Privacy policy

The controller of your data is Lu-Na sh.p.k. (Luna Travel), NIPT K31412087P, with its address at Rruga e Durrësit 75, Tiranë, Albania.

For any matter relating to your data: info@luna.al.

We have not appointed a data protection officer. Data requests are handled directly by our office.

We apply Law no. 124/2024 “On Personal Data Protection” and, when we serve persons located in the European Union, Regulation (EU) 2016/679 (GDPR).

When you buy a ticket. For each passenger: first name and surname, email and phone number. For the order: the line, the date and time of travel, the return journey if you choose one, the number of seats, the price and the site language. We use them to issue the named ticket, to send it to you, to check it on the vehicle and to notify you when something changes about the journey. The first name, surname, email and phone number are mandatory: without them the ticket cannot be issued. We use the phone number to contact you when there are changes or problems with the journey. Legal basis: performance of the travel contract and, for sales records, legal obligation under accounting law.

When you buy for other people. You provide us with the data of the other passengers. Provide only data that you are entitled to share, and inform them of this policy. Each passenger whose email differs from the buyer's receives only their own ticket by email. Legal basis: performance of the travel contract.

Customer summary. From the orders, the system keeps for each buyer, by email address, a summary with the name, phone number, language, and the number and value of orders, so that the office can see the history when you contact it. Legal basis: legitimate interest in customer service.

At the time of ordering. The IP address and browser data, as a measure against fraud and misuse. From the IP address we derive the country using a database located on our server, without sending the IP address to anyone. The IP address and browser data are automatically deleted from the order after 90 days; the country remains with the order. When you open the purchase form, we use the same database to preselect the phone prefix and the card country according to your country; you can change them freely. Legal basis: legitimate interest in fraud prevention.

When the ticket is scanned. The time of the scan, the employee who scanned it and the vehicle. This is the proof that the journey took place. Legal basis: performance of the travel contract.

When you request a cancellation or refund. The reason you select, the explanation you write and the IP address of the request. The reason is stored with the order so that the office's decision is traceable; the IP address is automatically deleted after 90 days. Legal basis: performance of the contract and, for refunds, legal obligation under accounting law.

When you request a change of date or direction. The new date or direction you request, the note you write and the IP address of the request. The request is stored with the order so that the office's decision is traceable; the IP address is automatically deleted after 90 days. Legal basis: performance of the travel contract.

When you send a transfer request. The type of request, departure and arrival, dates, number of passengers, luggage, duration of the cooperation, first and last name, phone, email, preferred contact method and your notes. Name and email are always required; for transfers, the departure and travel date are also required. The other fields are optional. The request is sent to the office by email so it can make you an offer. Legal basis: steps taken at your request prior to entering into a contract.

When you write to us through the contact page. Your first and last name, email, phone, topic, message and, for lost items, the photos you attach. Name, surname, email and phone are required. The message and photos are sent to the office by email so it can reply to you. Legal basis: legitimate interest in answering your questions.

Visit statistics. For each page opened, we count the page, language, country, device type and the page you came from (e.g. a search engine). We also count how many visits reach each step of buying a ticket, by language, device type and the page you came from. These counts are stored as totals per day and per hour, with no IP address, no cookies and no identifiers, and are not linked to your order. The list of IP addresses we keep for security is described in the next point. Legal basis: legitimate interest in improving the site.

Server logs. The site's server logs every request with the IP address, the page address, the browser and the time. For each IP address that opens the site we also keep how many pages it opened each day, the country, the device type, the last page and the time. Error logs may contain the IP address, the recipient's email address for an email that was not sent and, when a booking or card payment does not go through, the buyer's name, email and phone number, so that we can help you. Legal basis: legitimate interest in the security and maintenance of the service.

For card payment, see the section Card payment and POK.

The full card number and the CVC code never reach our server. The card form is displayed within our payment page, but the card details are captured by POK's payment software running in your browser: it encrypts them there and sends them directly to POK. The payment may require 3-D Secure verification by the bank that issued the card.

In the form you enter the card number, expiry date and CVC, the name on the card and the card's country; for cards from the United States and Canada, also the postcode and the state. The amount, the currency, the order description, the buyer's name and email, as well as technical browser data (screen size, time zone, language) required by card verification, are also passed to POK.

From POK we receive and store with the order: the payment status, the transaction identifier and reference number, the card brand and type, the last four digits, the name on the card and the billing details that POK returns to us. We use them to confirm the payment, for refunds and for accounting. Legal basis: performance of the contract and legal obligation under accounting law.

During payment, POK's software also loads into your browser services that POK uses for fraud prevention and card verification: ThreatMetrix, which creates a device fingerprint, and Cardinal Commerce for 3-D Secure. Your bank's verification page may open within the payment window. These services receive the IP address and technical data of your device.

