Skip to content

Privacy Policy

The provisions relied on are cited in brackets: the Albanian Law No. 124/2024 "On Personal Data Protection" ("Law 124/2024") and, for visitors in the European Union, the General Data Protection Regulation (EU) 2016/679 ("GDPR").

Who is responsible for your data

Juli Elezi, sole trader, trading as Visit Këlcyra / Kelcyra Rafting Team, SH75 6401, Këlcyrë, Albania, email visitkelcyra@gmail.com, is the controller of the personal data described here ("we", "us"). Write to that address for anything about your data.

What this site does not do

  • You do not need an account to use the site, and you cannot create one. Only Juli and the people who run the site for him log in, to the admin.
  • We do not sell your data, and we do not use it for advertising or profiling.
  • No advertising cookies are used. Statistics (Google Analytics) load only if you accept them.
  • We do not take payments online. You pay on the day.

Booking and trip requests

The forms on tour pages and on "Plan your trip" ask for your name and email (required), your WhatsApp number (optional), the tour, the date and the number of people if you give them, your message, and we record the language of the page you used and the time it arrived.

Why: to answer your request, and if you book, to organise your trip. Legal basis: steps taken at your request before a contract, and the contract itself (Law 124/2024, Art. 7(1)(b); GDPR Art. 6(1)(b)). Kept: 2 years after the trip date (or 2 years after the request arrived, if it has no date), then deleted automatically.

The participant waiver

Before the activity, every participant signs a waiver, online at /waiver or on paper. Online, it collects:

  • about you: full name, date of birth, home address, phone, email;
  • an emergency contact: their name and phone (please tell them you have given them);
  • the trip: the date, the tour if you choose one, and the booking if you used your booking's own link;
  • children under 18 who come with you: each child's name and date of birth;
  • your declarations: that you agree to the declaration, that you are in good health and have told (or will tell) the guide about any medical condition that could affect your safety, that you meet the requirements (able to swim, at least 12, no more than 120 kg), and, with children, that you are their parent or guardian and accept the declaration for them;
  • your signature: drawn with a finger or the mouse, and your typed name; the date and time are recorded by our server;
  • a copy of the exact text you signed, in the language you read it in and in English, with its version, so that later changes to the text never change what you signed;
  • photo consent, only if you tick the optional box.

We do not ask for details of any medical condition on the form; you tell the guide directly. Your declaration about your health (and your children's) is still information about health, a special category of data.

Why: to make sure every participant meets the conditions to take part safely, to reach someone if there is an emergency, to keep a record that the participant (or their parent or guardian) read and accepted the declaration, and for administration.

Legal bases:

  • the contract for the activity and the steps before it (Law 124/2024, Art. 7(1)(b); GDPR Art. 6(1)(b));
  • for the health declaration, your explicit consent, which you give by ticking that box (Law 124/2024, Art. 9(2)(a); GDPR Art. 9(2)(a)). Without it we cannot let you take part, because the activity cannot be run safely without it;
  • for the emergency contact, and for using the information in an emergency, our legitimate interest in your safety and, in an emergency, the vital interests of the person concerned (Law 124/2024, Art. 7(1)(ç) and (dh); GDPR Art. 6(1)(d) and (f));
  • for keeping the signed waiver as a record, our legitimate interest in being able to show what was agreed if there is ever a claim (Law 124/2024, Art. 7(1)(dh) and Art. 9(2)(dh); GDPR Art. 6(1)(f) and Art. 9(2)(f)).

Children. A parent or legal guardian fills in the waiver for anyone under 18 and gives the child's details; children never fill it in themselves (Law 124/2024, Art. 8(6); GDPR Art. 8).

Who sees it: Juli and the guides who need it for the activity. Signed waivers are stored in the site's database, never in public files, and only people logged in to the admin can see them.

Kept: 2 years after the trip date, then deleted automatically, with the children's details and the signature. Paper waivers are kept the same 2 years and then destroyed.

Photos and videos

We may take photos and videos during activities. We share photos and videos of you on our website and social media only if you tick the photo consent box on the waiver (Law 124/2024, Art. 7(1)(a); GDPR Art. 6(1)(a)). It is optional and never pre-ticked. You can withdraw it at any time by writing to visitkelcyra@gmail.com, as easily as you gave it (Law 124/2024, Art. 8(3); GDPR Art. 7(3)); we then stop using those photos and remove them from our website and our own social media posts. Photos showing children's faces are never published.

Emails we send

When the email service is switched on, a booking request is emailed to us and you receive a confirmation in your language; a signed waiver sends you a copy of what you signed and us a short notice. The emails go through Resend, Inc. (United States), which processes the addresses and the content of these emails on our behalf. Until it is switched on, nothing is emailed; your request or waiver is still saved.

Spam protection

The forms are protected by Cloudflare Turnstile, which checks that a person, not a program, is sending them, using technical information from your browser and your IP address. The forms also limit how many can be sent from one address in a minute. Legal basis: our legitimate interest in keeping the forms free of spam and abuse (Law 124/2024, Art. 7(1)(dh); GDPR Art. 6(1)(f)).

Contacting us directly

If you write to us by WhatsApp, email or phone, the data you send is processed by that service and by us, to answer you. The WhatsApp buttons only open WhatsApp with a message prepared: nothing is sent until you send it, and WhatsApp (Meta) is not loaded by our pages.

Links to other sites

Links to Google Maps (directions, our Business Profile from the address in the footer), Instagram, TikTok, YouTube, Facebook, Tripadvisor, WhatsApp, the partners and businesses listed on the site, and the website's maker (AM Web Design) open those sites only when you click them; nothing from them is loaded by our pages. Once there, their own privacy policies apply.

