Privacy Policy

1. Introduction

Welcome to Folium Gathering Place ("Folium", "we", "us", "our"). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, store, and protect your personal data when you visit our website or make a reservation with us, and it describes your privacy rights under applicable law.

We process personal data in accordance with Albanian Law No. 124/2024 "On Personal Data Protection", which is fully aligned with EU Regulation 2016/679 (GDPR), and with Law No. 54/2024 "On Electronic Communications in the Republic of Albania" for direct marketing communications.

2. Data Controller

The data controller responsible for your personal data is Folium Gathering Place, operating as Folium Tirana Restaurant & Bar, located at Rruga Dritan Mezini Rruga Faik Konica Rruga Gjeneral Nikols, Tiranë 1001, Tiranë 1010, Albania. You can reach us using the contact details in Section 13 below.

3. The Data We Collect About You

Personal data, or personal information, means any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data about you when you make a reservation or contact us, which we have grouped together as follows:

• Identity Data: includes first name, last name.
• Contact Data: includes email address and telephone number.
• Reservation Data: includes reservation date and time, party size, dining preferences (e.g. restaurant, cocktails, all-you-can-eat), special requests, dietary needs or allergies you choose to share, and average age group.
• Technical Data: includes internet protocol (IP) address, browser type and version, time zone setting and location, operating system, and other technology on the devices you use to access this website, collected through our privacy-focused website analytics.

4. How We Use Your Personal Data

We will only use your personal data when the law allows us to. Most commonly, we rely on the following legal bases:

• Performance of a contract: to process, confirm and manage your reservation and respond to special requests.
• Consent: to send you reservation confirmations, reminders, or updates by SMS and email, and for any optional marketing communications, which you may withdraw at any time as described in Section 5.
• Legal obligation: to comply with applicable Albanian law, including tax, accounting, and consumer protection requirements.
• Legitimate interests: to keep our website secure, prevent fraud or abuse of our booking form, and understand general usage of our website, provided your interests and fundamental rights do not override those interests.

5. Reservation Confirmations & Marketing Communications

We send transactional SMS and email messages (e.g. booking confirmations, changes, or reminders) that are necessary to manage your reservation. Any additional marketing communications will only be sent with your prior, explicit and freely given consent, in line with Instruction No. 4 of the Albanian Information and Data Protection Commissioner "On Personal Data Protection and Security Measures in Direct Marketing". You may withdraw consent to marketing communications at any time, free of charge, by contacting us using the details in Section 13 or by following the opt-out instructions included in the message, without affecting the lawfulness of processing carried out before you withdrew it.

6. Sharing Your Data & International Transfers

We share your personal data only with trusted third-party service providers who act as our data processors to help us run our reservation system, and only to the extent necessary for that purpose:

• Twilio Inc. — to deliver SMS reservation confirmations and updates. Twilio may process data outside Albania and the EEA (including in the United States); where this occurs, transfers are made subject to appropriate safeguards such as Standard Contractual Clauses.
• Zoho Corporation — to deliver email reservation confirmations, using EU-based mail servers.
• Vercel Inc. — to host our website and provide privacy-focused, cookieless website analytics.

We do not sell your personal data to third parties. We may also disclose your data where required by Albanian law or to protect our legal rights.

7. Cookies & Website Analytics

Our website uses privacy-focused analytics (Vercel Web Analytics) to understand general website traffic. This analytics tool does not use tracking cookies or collect data that directly identifies you. We do not currently use third-party advertising or social media tracking cookies. If this changes, we will update this policy and, where required, request your consent through a cookie banner.

8. Data Retention

We keep your reservation data only for as long as necessary to fulfil the purposes we collected it for, including for satisfying any legal, accounting, or reporting requirements. As a general rule, reservation records are retained for up to 24 months after your visit, unless a longer retention period is required by Albanian tax or accounting law, or you ask us to delete your data sooner and we have no legal obligation to keep it.

9. Data Security

We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know.

10. Your Legal Rights

Under Law No. 124/2024, you have the following rights in relation to your personal data:

• Request access to your personal data.
• Request correction (rectification) of your personal data.
• Request erasure of your personal data.
• Object to processing of your personal data.
• Request restriction of processing of your personal data.
• Request portability of your personal data, in a structured, commonly used, machine-readable format.
• Withdraw your consent at any time, where processing is based on consent.
• Lodge a complaint with the Albanian Information and Data Protection Commissioner (IDP), if you believe your rights have been violated.

If you wish to exercise any of the rights set out above, please contact us using the details in Section 13. We will respond to your request within the timeframes required by law.

You may also contact the Information and Data Protection Commissioner directly at Rr. "Abdi Toptani", Nd. 5, Kodi Postar 1001, Tiranë, Albania, by email at info@idp.al, or via their website at www.idp.al.

11. Children's Privacy

Our website and reservation services are not directed at children, and we do not knowingly collect personal data from anyone under the age of 16 without the consent of a parent or guardian. If you believe a child has provided us with personal data, please contact us so we can delete it.

12. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices or in applicable law. Any changes will be posted on this page with an updated "Last updated" date.