provider’s applicable privacy documentation may contain more detailed information about its transfer arrangements. You may contact us to request information about the safeguards relevant to processing under our control.
20. Retention criteria
We do not keep personal data indefinitely merely because storage is technically possible. Retention is determined by the purpose, the amount and sensitivity of the data, security and fraud-prevention needs, applicable limitation periods, legal or accounting duties and whether a dispute is reasonably anticipated.
| Data/activity | Retention approach |
|---|---|
| Server and security logs | Kept for the period configured for operations and security, then rotated, deleted or anonymised unless needed for an incident or legal claim. |
| Jetpack Stats identifiable visitor logs | Automattic states that identifiable Stats logs are retained for 28 days; aggregate statistics may remain available longer. |
| Contact correspondence | Kept while the request is active and for a reasonable follow-up or recordkeeping period; longer where needed for a legal obligation or claim. |
| Comments | May remain while the comment and related article are published; moderation or anti-spam records may be retained as needed to prevent abuse. |
| Subscriptions | Kept until unsubscribe or termination of the subscription, subject to limited suppression or proof-of-choice records where appropriate. |
| Consent records | Kept for as long as reasonably necessary to demonstrate and respect the user’s choice and to comply with accountability obligations. |
| Third-party services | Retention is determined by the independent provider for data it controls, subject to its privacy notice and applicable law. |
21. Whether providing personal data is mandatory
You can generally browse the public editorial content without directly providing your name or email address. Information requested in a contact form, comment form or subscription field is normally optional unless marked as required to provide the requested function. If a required field is not provided, we may be unable to send a subscription, publish a comment or respond effectively to a request. You are not required to consent to non-essential tracking in order to access ordinary public content, except where a lawful equivalent-access model is expressly permitted by applicable law.
22. Your rights under the GDPR
Where the GDPR applies and subject to its conditions and exceptions, you may have the right to:
- Access: obtain confirmation of whether your personal data is being processed and receive a copy and related information.
- Rectification: correct inaccurate personal data and complete incomplete data.
- Erasure: request deletion where the legal conditions are met.
- Restriction: request that processing be limited in the situations provided by law.
- Data portability: receive certain data you provided in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller.
- Object: object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. We will stop such processing unless compelling legitimate grounds or legal-claim grounds prevail.
- Object to direct marketing: object at any time to processing for direct marketing, including related profiling.
- Withdraw consent: withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
To exercise a right, email wonderfulalbania.com@gmail.com and identify the request clearly. We may ask for information reasonably necessary to verify identity and prevent unauthorised disclosure. Requests are handled within the time limits required by applicable law.
23. Right to complain to a supervisory authority
If you believe that your personal data has been processed unlawfully, you may lodge a complaint with the data-protection supervisory authority competent for your habitual residence, place of work or the place of the alleged infringement, without prejudice to other administrative or judicial remedies. Where the Italian supervisory authority is competent, it is the Garante per la protezione dei dati personali.
24. Children
Wonderful Albania is a general travel-information website and is not designed as a service specifically directed to children. We do not knowingly ask children to provide personal data for behavioural advertising or similar purposes. If a parent or guardian believes that a child has provided personal data inappropriately, they may contact us so that the circumstances can be reviewed and, where appropriate, the data removed.
25. Automated decision-making and profiling
Wonderful Albania does not itself use visitor data to make solely automated decisions that produce legal effects or similarly significant effects on individuals. Third-party platforms may carry out their own profiling or automated processing under their own terms and privacy notices, particularly after a user leaves this website or interacts with a third-party service.
26. Security
We use reasonable technical and organisational measures appropriate to the nature of the website and the data processed, including access controls, software updates, anti-spam and security measures, and hosting protections. No internet transmission or storage system is completely risk-free. Users should avoid sending sensitive information through ordinary email where a more secure channel is appropriate.
27. Do Not Track and similar browser signals
Some browsers offer privacy preference signals such as Do Not Track. Support varies among technologies and providers. Where an enabled service offers a setting to honour such signals, the site operator may configure it accordingly. A browser signal does not replace a consent choice where the applicable law requires a specific consent mechanism.
28. Changes to this Privacy Policy
We may update this Policy when the website, service providers, data practices or legal requirements change. The date at the top identifies the version currently published. Material changes may be highlighted through the website where appropriate. We encourage users to review this page periodically.
29. Contact
Questions about this Privacy Policy, the processing of personal data or a data-protection request can be sent to wonderfulalbania.com@gmail.com.