Skip to content
ENSQ

La Mirage

ENSQ

Privacy Policy

La Mirage respects the privacy and personal information of its website visitors and guests.

This Privacy Policy explains what information we collect, why we use it, who may receive it, how long it is retained and the rights available to you.

This policy applies to www.lamirage.al, our booking and contact forms, communications with La Mirage, online payments and accommodation services.

1Data controller

The controller responsible for processing personal information is KL Tech, NIPT M11306033H, Tirana, Albania, trading as La Mirage Collection.

Email: info@lamirage.al Website: www.lamirage.al

For privacy-related questions or requests, contact us at info@lamirage.al.

2Personal information we collect

Depending on how you use our website and services, we may collect and process the following categories of information.

Identification and contact information:

  • full name;
  • email address;
  • telephone number;
  • residential address, where necessary;
  • nationality or country of residence, where legally required;
  • identification-document information where legally required for guest registration;
  • information about the person making the booking;
  • information about other guests where necessary.

Booking and stay information:

  • selected property or accommodation;
  • check-in and check-out dates;
  • number of adults and children;
  • length of stay;
  • booking value and status;
  • change and cancellation requests;
  • special requests;
  • information about pets;
  • requested additional services;
  • communications before, during and after the stay;
  • booking history with La Mirage.

Payment information — when you use online payments, we may receive:

  • payment reference;
  • booking or order reference;
  • amount and currency;
  • transaction date and time;
  • payment, cancellation or refund status;
  • limited and masked card information, if supplied by the payment provider.

La Mirage does not store full payment-card numbers, CVV/CVC codes, PINs or online-banking credentials.

Forms and communications — we may retain information submitted through:

  • contact forms;
  • booking enquiry forms;
  • email;
  • telephone;
  • WhatsApp;
  • social media;
  • other communication channels chosen by you.

Technical information — when you use the website, our systems may record:

  • IP address;
  • device type;
  • browser type and version;
  • operating system;
  • browser language;
  • access date and time;
  • pages visited;
  • referring page;
  • technical errors;
  • request identifiers;
  • suspicious or unauthorized access attempts.

Incident and damage information — if an accident, fire, theft, damage, complaint, dispute or rule violation occurs, we may collect:

  • incident reports;
  • relevant photographs or videos;
  • statements from guests, staff or witnesses;
  • damage estimates and invoices;
  • communications with insurers, banks, authorities or legal advisers;
  • other information necessary to investigate and document the matter.

3How we use personal information

We may process personal information to:

  • respond to questions and enquiries;
  • check accommodation availability;
  • prepare and confirm bookings;
  • manage changes and cancellations;
  • process payments and refunds;
  • communicate before, during and after a stay;
  • provide requested services;
  • fulfil special requests;
  • administer check-in and check-out;
  • maintain financial and tax records;
  • prevent fraud and unauthorized payments;
  • protect guests, personnel and property;
  • investigate damage, accidents, fires, theft or rule violations;
  • handle complaints and disputes;
  • establish, exercise or defend legal claims;
  • maintain the security and operation of the website;
  • improve our services and guest experience;
  • send promotional offers where valid consent has been obtained.

4Legal bases

Personal information may be processed based on:

  • steps taken before entering into a contract;
  • performance of the booking and accommodation contract;
  • compliance with a legal obligation;
  • our legitimate interests in managing and protecting our business;
  • fraud prevention and security;
  • establishment, exercise or defence of legal claims;
  • your consent, where required.

Some information is necessary to process a booking. If you do not provide the requested information, we may be unable to process or confirm your booking.

5Who we share information with

Personal information may be shared, only where necessary, with:

  • authorized La Mirage personnel and contractors;
  • hosting, database and email providers;
  • security and technical maintenance providers;
  • providers of systems used to manage enquiries and bookings;
  • POK/RPAY and other payment-processing participants;
  • banks, card networks and financial institutions;
  • accountants, auditors, lawyers and insurers;
  • transport, maintenance or guest service providers;
  • police, courts, tax authorities and other competent authorities;
  • other parties where you consent or disclosure is permitted by law.

Service providers processing information on our behalf must use it only for the authorized service and apply appropriate security measures.

La Mirage does not sell or rent personal information.

6Payments through POK

Online payments may be processed by RPAY sh.p.k., trading under the POK brand.

POK processes payment-card information within its own secure payment environment. Processing carried out through POK's services is also governed by POK's terms and Privacy Policy (pokpay.io/privacy-policy).

