Legal documents

Privacy
Policy

What data we collect, why we need it, and how we protect it.

Last updated August 21, 2026

What we collect

From customers

First and last name
Email and phone number
Booking dates and details
Communications with us

From businesses

Entity details and contacts
Photo of the identity document
Vehicle details and prices
Booking history

Automatically

IP address and device type
Pages visited on the platform
Technical session cookies
Security logs

We don't sell your data and we don't store card data. Your contact details are shown to the business only two days before the booking.

1. Who is responsible for the data

The controller of personal data collected through the Ridalo.al platform is Elvis Cuni, tax ID (NIPT) M51924502F, with registered address in Durrës, Sukth, Vadardhe village, Albania.
For any question or request relating to your data, write to us at info@Ridalo.al.al.

2. Why we process the data

To create and maintain your account on the platform.
To carry out and confirm bookings, including sending automatic confirmation emails.
To verify the identity of businesses before their vehicles are made public.
To collect the 8% Booking Fee through the payment provider.
To respond to requests you send us through the contact page.
For platform security, fraud and abuse prevention, and to comply with legal obligations.

3. What legal basis we rely on

Performance of the contractual relationship: when you open an account or make a booking, processing is necessary to provide the service.
Our legitimate interest: platform security, fraud prevention, and service improvement.
Legal obligation: retaining financial data and responding to requests from competent authorities.
Consent: for non-essential cookies (analytics, marketing) and for promotional communications, which you may disable or withdraw at any time.
Where applicable, processing is carried out in accordance with Albanian legislation on the protection of personal data and, where relevant, the EU General Data Protection Regulation (GDPR).

4. Business registration document

A business registration document (e.g. Tax ID / NIPT) is required only from businesses, as part of initial verification. We do not require a personal ID card or passport photo.
It is seen only by authorized platform staff, is never published, and is not given to customers or other businesses.
If the account is rejected, the document is deleted within 30 days of the decision.

5. Who we share the data with

With the business you made the booking with: your name and booking details are shown to them so they can prepare the vehicle.
With the online payment provider, to process the Booking Fee.
With our technical providers for hosting, database, analytics, and email delivery, who act according to our instructions.
With competent authorities, where required by law.
We do not sell or rent your data for third-party marketing purposes.

6. When your contact details are shown

The customer's phone number and email are shown to the business - and vice versa - only two days before the booking's start date.
Until then, both parties communicate only through the platform. This rule exists specifically to limit the sharing of contact details.

7. Payment data

Your card number and its details are entered directly with the payment provider and are not stored on our servers.
We store only the payment confirmation, amount, and date, which are necessary for the booking and for accounting purposes.
The remaining amount is paid outside the platform, directly to the business, and does not pass through us.

8. How long we retain data

Account data is retained for as long as the account is active and is deleted within 12 months of its closure.
Booking and payment data is retained for the periods required by applicable financial legislation.
Verification documents of rejected businesses are deleted within 30 days.
Messages sent through the contact page are retained for up to 24 months.

9. Cookies

We use cookies and similar technologies for the platform's essential functionality (maintaining your session, storing search filters), account security, analytics, preferences, and, where permitted, marketing.
Essential and security cookies are necessary for the platform to function and are used without requiring prior consent.
Analytics, preference, and marketing cookies are used only with your prior consent, which you may give or withdraw at any time from the cookie banner or your browser settings.

10. Your rights

To request access to the data we hold about you and a copy of it.
To request correction of inaccurate or incomplete data.
To request deletion of data, where we have no legal obligation to retain it.
To object to or request restriction of processing in certain cases.
To request data portability, where applicable.
To withdraw consent for non-essential cookies and promotional communications, without affecting bookings already made.
Requests should be sent to info@Ridalo.al.al and we will respond within the legal deadlines.

11. Security

The connection to the platform is encrypted and passwords are stored hashed, never in readable text.
Access to sensitive data is restricted to staff who need it.
No system is completely impenetrable. If a breach occurs that puts your data at risk, we will notify you and the competent authority within the legal deadlines.

12. International transfers

Some of the technical services we use (hosting, email, payments, analytics) may be located outside Albania, including within the European Union.
In such cases, we ensure that the transfer is made to countries or providers that guarantee an adequate level of protection, in accordance with applicable requirements, including those of the GDPR where it applies.

13. Minimum age

The platform is intended for persons over 18 years of age. We do not knowingly collect data from minors.
If we determine that an account belongs to a person under 18, we close it and delete the related data.

14. Changes to this policy

This policy may be updated. The version in effect is the one published here, with the update date shown at the top.
For material changes, we notify users with an active account by email.

15. Complaints

If you believe your rights have been violated, please contact us first.
You also have the right to lodge a complaint with the Commissioner for the Right to Information and Protection of Personal Data of the Republic of Albania.

Request about your data?

Write to us and specify what you're requesting - access, correction, or deletion. We will respond within the legal deadlines.

Send the request Terms of Use

PrivacyPolicy