Privacy Policy

1. Who is responsible for your data

Natë Society (“we”, “us”), the independent promoter behind this website, decides why and how your personal data is used and is the “controller” of the data described here. Contact: email hello@natesociety.com or WhatsApp +355697926004.

We handle personal data in line with Albanian data-protection law and, where it applies to you, the EU and UK General Data Protection Regulation (GDPR). Venues are separate businesses: once they receive your name and party size for the door, they use it under their own responsibility and their own policies (see section 5).

2. What we collect

When you book

• Identity and contact: full name, phone/WhatsApp number and email address. The email is required: it is where we send your pass and any change to your night.
• Booking details: the event and date, your guest count (men/women), a VIP or table request, and any note you type. Please do not put health details or other sensitive information in the note.
• Consent record: the time you accepted our Terms and this policy.
• Pass and check-in: your pass code and QR code, and when and how you were checked in (door scan, door code or on-site check-in).
• Source label (only if you accepted our banner): a short label of which link or website brought you here (for example “instagram”), kept for 30 days and saved with your booking. It contains no personal data.

Optional location

On the night, if you choose automatic check-in on your pass, your device’s location is used only while that page is open to see whether you are at the venue. It is compared once with the venue’s position and is never stored; we only record that you checked in. You can decline and use the door code or QR scan instead.

Reviews

If you leave a review, the name, origin, rating and text you submit. Reviews are checked before they are published. After your night we may send you a one-time email with a link to leave a review.

Messages you send us

If you write to us on WhatsApp, Instagram or by email, we receive your number or handle, your name if you share it, and what you write.

Using the website

• Technical data: your IP address is used briefly to prevent abuse (rate limiting), and our hosting providers keep standard server logs. Vercel Web Analytics counts visits and page views (page, where you came from, country, device and browser type) and Vercel Speed Insights measures how fast pages load. Both use no cookies, do not follow you across other websites and do not identify you.
• On your device: your language choice, your choice on our banner, and the passes you have booked are saved in your browser (see “Cookies and similar technologies” below), so your pass opens without a signal at the door.
• Analytics (only if you accept): Google Analytics counts visits and shows which pages and channels work. It sets cookies, receives technical data such as an anonymised IP address, and does not receive your name, phone or email. Our own admin and door-scanner pages are never measured.

Photos and videos

We, venues and others photograph and film at events, and we make short reels and stories from clips. If you are identifiable in something we publish, that is personal data (see section 7).

What we do not collect

We do not take payments on this website, so we do not collect card details. We do not collect or copy your ID document; the venue may check it at the door under its own rules. We do not ask for sensitive categories of data.

3. Why we use it, and on what basis

• To run your booking (register you on the guestlist, create your pass and QR code, manage door entry, contact you about it): needed to carry out your booking, at your request.
• To send updates and offers about similar nights, VIP invitations and promotions by email or WhatsApp: based on your consent, given when you book. You can withdraw it at any time (section 6).
• To ask for a review after your night, and to publish reviews you send: our legitimate interest in improving our service and showing honest feedback, and your consent for the review you choose to publish.
• To keep the service safe (prevent fake or automated bookings, protect the systems, block repeated abuse): our legitimate interest in running a secure service.
• To promote nightlife in Tirana with photos and videos, and to keep records of who to invite back: our legitimate interest in promoting our work. We have weighed this against your interests and rights, and you can object (section 8).
• Analytics and the source label: your consent, given through the banner.
• Location check-in: your consent, given when you switch it on.
• To meet legal obligations and to establish, exercise or defend legal claims: legal obligation and legitimate interest.

4. How your data is protected

Personal data is sent over encrypted connections (HTTPS) and stored on a Supabase PostgreSQL database with Row-Level Security switched on, so records cannot be read by the public. Access is limited to authorised administrators who sign in with individual credentials. The “Find my pass” page shows only a masked name and never reveals phone numbers or email addresses.

Door staff use a separate scanner protected by a PIN. To work without a signal, it keeps a short list on the staff member’s phone with only the name, party size and pass status for that night, no phone number or email. That list is wiped when the scanner is locked, and automatically after 20 hours. No system is completely secure. If a breach affecting your data occurs, we will notify you and the authorities as the law requires.