Statistics (Google Analytics), only with your consent

If you click Accept in the cookie banner, the site loads Google Analytics 4 (Google Ireland Limited / Google LLC) to count visits and see which pages are useful. It sets the cookies _ga and _ga_<ID> and sends Google information about your visit: the pages you open, your device and browser, and an approximate location derived from your IP address (Google Analytics 4 does not log or store IP addresses). Google Consent Mode v2 keeps advertising storage, ad personalisation and ad user data off.

If you click Decline, or do nothing, Google Analytics is not loaded at all. You can change your choice at any time with Cookie settings at the bottom of every page; declining then deletes the _ga cookies. Legal basis: your consent (Law 124/2024, Art. 7(1)(a); GDPR Art. 6(1)(a)). Google keeps the statistics for 14 months. The banner and the statistics are switched off until the site is launched.

What your browser stores

  • vk-consent: your browser's local storage. What for: your answer to the cookie banner. How long: until you clear it
  • vk:favorites: your browser's local storage. What for: places and tours you save with the heart. Never sent to us. How long: until you clear it
  • NEXT_LOCALE: cookie. What for: the language you chose, so the site opens in it next time. How long: 1 year
  • _ga, _ga_<ID>: cookies. What for: Google Analytics, only if you accepted. How long: up to 2 years

The first three are needed for things you ask for and need no consent. The admin's login cookie is only set for the people who run the site.

Where your data is kept, and who processes it for us

  • Cloudflare, Inc. (United States): the website runs on Cloudflare. It hosts the pages, the database (Cloudflare D1, where booking requests and waivers, signatures included, are stored) and the photo storage (Cloudflare R2), runs Turnstile, and keeps short-lived technical logs. Like any web host it processes your IP address and request details to deliver the site and protect it from attacks. The database is located in Eastern Europe and served from Frankfurt.
  • Resend, Inc. (United States): email, once switched on (see above).
  • Google (Google Ireland Limited / Google LLC): Google Analytics, only with your consent.

These companies process data only on our instructions, under data processing terms (Law 124/2024, Art. 26; GDPR Art. 28). The site's fonts, map and video are served from our own address: your browser does not contact Google Fonts, a map provider or a video platform to show them. (The admin's machine translation of the site's own texts sends those texts to Google Cloud Translation; it never sends your data.)

Transfers outside Albania and the EU. Cloudflare, Google and Resend are based in the United States, and their services may process data there. Albania's Information and Data Protection Commissioner treats the United States as providing an adequate level of protection for companies certified under the EU–US Data Privacy Framework (Commissioner's Decision No. 01 of 30 April 2025, under Law 124/2024, Art. 40; for the EU, Commission Implementing Decision (EU) 2023/1795 under GDPR Art. 45). Cloudflare and Google are certified.

How long we keep it

  • Booking requests: 2 years after the trip date (or after arrival, without a date), then deleted automatically
  • Waivers, with children's details and signatures: 2 years after the trip date, then deleted automatically
  • Paper waivers: 2 years after the trip date, then destroyed
  • Photo consent: as long as the waiver; photos already published until you withdraw consent
  • Emails and WhatsApp messages: only as long as needed to arrange your trip, and no longer than 2 years
  • Statistics (Google Analytics): 14 months

Your rights

You can ask us for a copy of your data and information about how we use it (Law 124/2024, Art. 14; GDPR Art. 15), to correct it (Art. 15; GDPR Art. 16), to delete it (Art. 15 and 16; GDPR Art. 17), to restrict how we use it (Art. 17; GDPR Art. 18), to receive it in a portable form (Art. 18; GDPR Art. 20), and to object to processing based on our legitimate interests (Art. 19; GDPR Art. 21). Where we rely on your consent (the health declaration, photos, statistics), you can withdraw it at any time; this does not affect what was done before (Law 124/2024, Art. 8(3); GDPR Art. 7(3)). Withdrawing consent to the health declaration before the activity means you cannot take part.

Write to visitkelcyra@gmail.com. We answer within 30 days. If a request is complex we may need up to 60 days, and then we tell you why within the first 30 (Law 124/2024, Art. 12(4); GDPR Art. 12(3)). We may ask you to confirm who you are (Law 124/2024, Art. 12(3)). A parent or guardian can exercise these rights for their child.

Complaints

If you think we have not handled your data lawfully, please tell us first so we can put it right. You also have the right to complain to a supervisory authority:

  • in Albania, the Information and Data Protection Commissioner (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale), Rruga "Abdi Toptani", Nr. 5, Tirana, idp.al (Law 124/2024, Art. 86); the Commissioner's decisions can be appealed to the administrative court (Art. 87);
  • if you live in the European Union, also the data protection authority of your country, of your place of work, or of the place of the alleged infringement (GDPR Art. 77). The list is at edpb.europa.eu.

Children

The website is not aimed at children, and we do not knowingly collect children's data except through the waiver, where a parent or legal guardian gives it for a child taking part with them (see above). Bookings are made by adults.

Security

Only the people who run the site can log in to the admin, with their own passwords; nobody else can read booking requests or waivers, through the website or its programming interface. Connections to the site are encrypted (HTTPS). The database is backed up by Cloudflare for 30 days, so a deleted request or waiver disappears from the backups within 30 days of its deletion.

Changes to this policy

If what we do with personal data changes, we update this page and the date at the top. This policy may be available in several languages; if the versions differ, the English version applies.