Last updated: 14 October 2026
1. Who we are
Alar Food & Catering (“AlAr”, “we”, “us”) runs the AlAr Fast Casual Restaurant in Tirana and provides food ordering, delivery and catering services. For the personal data processed through this website (al-ar.al) and our services, we are the controller.
- Address: Rruga Abdyl Frashëri, Tirana, Albania
- Phone: +355 68 666 6777
2. Legal framework
We process personal data in line with Law No. 124/2024 “On the protection of personal data” of the Republic of Albania and the guidance of the Information and Data Protection Commissioner. This policy explains what data we collect, why we collect it, how long we keep it and what rights you have.
3. What data we collect
| Category | What it includes | How we get it |
|---|---|---|
| Contact and order data | Name, phone number, delivery address, the items you order, notes on your order | When you call or message us to order, or contact us |
| Catering enquiries | Name, phone, email, company (if any), event date, location, number of guests, menu preferences | When you ask us about catering for an event |
| Dietary and allergy information | Allergies or dietary needs you choose to tell us (e.g. gluten-free, vegetarian) | Only if you tell us, so we can prepare your food safely |
| Account data | Username, email address, password (stored encrypted), wishlist | When you create an account on the website |
| Newsletter data | Email address | When you subscribe to our weekly promotions |
| Technical data | IP address, browser and device type, pages visited, date and time of visit | Automatically, through server logs and cookies |
4. Why we use your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Taking, preparing and delivering your order | Performance of a contract |
| Preparing quotes and organising catering events | Steps before a contract / performance of a contract |
| Taking account of allergies or dietary needs you tell us about | Your explicit consent |
| Managing your website account and wishlist | Performance of a contract |
| Sending the weekly newsletter and promotions | Your consent, which you can withdraw at any time |
| Issuing invoices and keeping accounting records | Legal obligation |
| Keeping the website secure and working properly | Legitimate interest |
| Statistics on how the website is used (cookies via Google Tag Manager) | Your consent |
5. Cookies and third-party services
Our website uses necessary cookies so that it works correctly (for example, to keep you logged in, remember your cart and wishlist, and keep the site secure). These cookies do not need your consent.
With your consent, we may also use statistics cookies. You can accept or reject them through the cookie banner and change your choice at any time.
The website also uses these third-party services:
- Google Tag Manager (Google Ireland Ltd.): a tool that loads other website scripts. Statistics or marketing tags loaded through it run only after you give consent.
- Google Maps (Google Ireland Ltd.): shows our location. When the map loads, Google may receive your IP address.
- Facebook, Instagram (Meta Platforms Ireland Ltd.) and Tripadvisor: our pages there are linked from the website. Those platforms process your data under their own privacy policies only when you click through to them.
6. Who we share your data with
We do not sell your personal data. We share it only when needed with:
- our staff and delivery staff, so they can prepare and deliver your order;
- our website hosting and IT providers;
- our accountants and the tax authorities, as required by law;
- courts, the police or other authorities, when the law requires us to.
7. International transfers
Some of the providers listed above (such as Google and Meta) may process data outside Albania, including in the European Union and the United States. In those cases, the transfer is protected by appropriate safeguards, such as European Commission adequacy decisions (including the EU–US Data Privacy Framework) or standard contractual clauses.
8. How long we keep your data
| Data | Retention period |
|---|---|
| Order and delivery details | Up to 3 months after the order, unless needed for a complaint |
| Allergy and dietary information | Only until your order or event is completed |
| Catering enquiries that do not lead to a booking | 1 year |
| Invoices and accounting records | 10 years, as required by law |
| Website account | Until you delete the account, or after 2 years of inactivity |
| Newsletter email | Until you unsubscribe |
| Server logs | 6 months |
9. Security
We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), encrypted passwords and access only for authorised staff. If a data breach is likely to put your rights at risk, we will notify the Commissioner within 72 hours and inform you when the law requires it.
10. Your rights
Under Law No. 124/2024 you have the right to:
- access the data we hold about you;
- have inaccurate data corrected;
- have your data deleted, where there is no legal reason for us to keep it;
- restrict or object to processing;
- receive your data in a portable format;
- withdraw your consent at any time, without affecting earlier processing;
- unsubscribe from the newsletter using the link in each email.
To use any of these rights, call us at +355 68 666 6777 or visit us at the restaurant. We will reply within 30 days.
11. Children
Our website is not aimed at children under 16. We do not knowingly collect data from children. If you think a child has given us data, contact us and we will delete it.
12. Complaints and changes
If you think we have not handled your data correctly, you can complain to the Information and Data Protection Commissioner: Rr. “Abdi Toptani”, Nd. 5, Tirana; www.idp.al; info@idp.al.
We may update this policy. The current version is always published on this page, with its date at the top.