Introduction
Summit Balkans ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect information you provide when you visit our website (summitbalkans.com) or book one of our tours.
1. Data Controller
The data controller for the purposes of GDPR and applicable Kosovo data protection laws is:
Summit Balkans Evlia Qelebia, Mitrovica e Veriut 40000, Kosovo Email: info@summitbalkans.com Phone: +383 48 300 155
2. What Data We Collect
We collect the following categories of personal data:
Booking & contact information:
- Full name, email address, phone number
- Date of birth, nationality, passport details (where required)
- Emergency contact details
- Dietary requirements, medical conditions disclosed for safety
Payment information:
- Payment is processed by Stripe. We do not store credit card details on our servers.
Website usage data:
- IP address, browser type, device information
- Pages visited, time spent on site, referring URLs
- Cookies (see our Cookie Policy)
3. How We Use Your Data
We use your personal data to:
- Process and confirm your booking
- Communicate about your tour (logistics, weather, changes)
- Comply with legal and regulatory requirements
- Send marketing communications (only with your consent)
- Improve our website and services
4. Legal Basis for Processing
We process your data based on:
- Contract performance — to deliver the tour you booked
- Legal obligations — to comply with tax, accounting, and tourism regulations
- Legitimate interests — to improve our services and prevent fraud
- Consent — for marketing emails (you can withdraw consent anytime)
5. Data Sharing
We share your data only with:
- Tour partners (accommodation, transport, guides) — to fulfill your booking
- Stripe — for payment processing
- Bókun — for booking management and OTA distribution
- Authorities — only when legally required
We never sell your data to third parties.
6. Data Retention
We retain personal data only as long as necessary:
- Booking records: 7 years (for tax and accounting purposes)
- Marketing data: until you unsubscribe
- Website analytics: 26 months
7. Your Rights (GDPR)
You have the right to:
- Access your personal data
- Correct inaccurate data
- Request deletion ("right to be forgotten")
- Restrict or object to processing
- Receive your data in portable format
- Withdraw consent at any time
- Lodge a complaint with the Kosovo data protection authority
To exercise these rights, contact us at info@summitbalkans.com.
8. Data Security
We implement appropriate technical and organizational measures to protect your data, including:
- HTTPS encryption on our website
- Secure password and access controls
- Regular security updates
- Limited employee access to personal data
9. International Transfers
Some of our service providers (Stripe, hosting providers) may process data outside Kosovo or the EU. We ensure adequate safeguards through standard contractual clauses or equivalent mechanisms.
10. Children's Privacy
Our services are not directed to children under 16. We do not knowingly collect data from children without parental consent.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The latest version is always available at summitbalkans.com/legal/privacy-policy.
12. Contact
For privacy-related questions or to exercise your rights:
Email: info@summitbalkans.com Address: Evlia Qelebia, Mitrovica e Veriut 40000, Kosovo