Privacy Notice

The controller responsible for your personal data is:

Tech Fly
Sheshi Avni Rustemi 22/2, 1001 Tirana, Albania
VAT / registration: L11904007C
Email: info@location.travel

We have not appointed a Data Protection Officer, as we are not required to under Article 37 of the GDPR. We have also not appointed an EU/UK Article 27 representative at this time. For any privacy question, contact us directly at info@location.travel.

Depending on how you use the service, we may process the following categories of data:

• Account data — if you create an account: name, email address, password if you set one (stored only as a secure hash), phone, nationality, language and currency preferences, and saved hotels. If you sign in with Google, we receive your name, email address and profile picture from Google; we never see your Google password. We use your verified email to show bookings and loyalty points held for you by LiteAPI.travel.
• Booking data — the lead guest's name, email address and phone number, check-in/check-out dates, destination, number and ages of guests, room selections, special requests, and booking and hotel confirmation numbers.
• Guest data — names and, where required, contact or age information of co-travellers that you provide at checkout.
• Payment metadata — payment status, currency and amount. Full card details are collected and processed directly by LiteAPI.travel's PCI-DSS compliant payment infrastructure; we do not store card numbers.
• Communications — messages you send to info@location.travel, support requests, and booking-related correspondence.
• Device and log data — IP address, browser type, device identifiers, referring pages, pages viewed, and approximate location derived from IP.
• Location — only if you tap “Use my location” or “Near me”: your browser shares your position once, we round it to about 1 km to find hotels nearby, and we don’t store it.
• Your season — to show the right season (for example summer in Sydney when it is winter in Europe), the page reads your device’s time zone and today’s month in your browser. This stays on your device: it is not sent to us or stored.
• Recent searches and recently viewed hotels — kept only in your own browser (local storage) to show them on the home page. They are not sent to us; use “Clear history” on the home page to remove them.
• Cookie and similar technology data — see Section 12.

We use your personal data only where we have a valid legal basis under Article 6 of the GDPR:

• Contractual necessity (Art. 6(1)(b)) — to process bookings, send booking confirmations, transmit reservation details to LiteAPI.travel and the accommodation provider, and provide customer support.
• Legitimate interests (Art. 6(1)(f)) — to secure our service, prevent fraud and abuse, improve site functionality, and defend legal claims. You may object to processing based on this ground at any time.
• Consent (Art. 6(1)(a)) — for analytics cookies (Google Analytics), for any future marketing communications, and for any use of sensitive data. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• Legal obligation (Art. 6(1)(c)) — for tax, accounting, anti-money-laundering, and other legal record-keeping obligations.

We share personal data only with the recipients strictly needed to operate the service:

• LiteAPI — Nuitée Travel Limited — 4 Waterloo Rd, Ballsbridge, Dublin, D04 A0X3, Ireland (EU/GDPR-established). Processes booking requests, transmits reservation data to accommodation providers, and captures payment inside its PCI-DSS compliant environment. LiteAPI also provides the checkout payment form (payment-wrapper.liteapi.travel) that loads in your browser, and hotel content such as photos, reviews and AI-generated review summaries and answers. Acts as a data processor on our behalf for booking transmission, and as an independent controller for its own platform operations, security, and analytics under its own Privacy Policy.
• Accommodation providers, hotels and travel suppliers — receive the booking details necessary to fulfil your reservation. From the moment a booking is transmitted, the Provider becomes an independent controller of any additional personal data it collects at check-in (identity documents, credit-card imprint for damage deposit, guest register, in-room services). Its own privacy policy applies to that processing.
• Contabo GmbH (Germany) — provides the server that hosts the website and the database that stores booking records.
• Resend (Plus Five Five, Inc., USA) — sends booking confirmation and cancellation emails on our behalf. Transfers rely on the EU Standard Contractual Clauses.
• Email hosting provider — receives and delivers correspondence sent to and from info@location.travel.
• Google Ireland Limited (Google Analytics 4) — measures how the site is used, only if you accept analytics cookies. Receives pseudonymous usage data (pages viewed, device and browser type, approximate location from an anonymised IP address). Data may be transferred to Google LLC in the United States under the EU–US Data Privacy Framework and Standard Contractual Clauses.
• Google Ireland Limited (Google Sign-In) — only if you choose “Continue with Google”: confirms your identity and shares your name, email address and profile picture with us. Data may be transferred to Google LLC in the United States under the EU–US Data Privacy Framework and Standard Contractual Clauses.
• OpenFreeMap — serves the map tiles used on hotel and search-results pages, built on OpenStreetMap data. No cookies are set; your IP address is transmitted to fetch the tiles. Directions open in Google Maps, Apple Maps or Waze only if you choose to click those links.
• Public authorities, regulators, or courts — where we are legally required to disclose information.

