Privacy Policy
Last updated: 20 August 2026
This Privacy Policy explains how PackForBreak collects, uses, stores and protects your personal data when you use our marketplace. It also describes your rights and how to exercise them.
1. Who we are
PackForBreak Sh.p.k. ("PackForBreak", "we", "us") is the data controller for the personal data processed through the PackForBreak platform, available at packforbreak.com.
Registered address: Albania (exact address to be inserted before VPS go-live).
Data protection contact: privacy@packforbreak.com.
We act as an intermediary: when you book a stay, transfer or activity, the supplier (hotel, transfer company, tour operator) also processes your data as an independent controller to deliver the service.
2. What personal data we collect
| Category | Examples | How we collect it |
|---|---|---|
| Identity & contact | Name, email address, phone number, date of birth, nationality. | You provide this when you register or update your profile. |
| Account & security | Password hash, user ID, role, two-factor settings, login history. | Created when you sign up and use security features. |
| Booking & trip details | Dates, destinations, number of guests, room/experience type, special requests. | You enter this during search and checkout. |
| Payment data | Card brand, last four digits, billing address, transaction history. | Collected by our payment provider during checkout. We do not store full card numbers. |
| Supplier & business data | Business name, registration number, verified address, licence details, payout account, commission tier. | Provided during partner registration and verification. |
| Technical & usage | IP address, browser type, device ID, pages visited, search terms, error logs. | Collected automatically when you use the platform. |
| Communications | Support tickets, review text, chat messages, email correspondence. | Created when you contact us or leave a review. |
3. How we use your data and our legal basis
Under GDPR, we must have a lawful reason to process personal data. The table below shows the main purposes and the legal basis for each.
| Legal basis | Purpose |
|---|---|
| Performance of a contract | Creating and managing your account, processing bookings, sending confirmations, enabling check-in. |
| Legal obligation | Tax invoicing, accounting records, fraud prevention, responding to lawful requests from authorities. |
| Legitimate interest | Platform security, abuse prevention, service improvement, customer support, enforcing terms. |
| Consent | Marketing emails, analytics cookies, marketing cookies, affiliate attribution beyond the essential window. |
4. Who we share your data with
We only share personal data when necessary and with appropriate safeguards:
- Suppliers — the accommodation provider, transfer company or activity operator receives the booking details needed to deliver the service (name, dates, guest count, special requests, contact number).
- Payment providers — Stripe or other PCI-DSS compliant processors handle card payments. We only receive confirmation of payment and the last four digits.
- Communication services — email, SMS and push notification providers used to send booking confirmations and support messages.
- Internal roles — staff see only the data their role requires. For example, Finance sees amounts and payout accounts; Customer Support sees booking details; Area Managers see supplier business data.
- Authorities — courts, regulators, tax authorities or law enforcement when required by law.
- Professional advisers — auditors, lawyers or insurers in connection with legal claims or compliance reviews.
We never sell personal data to third parties for marketing purposes.
5. International transfers
PackForBreak operates in multiple countries. Some of our service providers (for example payment, hosting, email or analytics) may process data outside your country of residence, including outside the European Economic Area (EEA).
When this happens, we protect your data by using one of the following safeguards:
- Transferring to countries recognised by the European Commission as providing an adequate level of protection.
- Using Standard Contractual Clauses (SCCs) approved by the European Commission.
- Ensuring the provider is certified under recognised frameworks such as the EU-US Data Privacy Framework, where applicable.
You can request a copy of the relevant safeguards by emailing privacy@packforbreak.com.
6. How long we keep your data
We keep personal data only for as long as necessary for the purposes described in this policy, or as required by law.
| Type of data | Retention period |
|---|---|
| Booking and invoice records | Up to 10 years after the stay/service date (statutory accounting and tax obligations). |
| Account profile data | Until you delete your account, then removed within 30 days unless we must keep it for legal reasons. |
| Payment transaction records | Up to 10 years for tax and dispute purposes. Full card numbers are never kept by us. |
| Support tickets and communications | 7 years after the ticket is closed. |
| Technical logs and analytics | 12 months, then anonymised or deleted. |
| Marketing consent records | Until you withdraw consent, plus up to 3 years to prove compliance. |
7. Your GDPR rights
Depending on your location, you have the following rights in relation to your personal data:
Access
You can request a copy of the personal data we hold about you.
Rectification
You can correct inaccurate or incomplete data through your account or by contacting us.
Erasure (‘right to be forgotten’)
You can ask us to delete your data when it is no longer needed, subject to legal retention requirements.
Restriction
You can ask us to limit processing while we resolve a dispute or verify accuracy.
Data portability
You can receive your data in a structured, machine-readable format and transfer it elsewhere.
Objection
You can object to processing based on legitimate interest or direct marketing at any time.
Withdraw consent
Where we rely on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Many of these rights can be exercised directly in your account under My account → Profile and Security. For requests that cannot be handled automatically, email privacy@packforbreak.com. We will respond within 30 days and may ask for proof of identity.
If you believe your rights have been violated, you have the right to complain to your local data protection authority. In Albania, this is the Information and Data Protection Commissioner.
8. Automated decision-making and profiling
We do not make fully automated decisions that produce legal effects or similarly significant effects on you. Some features use automated scoring that does not have legal consequences:
- Search ranking — listings are ordered using factors such as relevance, availability, price, partner tier and review score.
- Fraud screening — payments may be flagged for manual review based on risk indicators.
- Loyalty tier — your tier is calculated automatically from the number of completed bookings and determines discount levels.
You can contest any of these outcomes by contacting customer support.
9. Data security
We use technical and organisational measures to protect your personal data:
- All data is transmitted over HTTPS/TLS.
- Passwords are hashed using strong, one-way algorithms.
- Access to administrative functions requires role-based permissions and, for privileged accounts, an additional email verification code.
- Sessions are token-based and expire after inactivity.
- Every administrative action is recorded in an immutable audit log.
- Payment card data is handled by PCI-DSS compliant providers; we do not store full card numbers.
- Servers and backups are encrypted at rest where supported by the hosting environment.
10. Children
PackForBreak is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe we have received such data, please contact us and we will delete it promptly.
11. Cookies and similar technologies
We use cookies and local storage to keep you signed in, remember your preferences, process bookings and measure site performance. For full details, including the cookies we use and how to manage your choices, see our Cookie Policy.
12. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements or data practices. The "Last updated" date at the top of this page shows the current version. We will notify you of material changes by email or through a prominent notice on the platform.
13. Contact us
For any questions, requests or complaints about this Privacy Policy or how we handle your data, contact:
PackForBreak Sh.p.k.
Email: privacy@packforbreak.com
Address: Albania (to be completed before VPS go-live).