5. Who we share it with

• The venue you book: your name, party size, VIP/table request and pass status, so it can admit you. The venue then acts under its own responsibility.
• Door staff working the night, through the scanner described above.
• Service providers that process data for us and only for running this service: Supabase (database), Vercel (hosting and page-speed measurement), Google (email delivery and, if you accept, Analytics) and Meta (WhatsApp, which we use to receive booking notifications and to reply to messages you send us).
• Authorities and advisers, when the law requires it or to protect our legal rights.
• A successor, if the business is transferred to another owner, who must respect this policy.

We never sell your personal data, and we do not rent it or hand it to advertisers or data brokers.

Some providers may process data outside Albania and the European Economic Area, for example in the United States. Where they do, we rely on the safeguards the law recognises, such as standard contractual clauses or an adequacy decision.

6. Marketing, and how to stop it

When you book, you agree to the Terms and consent to receive updates about your booking and, from time to time, about similar nights, VIP invitations and promotions, by email or WhatsApp. Booking messages (your pass, a change, a reminder) are part of the service.

In practice, we send promotional messages mainly to guests who live in Albania. If you are visiting, we normally only send you messages about your own booking.

You can withdraw your consent to marketing at any time, and it will not affect your existing bookings. Reply STOP to any message, or contact us at email hello@natesociety.com or WhatsApp +355697926004, and we will stop.

7. Photos, videos and content

We publish photos and short videos to show what nightlife in Tirana is like. Some are ours, some come from venues, artists and other creators; how we use those clips, and how the author, the rights holder or the venue can have them credited or removed, is on our Content & Credits page.

That is a matter of copyright and ownership. It is separate from your privacy rights. If you are identifiable in something we publish and you have a concern about your image or personal data, tell us. We will look at it in good faith, weigh it against our legitimate interest in the content, and stop or change the use where the law gives you the right to object.

8. Your rights, and how to use them

Depending on where you live, you can ask us to access, correct or delete your data, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent at any time. You also have the right not to be subject to decisions made only by automated means with legal effect on you; we do not make such decisions.

To use a right, send a simple request to email hello@natesociety.com or WhatsApp +355697926004. We may ask you to confirm it is you (for example by writing from the phone number or email on the booking) before we act. We will respond without undue delay and within one month, and we do not charge a fee unless requests are clearly unfounded or excessive.

You may complain to the data-protection authority. In Albania that is the Information and Data Protection Commissioner. If you live in the EU/EEA or UK, you can also complain to your local authority. We would appreciate the chance to fix things first.

9. How long we keep it

• Booking records (name, phone, email, party details, notes, check-in details) are deleted automatically about 30 days after the event date.
• Your guest contact record (name, phone, email and how many times you have booked) is kept so we can recognise returning guests and, if you have not opted out, invite you to future nights. We keep it for as long as it is useful to us and you have not asked us to delete it, and we clear out records that have had no activity for a long time (around three years). We delete yours sooner if you ask.
• Reviews stay while they are published. You can ask us to remove yours or your name from it.
• Messages you send us are kept as long as needed to deal with them, usually no more than 24 months.
• Analytics and server logs are kept by the providers for a limited period under their settings.
• On your device, your pass stays until you clear your browser data.
• We may keep the minimum needed for longer where the law requires it or to deal with a legal claim.

10. Cookies and similar technologies

• Essential (no consent needed): a small record of your choice on our banner (a first-party cookie, one year, and browser storage), your language choice and your saved passes (browser storage). Staff who sign in to the admin or the door scanner also get a session cookie.
• Only if you accept: the source label (30 days) and Google Analytics cookies (such as _ga).
• Never: advertising or cross-site tracking cookies.

If you choose “Essential only” on the banner, Google Analytics is not loaded and sets nothing. You can clear cookies and site data in your browser at any time.

11. Age

Our events are for adults only. We do not knowingly collect data from anyone under 18.

12. Links to other services

Our pages link to Instagram, WhatsApp, maps, venue websites and ticket sellers. They have their own privacy policies, and we do not control them.

13. Changes to this policy

If we change how we use personal data we will update this page and its date. We will tell you about material changes, especially any change to marketing use, in advance where we can.

14. Contact

Questions about this policy or your data: email hello@natesociety.com or WhatsApp +355697926004.