Privacy Policy — Flower Hotels & Resort

Last updated: 21 October 2026

This policy explains how Flower Hotel & Spa Sh.p.k. ("Flower Hotels & Resort", "we", "us"), NIPT L63707803N, with registered address at Rruga Ahmet Caci, Golem, Durrës, Albania, collects and uses personal data when you visit www.hotel-flower.com, chat with our virtual assistant Gonxhe, or message us on Facebook Messenger or Instagram.

1. Who is responsible for your data

Flower Hotel & Spa Sh.p.k. is the controller of your personal data. Contact: reception@hotel-flower.com, +355 67 604 0707.

2. What data we collect

  • Messages you send us on our website chat, Facebook Messenger or Instagram Direct, and our replies.
  • Profile data shared by Meta when you message our Facebook Page or Instagram account: your name, profile picture and a page-scoped user ID.
  • Contact and booking details you give us: name, email, phone number, dates of stay, number of guests, ages of children, special requests.
  • Website usage data: pages visited, time on site, device and browser type, approximate location from IP address.
  • Stay feedback you choose to give during or after your stay.

We do not ask for and do not want payment card details in chat. Never send card numbers by message.

3. Why we use it

  • To answer your questions about rooms, packages, prices, spa and events.
  • To check availability and make, change or cancel your reservation.
  • To hand your conversation to our Reservations team when a person is needed.
  • To improve our service and our assistant's answers.
  • To meet legal obligations (e.g. guest registration and accounting rules).

We use your data on the basis of your request (taking steps before a contract), the performance of your booking, our legitimate interest in answering enquiries well, and legal obligations. We do not use data received through Facebook or Instagram for advertising or email marketing without your explicit consent, and we never sell personal data.

4. Our virtual assistant (Gonxhe)

Gonxhe is an AI assistant. Your messages are processed by an AI service provider to generate replies. A member of our Reservations team can read the conversation and take over at any time; you can ask to speak with a person whenever you like.

5. Who we share it with

Only with service providers who process data on our behalf, under contract:

  • Anthropic (AI processing of chat messages) — USA
  • Render (application hosting) — USA
  • Neon (database) — Frankfurt, EU
  • Cloudbeds (reservation system)
  • Meta Platforms (Facebook Messenger and Instagram, when you message us there)
  • Zoho (email)

Where data is transferred outside Albania/EU, we rely on the providers' standard contractual safeguards.

6. How long we keep it

  • Chat conversations: 12 months after the last message, then deleted.
  • Booking records: as long as required by Albanian tax and accounting law.
  • Website usage data: 12 months.

7. Your rights

You may ask to access, correct, delete or receive a copy of your data, to restrict or object to its use, and to withdraw consent at any time. You may also complain to the Albanian Commissioner for the Right to Information and Personal Data Protection (idp.al).

8. How to delete your data

  • Email reception@hotel-flower.com with the subject "Delete my data" and the name / Facebook or Instagram profile you used. We delete your conversations and profile data within 30 days and confirm by reply.
  • Facebook: Settings & Privacy → Settings → Apps and Websites → remove our app → "Send request". We receive the request automatically and give you a confirmation code to check its status.

Booking records we are legally required to keep are retained only for that legal period.

9. Cookies

Our website uses essential cookies and a session identifier to keep the chat working and to count visits. We also use Google Analytics / Google Tag Manager to understand how the site is used and the Meta Pixel to measure the results of our Facebook and Instagram advertising. You can block these through your browser settings or ad preferences.

10. Changes

We may update this policy; the date at the top shows the latest version.