Last updated: 14 October 2026
1. Who we are
Supharwee Thai Massage (“we”, “us”) is a Thai massage studio in Tirana, Albania. We operate the website https://thaimassagetirana.al and are the controller of the personal data described in this policy.
This policy explains what personal data we collect, why, on what legal basis, how long we keep it and how you can exercise your rights. It applies to website visitors, people who contact us, clients and people who buy or receive gift cards.
- Location: Tirana, Albania (see on Google Maps)
- Phone / WhatsApp: +355 69 600 5657
2. Legal framework
We process personal data in accordance with Albanian Law No. 124/2024 “On the Protection of Personal Data”, which is aligned with the EU General Data Protection Regulation (GDPR), and with the guidance of the Albanian Commissioner for the Right to Information and Personal Data Protection.
We follow the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.
3. What data we collect
| Category | What it includes | How we get it |
|---|---|---|
| Bookings | Name, phone number, date and time, treatment chosen, number of people, preferences such as therapist or pressure | When you book with us, mainly through WhatsApp or by phone |
| Health information | Information relevant to your treatment, such as injuries, pain, medical conditions, allergies to oils, or pregnancy | Only if you choose to tell us, before or during your treatment |
| Gift cards and packages | Name and contact details of the buyer, name of the recipient, the card or package bought, payment and redemption | When you order a gift card, couples massage, hotel and massage package or spa treatment |
| Payments | Amount, payment method, receipt | When you pay for a treatment or gift card |
| Technical data | IP address, browser and device type, date and time of visit, pages visited | Automatically, from our web server |
Health information is a special category of personal data. We use it only so our therapists can adapt or, if necessary, decline a treatment for your safety, and only with your explicit consent, which you give by sharing it with us.
4. Why we use your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Managing bookings and providing treatments | Performance of a contract with you |
| Adapting treatments to your health and safety | Your explicit consent |
| Selling and redeeming gift cards and packages | Performance of a contract |
| Payments, receipts, accounting and tax | Legal obligation |
| Answering your questions | Our legitimate interest in replying to clients |
| Running and securing the website | Our legitimate interest in a working and secure website |
We do not sell your data, we do not send marketing messages without your consent, we do not use analytics or advertising tracking tools, and we do not make automated decisions that have legal effects on you.
5. WhatsApp
All “Book” and “I want this card” buttons on our website open a chat with us on WhatsApp, a service of Meta Platforms Ireland Ltd. Your conversation takes place on WhatsApp under WhatsApp’s privacy policy. We recommend that you share detailed health information in person at the studio rather than in a message.
6. Cookies and third-party content
Our website uses only cookies that are necessary for it to work and to keep it secure. We do not use analytics, advertising or tracking cookies.
- Google Fonts – fonts may be loaded from Google’s servers, which receive your IP address.
- Google Maps, Facebook and Instagram – our location and social media links are simple links. Google or Meta receive data only if you click them.
You can block or delete cookies at any time in your browser settings.
7. Who we share data with
- Our therapists – only the information needed for your treatment.
- Partner hotels – for hotel and massage packages, only the data needed to arrange your stay and treatment.
- Meta (WhatsApp) – as described in section 5.
- Technical providers – our website hosting provider and our web developer Park Studios for website maintenance. They act only on our instructions.
- Accountants and public authorities – when the law requires it.
8. International transfers
Some technical providers, such as Meta and Google, may process data outside Albania, including in the European Union and the United States. Such transfers take place only to countries with an adequate level of protection or with appropriate safeguards such as standard contractual clauses, as required by Law No. 124/2024.
9. How long we keep your data
| Data | Retention period |
|---|---|
| Booking details | 6 months after the appointment |
| Health information | Only for as long as needed for your treatments; deleted on request or after 1 year without a visit |
| Gift card records | Until the card is used or expires, and as long as required for accounting |
| Receipts and accounting records | 10 years, as required by Albanian accounting law |
| Website server logs | 6 months |
After these periods, data is securely deleted or anonymised.
10. Security
We use appropriate measures to protect your data, including restricted access to client information, confidentiality obligations for staff and an encrypted connection (HTTPS) on our website. If a data breach is likely to put your rights at risk, we will notify the Commissioner within 72 hours and, where the risk is high, inform you without undue delay.
11. Your rights
Under Law No. 124/2024 you have the right to:
- access your personal data and receive a copy;
- correct inaccurate or incomplete data;
- erasure, where we no longer need the data and are not legally required to keep it;
- restrict processing in certain cases;
- object to processing based on our legitimate interests;
- data portability for data you gave us under a contract or consent;
- withdraw consent at any time, without affecting earlier processing.
To exercise your rights, contact us by WhatsApp or phone at +355 69 600 5657 or in person at the studio. We may ask you to confirm your identity. It is free of charge and we will reply within 30 days.
12. Minors
Our services are intended for adults. Treatments for persons under 18 are provided only with the consent and, where appropriate, presence of a parent or guardian.
13. Complaints and changes
If you believe your data is processed unlawfully, please contact us first so we can resolve it. You also have the right to lodge a complaint with the Albanian supervisory authority:
- Commissioner for the Right to Information and Personal Data Protection
- Address: Rr. “Abdi Toptani”, Nd. 5, Tirana, Albania
- Website: www.idp.al
- Email: info@idp.al
We may update this policy when the law or our practices change. The current version is always published on this page with the date of the last update at the top.