La Mirage may receive only:

  • transaction reference;
  • booking reference;
  • amount and currency;
  • payment date and time;
  • payment or refund status;
  • limited and masked card information, if provided by POK;
  • information required for fraud prevention or payment-dispute management.

This information is used to confirm payments, administer bookings, maintain accounting records, process refunds, prevent fraud and defend legal claims.

7Google Maps and external platforms

The website may contain embedded Google Maps. When a map is loaded, Google may receive:

  • IP address;
  • device and browser information;
  • information about the page visited;
  • approximate or precise location where permitted by your device;
  • Google cookies or other identifiers.

Google's processing is governed by the Google Privacy Policy (policies.google.com/privacy).

The website may also contain links to WhatsApp, Instagram or other platforms. Once opened, further processing is governed by the relevant platform's privacy policy.

8Cookies

The website may use:

  • strictly necessary technical cookies;
  • security cookies;
  • preference cookies;
  • third-party technologies associated with Google Maps;
  • analytics or marketing cookies only if introduced and the required consent is obtained.

Non-essential cookies are not activated without your consent.

You can control or delete cookies through your browser settings. Disabling essential cookies may affect website functionality.

9Retention periods

Personal information is retained only for as long as necessary:

  • general enquiries: up to 24 months after the last interaction;
  • unconfirmed booking enquiries: up to 24 months;
  • booking, payment, invoice and accounting records: at least five years after the relevant tax year, or longer where legally required;
  • booking correspondence: for as long as necessary to provide the service and defend claims;
  • damage, accident and dispute records: until the matter is closed and the applicable claim period has expired;
  • technical and security logs: normally up to 90 days unless required for an incident investigation;
  • marketing information: until consent is withdrawn or after 24 months of inactivity;
  • backups: deleted or overwritten according to the applicable backup cycle.

When information is no longer required, it is deleted, anonymized or restricted as required by law.

10International transfers

Some technology providers may process information outside Albania. Where an international transfer occurs, we use or require safeguards permitted by law, such as:

  • adequacy decisions;
  • contractual protections;
  • appropriate safeguards;
  • other legally permitted transfer mechanisms.

11Information security

We use reasonable technical and organizational safeguards, including:

  • encrypted HTTPS connections;
  • restricted access;
  • authentication for administrative areas;
  • controlled credential management;
  • data backups;
  • technical monitoring and logging;
  • security updates;
  • incident-response procedures.

No electronic system or internet transmission can guarantee absolute security.

12Security cameras

Where CCTV is used at a property, it may cover entrances, gardens, external spaces or common areas.

CCTV is not placed in:

  • bedrooms;
  • bathrooms;
  • changing areas;
  • other areas where full privacy is expected.

Monitored areas are identified by visible notices.

Recordings are normally retained for no longer than 30 days unless required to investigate an incident, damage, theft or legal claim.

13Children's information

Bookings must be made by a person aged 18 or over.

Information about children is processed only where:

  • it is supplied by a parent or responsible adult;
  • it is necessary for the booking;
  • it is required for the child's safety;
  • it is required by law.

Please do not send unnecessary documents or information about children.

14Promotional communications

Promotional offers are sent only where:

  • you have given consent; or
  • the communication is expressly permitted by law.

You can withdraw consent at any time by using the unsubscribe option or contacting info@lamirage.al.

Withdrawing marketing consent does not affect operational communications relating to an active booking.

15Automated decision-making

We currently do not use solely automated decision-making that produces legal or similarly significant effects.

An automated availability or payment response does not necessarily constitute final confirmation of a booking.

16Your rights

Subject to applicable legal conditions, you may request:

  • information about processing;
  • access to your personal information;
  • correction of inaccurate information;
  • completion of incomplete information;
  • deletion;
  • restriction of processing;
  • objection to processing;
  • data portability;
  • withdrawal of consent;
  • information about recipients and transfers;
  • protection from solely automated significant decisions;
  • the right to lodge a complaint.

To exercise these rights, contact info@lamirage.al. We may request reasonable information to verify your identity. Requests are handled within the applicable legal period, normally within 30 days.

17Complaints

If you believe your personal information has been processed unlawfully, contact us at info@lamirage.al.

You also have the right to contact: the Commissioner for the Right to Information and Personal Data Protection.

  • Email: info@idp.al
  • Telephone: +355 42 23 7200
  • Toll-free: 0800 2050
  • Website: www.idp.al

18Changes to this policy

We may update this Privacy Policy when there are changes to:

  • our services;
  • the way information is processed;
  • our service providers;
  • payment methods;
  • legal requirements.

The latest version will be published on this page together with its effective date.