We do not sell personal data. We do not share personal data with advertising networks. If this ever changes we will update this notice and, where required, ask for your consent first.

Because location.travel serves guests booking accommodation worldwide, personal data will be transferred to the country in which the property you book is located, and to any sub-processor that operates outside your jurisdiction. LiteAPI (Nuitée Travel Limited) is established in Ireland, so booking data transmitted to LiteAPI stays within the European Economic Area; onward transfer from LiteAPI to the accommodation Provider depends on the destination country of the property. Where a transfer leaves the EEA, we rely on an adequacy decision of the European Commission where one exists, or on the European Commission's Standard Contractual Clauses (2021/914) together with additional safeguards where appropriate. You can request a copy of the safeguards in place by contacting info@location.travel.

We retain personal data only for as long as necessary for the purposes for which it was collected:

• Booking data — kept for 6 years after the stay for customer service, tax, accounting, legal, and dispute purposes. Bookings are processed through LiteAPI.travel, which retains its own copy under its retention rules.
• Account data — kept while the account is active. When you delete your account, your profile, saved hotels, sign-in methods and sessions are deleted immediately; bookings are kept as booking records (see above) but no longer linked to an account.
• Marketing data — kept until you unsubscribe, withdraw consent, or after 24 months of inactivity, whichever comes first.
• Support correspondence — kept for up to 3 years after the last contact.
• Log and cookie data — kept for up to 13 months.

If you have an account, you can do two of these yourself at any time, under Account → Profile: download a copy of your data (as a JSON file) and permanently delete your account, confirmed with a code sent to your email. For anything else, write to info@location.travel; we reply within one month.

Under the GDPR and comparable laws you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data (right to be forgotten) where legal grounds apply
• Restrict our processing while a request is under review
• Receive your data in a portable, machine-readable format
• Object to processing based on legitimate interests
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with your national data protection authority (see the EDPB list of authorities)

To exercise any right, email info@location.travel. We respond within one month; the deadline can be extended by two further months for complex requests, in which case we will inform you.

We do not carry out solely automated decisions that produce legal or similarly significant effects on you, and we do not carry out profiling for advertising purposes.

We use artificial intelligence (AI) to assist in creating some of the content shown on location.travel and to power automated chatbot features, where available. AI-generated content is reviewed by our team before publication, but errors may still occur. For more information about how we use AI and how we disclose AI interactions, please see our AI Disclosure.

location.travel is intended for adults. We do not knowingly collect personal data from children under 18. Guests under 18 may be included in a booking made by a responsible adult.

We use appropriate technical and organisational measures to protect personal data, including TLS encryption in transit, a database that is not reachable from the internet, restricted administrative access, rate limits, and server-side handling of all booking and payment steps. No system is perfectly secure; if we become aware of a personal data breach affecting your rights, we will notify you and the relevant supervisory authority as required by law.

Strictly necessary cookies keep the site working and do not require consent: a secure cookie that lets the browser you booked with show and manage that booking, your sign-in session if you have an account, and small preference cookies for your language, currency and cookie choice. On your first visit we suggest a language and currency from your browser's language and the country of your IP address, looked up on our own server in the free country database of DB-IP (CC BY 4.0); the IP address is not stored for this.

Analytics cookies (only with your consent). If you click "Accept" in the cookie banner, we load Google Analytics 4 (Google Ireland Limited) to understand how the site is used, for example which pages are visited and whether searches lead to bookings. IP addresses are anonymised and advertising features are switched off. Nothing is loaded or sent to Google before you agree. You can change your choice at any time with "Cookie settings" in the footer. Analytics cookies are kept for up to 14 months.

We do not use marketing or advertising cookies.

The following third-party services load in your browser on specific pages:

• LiteAPI Payment form (Nuitée Travel Limited) — loaded only on the checkout page from payment-wrapper.liteapi.travel, with its payment processor. It may set its own fraud-prevention cookies.
• OpenFreeMap — map tiles on hotel and results pages; no cookies, but your IP address is sent to fetch the tiles.

We may update this Privacy Notice from time to time. When we make material changes we will revise the "Last updated" date and, where appropriate, notify you by email or in-app. Continued use of the service after changes take effect constitutes acceptance of the updated notice.

For any privacy question or to exercise a right, contact: info@location.travel