For the data it collects during payment, POK is an independent controller and applies its own policy. Its main points, which we pass on to you for convenience, are:

• Who it is: RPAY sh.p.k., NIPT M11328018F, trading as POK, an electronic money institution licensed by the Bank of Albania (licence no. 50, dated 9.9.2021), Rruga “Frang Bardhi”, Godina Kristal Center, 2nd floor, entrance 33, Tiranë.
• What it collects: card or account data, transaction data, device identifier, IP address and security signals; for users with a POK account, also identification data.
• Why: to carry out the payment, for fraud prevention, for legal obligations against money laundering, for customer support, for security, for technical analysis and, when you so choose, for marketing.
• Legal basis: performance of a contract, legal obligations, legitimate interest and, where required, consent.
• Shared with: payment processors and card partners, card schemes and banks, identity verification and sanctions screening providers, hosting and cloud providers, Google Tag Manager, merchants and regulatory authorities, including the Bank of Albania and the Commissioner for the Right to Information and Personal Data Protection.
• Outside Albania: it may transfer them to countries of the European Economic Area or to other countries, with safeguards which, according to its policy, may include adequacy decisions, standard or equivalent contractual clauses, and technical measures.
• How long: for as long as necessary for the purpose and as required by the laws it applies.
• Cookies: POK declares that it does not use cookies on its website and app and that it may use Google Tag Manager for technical tags.
• Privacy contact: Akil Rajdho, Information Security Officer and Privacy Contact, arajdho@rpay.ai, +355 68 606 0063.

POK's full and up-to-date text: pokpay.io/privacy-policy. If our summary differs from POK's text, POK's text prevails.

Only emails related to your order or request: the ticket with the QR code (as a PDF and as an image), confirmation of the cancellation request and of the cancellation, the new date when the office reschedules the journey, and the office's reply. We do not send advertising or newsletters, and we do not give your address to anyone.

Automated emails are sent from noreply@luna.al through our mail server. When sending fails, the system tries up to 8 times in total, within about 11 hours. The copy of the email is deleted 30 days after sending, or 30 days after creation if it cannot be sent; attachments are deleted as soon as the email is sent.

The site does not use advertising cookies and does not load third-party analytics tools. In your browser it stores only the cookies and technical notes needed for the site to work, such as:

• luna_pay A cookie set when you start a payment. It verifies that the order belongs to this browser. It lasts 24 hours.
• luna.language A cookie set when you change the site language or open a page in another language. It keeps the selected language. It lasts 1 year.
• luna.visit An entry in sessionStorage so that the first page of a visit is counted only once in the statistics. It is deleted when you close the tab.
• luna.ref An entry in sessionStorage holding the address of the page you came from, so that purchase statistics know the source of the visit. It is deleted when you close the tab.
• luna.step.* Entries in sessionStorage so that each step of buying a ticket is counted only once in the statistics. They are deleted when you close the tab.
• luna:wa-nudge An entry in sessionStorage so that the WhatsApp invitation is not shown again. It is deleted when you close the tab.

Google Maps. The airport and contact pages display Google Maps maps showing where the stops and the office are located. For visitors from the European Union, the European Economic Area, the United Kingdom and Switzerland, the map appears only after you request it with a click; until then, the site does not connect to Google. For visitors from other countries, the map appears automatically. We determine the country from the IP address using a database on our own server, without storing it for this purpose. Legal basis: your consent when you request the map, otherwise our legitimate interest in showing you the location. When the map appears, your browser connects to Google, which receives the IP address and browser data and may set its own cookies, in accordance with Google's policy: policies.google.com/privacy.

Payment. Only on the payment page are POK's software and its security services loaded, and they may store data in your browser according to their own rules, as explained in the payment section.

WhatsApp. The WhatsApp button is a simple link: the site loads nothing from WhatsApp until you press it. When you write to us there, WhatsApp's policy applies.

The fonts, images and line map on the home page come from our server. Weather and flight schedules are read by our server from public sources, without any of your data being sent to them.

The data we hold is seen only by our staff.

Refund requests, transfer requests, contact messages and notifications about payments with problems are sent to our office by email.

The only third party that receives data from us is POK, which carries out the card payment under its own policy.

Public authorities, such as the tax administration, the courts or the police, receive data only when required by law. We do not sell your data and we do not give it to third parties for their own purposes.

The site, the database, the backups and the mail server are located in data centres in Germany, in the European Union. Under Law no. 124/2024 and Commissioner's Decision no. 01, dated 30.04.2025, the Member States of the European Union have an adequate level of protection, so this transfer does not require specific authorisation.

