Privacy
What we hold, why we hold it, and how long for. Written from what the system actually does, not from a template.
Who holds it
GOVAN SHPK, NUIS M52006019P, Tirana Business Park, Godina Nr. 7, Rruga e Aeroportit, Vorë, Tiranë, Albania. For anything on this page, write to info@govan.al and a person will answer.
What we hold, and for how long
Your name, email address and phone number
To take the booking, reach you about it, and issue the paperwork.
For as long as you have an account with us, or until you ask us to remove it.
Photographs of your driving licence and passport or ID card
To check that whoever drives the van is allowed to, which our insurer requires.
6 months after the rental ends, then deleted — unless a damage claim or a fine is still open on that rental.
The licence and document numbers you type at check-in
They go on the rental agreement, and are what an insurer or the police need after an accident.
Deleted on the same schedule as the photographs they came from.
Your bookings, what you paid, and the agreement you signed
It is the contract between us, and Albanian tax and accounting law requires us to keep it.
For the retention period Albanian law sets. We cannot delete these on request.
Photographs of the van at pickup and at return
So neither of us has to rely on memory about a scratch. They protect you as much as us.
Kept with the rental record for as long as a claim about it could still be brought.
A checkout you started and did not finish
So the link we email you four hours later brings you back to the same van, dates and price instead of making you start again.
The price is held for 48 hours. 30 days after that, the whole thing — including the name, phone number and email you typed — is deleted.
A record of the emails we sent you
To prove a confirmation went out, and to stop sending to an address that bounces.
24 months.
Your recent searches, while you are signed in
So you can pick up where you left off. Only the last few, and only your own.
Until you delete them, which you can do from your account in one click.
Your identity documents
The photographs of your licence and passport are encrypted before they touch our disk. They are never shown on this website, never sent by WhatsApp, and never attached to an email — not even to you. If you want a copy back, ask us and a person will send it.
We strip the location data your phone puts into a photograph before we store it.
What we do not do
- We do not sell your data, or share it for anybody else's advertising.
- We do not track you across other websites.
- We do not put a tracking pixel in our emails.
- We do not email you offers unless you asked for them.
Your rights
You can get a copy of everything we hold about you, correct it, or ask us to delete it. The first two are immediate from your account.
Deletion is honest rather than instant, and it is worth saying why. We can stop marketing to you the moment you ask, and we do. We cannot delete a rental that has happened: an invoice and a signed agreement have to be kept for the period Albanian tax law sets, and a booking with an open damage claim has to be kept until it closes. Everything not held for those reasons goes, and your name comes off the rest once the retention period ends.
Ask us anything on this list and you get an answer within 30 days, which is the deadline the law sets and the one we hold ourselves to. Most of it is the same day; if a request is genuinely complicated we will tell you that inside the 30 days rather than at the end of them.
If you think we have got something wrong, tell us first — and you can complain to the Albanian Information and Data Protection Commissioner.
Who else sees it
Running a rental business means a handful of other companies handle some of this on our behalf. This is all of them. Anything marked not in use is listed because we intend to use it and would rather tell you before than after.
| Who | What for | Where | Basis |
|---|---|---|---|
| Hetzner Online GmbH Everything the application stores. | The servers this site and its database run on. | Germany (EU) | Contract |
| Google (Gmail SMTP) Name, email address, booking reference and dates. | Delivering booking confirmations, check-in links and receipts. | EU/US (adequacy: EU–US Data Privacy Framework) | Contract |
| Google (Analytics 4 / Tag Manager) Pseudonymous identifiers, pages viewed, funnel events. | Counting which pages lead to a booking. | EU/US (adequacy: EU–US Data Privacy Framework) | Consent — nothing loads until the visitor accepts |
| Stripe Payments Europe, Ltd. — not in use Name, email, amount. Card details go to Stripe directly and never reach GoVan. | Taking the deposit and the balance, and holding the security deposit. | Ireland (EU) | Contract |
| WhatsApp Ireland Ltd (Meta) Whatever the visitor types, and their phone number. | The chat button, when a visitor chooses to use it. | Ireland (EU) | The visitor starts the conversation |
| Fiscalization provider (not yet chosen — ⚑8) — not in use Invoice lines, totals, and the customer’s name and NUIS where they are a business. | Submitting invoices to the Albanian tax authority, as the law requires. | Albania | Legal obligation |
Last updated 7 September 2026.