Privacy Policy

1. Information you provide

Depending on the feature you use, you may provide information such as:

• name and email address;
• booking, traveller and group details;
• messages sent through the contact form;
• account/profile information;
• private-tour requirements that you choose to share.

Please do not send passwords, payment credentials or unnecessary sensitive information through free-text contact fields.

2. Payments

Where PayPal is offered, payment verification is handled through PayPal and our server-side payment integration. Vjosa Experience does not intentionally store your PayPal password or card details. We may retain booking/payment status, transaction references, gross amount, fees and seller net where needed for accounting and reconciliation.

3. Sessions and security

The site uses first-party session identifiers and a first-party random device identifier to protect account and booking flows. Server-side systems may also record security information such as IP address, user-agent, request path, rate-limit activity, failed authentication attempts and suspicious request patterns.

We do not intentionally record raw keystrokes, message contents for behavioural profiling, mouse coordinates or full browser interaction histories for security analytics.

Security records may be retained longer when required to investigate abuse, protect accounts, comply with legal obligations or preserve evidence under a legal hold.

4. Security monitoring

Defensive monitoring may identify signals such as request flooding, repeated authentication failures, suspicious input patterns, browser security-policy violations and access attempts against privileged areas. These signals are used to protect the service, investigate incidents and improve security controls.

We do not claim to detect harmless use of browser developer tools. Monitoring focuses on actions and requests that actually interact with the website or its systems.

5. Essential storage and optional analytics

Essential first-party storage may be used for sessions, account state, security and interface preferences. Customer authentication uses a server-set HttpOnly session cookie, so browser JavaScript cannot read the customer session identifier. A separate first-party CSRF token cookie is readable by the browser only so same-origin state-changing requests can prove they came from this site. These functions can operate without optional analytics.

Optional analytics is loaded only after you choose “Accept & Continue” in the homepage privacy/storage prompt. If you decline, the optional analytics script is not loaded by the homepage.

You can change or withdraw your analytics choice at any time using the Manage privacy settings control on this page. When analytics consent is withdrawn, the site records the new choice, removes known first-party analytics storage where possible, and reloads the page so optional analytics code is no longer active.

6. How information is used

• to provide tours, bookings, accounts and private-tour planning;
• to answer contact requests;
• to operate group-formation and notification features;
• to process and reconcile supported payments;
• to prevent abuse, investigate security incidents and protect the service;
• to comply with accounting, legal and operational requirements.

7. Service providers

The website relies on service providers needed to operate the platform, which may include hosting, database/authentication infrastructure, email delivery, mapping/content delivery and payment providers. Information is shared with providers only as needed for the relevant service.

8. Retention

Different records have different retention needs. Booking/accounting information may need to be retained for operational or legal reasons. Security data may be retained according to security policy and longer when an incident is under investigation or legal hold. Data that is no longer needed should be deleted or anonymized according to the applicable retention process.

9. Your requests

You can contact us to ask about the personal information associated with your account or booking and to request correction or deletion where applicable. Some records may need to be retained when required by law, accounting rules, fraud prevention, dispute handling or security obligations.

10. Contact

Privacy questions can be sent to hello@vjosaexperience.com.