POK and Google may transfer the data they collect themselves outside Albania, in accordance with their own policies.

• Orders, tickets, payments, refunds and scans, together with the passengers' name, email and phone number

  Legal basisPerformance of a contract and statutory accounting duties
  Kept for10 years after the close of the accounting period (Law no. 25/2018, Article 8)

• Customer summary

  Legal basisLegitimate interest: customer service
  Kept forFor as long as the customer's orders are kept

• Unpaid orders

  Legal basisSteps prior to entering into a contract
  Kept forAutomatically deleted 5–10 minutes after expiry, when no payment is in progress

• IP address and browser in the order, in cancellation requests and in the list of visits

  Legal basisLegitimate interest: fraud prevention and security
  Kept for90 days, then automatically deleted

• Copies of emails in the sending queue, including transfer requests and contact messages

  Legal basisPerformance of a contract; steps prior to entering into a contract; legitimate interest
  Kept for30 days after sending, or 30 days after creation if it cannot be sent

• Requests and messages in the office mailbox

  Legal basisSteps prior to entering into a contract; legitimate interest
  Kept forFor as long as the communication lasts; if a contract is concluded, for the same period as the accounting records

• Application error log

  Legal basisLegitimate interest: security and maintenance
  Kept for30 days

• Server system log

  Legal basisLegitimate interest: security and maintenance
  Kept forUp to 90 days

• Web server request log (IP, page, browser, time)

  Legal basisLegitimate interest: security
  Kept forUp to 53 days

• Anti-abuse counters by IP address

  Legal basisLegitimate interest: security
  Kept forDeleted about 24 hours after the limit expires

• IP addresses blocked for attacks on the website

  Legal basisLegitimate interest: security
  Kept forFor as long as the block lasts and up to 90 days afterwards

• Database backups

  Legal basisLegitimate interest: continuity of the service
  Kept forUp to 7 days; deleted data also disappears from the backups within this period

• Visit statistics

  Legal basisLegitimate interest; they contain no personal data
  Kept forAs total counts, with no time limit

We do not take decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you, and we do not carry out profiling.

For security, the system automatically limits the number of orders and card attempts from the same IP address, as well as the number of card attempts for the same order; once the limit is reached, card payment is temporarily closed for that order or that address. POK and your bank may decline a payment based on their own checks. If you believe you have been blocked in error, write to us and the office will review the case.

We do not collect passengers' age or date of birth. When you buy a ticket for a minor, you provide us with their data, as the parent, guardian or adult buying on their behalf. You may use your own email for their ticket.

Under Law no. 124/2024, you have the following rights:

• Information: to know how your data is processed, as explained on this page.
• Access: to obtain a copy of your data. The first copy is free of charge.
• Rectification: to rectify inaccurate or incomplete data.
• Erasure: to request the erasure of data when there is no longer a legal reason to keep it.
• Restriction of processing: to request that the data be stored but not used, e.g. while its accuracy is being examined.
• Data portability: to receive the data you have provided to us in a commonly used electronic format or, where technically feasible, to have us send it directly to another controller.
• Automated individual decision-making: not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.
• Withdrawal of consent: where processing is based on your consent, to withdraw it at any time, without affecting processing carried out before the withdrawal.

Right to object. When we process data on the basis of legitimate interest (security, fraud prevention, statistics, the customer summary, replying to messages), you may object at any time on grounds relating to your particular situation. We stop the processing unless we have compelling legitimate grounds which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. We do not use your data for direct marketing.

How to exercise them. Write to info@luna.al. To protect your data, we may ask you to write from the order email or to provide the order code. We respond free of charge within 30 days. When a request is complex or we have many requests, this period may be extended to up to 60 days, and we will inform you of this, with the reasons, within the first 30 days.

When you request erasure, order data that accounting law requires us to keep is not erased before the 10-year period expires. Until then, we keep it only for this obligation and do not use it for anything else.

Complaints. You have the right to lodge a complaint, free of charge, with the Commissioner for the Right to Information and Personal Data Protection: Rr. “Abdi Toptani”, Nd. 5, 1001 Tiranë; tel. +355 42 23 7200; toll-free line 0800 2050; info@idp.al; idp.al. You may also apply to the court. If you are located in the European Union, you may also lodge a complaint with the data protection authority in your country.

The connection to the site is encrypted. The ticket QR code carries a cryptographic signature that the server verifies at every scan, so the ticket cannot be forged.

If a personal data breach occurs that puts your rights at risk, we notify the Commissioner within 72 hours of becoming aware of it, as required by Article 29 of Law no. 124/2024, and we notify you when the law requires it.

When the way we process data changes, we update this page and the date at the top of it. The version published here is the one in force.