Privacy Policy

Tad Adventure operates this website at tad-adventure.com and runs guided off-road motorcycle tours, adventure bike training and motorcycle rentals in Kosovo, Albania and Montenegro. We are the data controller for the personal data described in this policy.

• Address: Prishtina, Republic of Kosovo
• Email: hello@tad-adventure.com
• WhatsApp and phone: +383 49 694 461

For anything to do with your data, write to hello@tad-adventure.com. A person reads that inbox, not a ticketing system.

When you send an enquiry. The booking form on this site collects your name, email address, WhatsApp number, preferred dates and the tour you are interested in. The form does not send anything to our servers: it opens WhatsApp with those details written into a message, which you send yourself. From that point the conversation lives in WhatsApp, which is operated by Meta under its own privacy policy.

When you book. Before departure we ask every rider to complete a Rider Information and Liability Waiver, and a Rental Agreement if you are using one of our motorcycles. Between them these collect your date of birth, nationality, passport or ID number, home address, phone and email, emergency contact details, travel and medical insurance provider and policy number, motorcycle licence number and category, riding experience, height and weight for bike sizing, and any medical conditions, allergies or medication we should know about on the trail.

When you pay. Card payments are processed by our bank's secure payment page. Your card number, expiry date and security code are entered on the bank's system, not ours. We never see or store full card details. What we keep is the payment reference, the amount, the currency, the date and whether the payment succeeded, which is what we need for our accounts and for refunds.

When you browse. This site loads Google Tag Manager, which in turn loads analytics and advertising tags including Google Analytics 4, and may load Meta Pixel and Google Ads tags. These record pages viewed, buttons and forms interacted with, approximate location derived from your IP address, device and browser type, and the site or advert that sent you here. Our hosting provider, Vercel, also keeps standard server logs including IP addresses for security and troubleshooting.

Health data. The medical information on the waiver is sensitive personal data. We ask for it only so a guide can respond properly if something happens in the mountains, we share it only with the guide leading your ride and, in an emergency, with medical responders, and we delete it once the retention period below has passed.

• To answer your enquiry and prepare a booking. Basis: steps taken at your request before entering a contract.
• To run the tour, training or rental you booked, including route planning, accommodation, bike allocation and safety. Basis: performance of our contract with you.
• To take payment and issue refunds. Basis: performance of our contract with you.
• To keep accounting and tax records. Basis: our legal obligations in Kosovo.
• To respond to a medical emergency on a ride. Basis: your explicit consent, given on the waiver, and protection of vital interests.
• To defend against a claim arising from an incident on a tour or damage to a motorcycle. Basis: our legitimate interest in establishing and defending legal claims.
• To understand how the website is used and to advertise our tours. Basis: your consent for analytics and advertising cookies, and our legitimate interest in a website that works.

We do not sell personal data, and we do not trade it. We share it only with:

• Our bank and its payment provider, to authorise card payments and process refunds.
• Guides working on your ride, who need your riding experience, bike sizing and emergency and medical details.
• Accommodation, transport and local partners on multi-day tours, who need your name and the dates you are staying.
• Emergency services, doctors and hospitals, if you are injured on a ride.
• Technology providers that run this site and our messaging: Vercel for hosting, Google for Tag Manager and Analytics, Meta for WhatsApp and any advertising pixels.
• Our accountant, insurers and lawyers, where a booking or an incident requires it.
• Public authorities, where the law requires us to hand something over.

Some of these providers are based outside Kosovo, mainly in the European Union and the United States, so your data may be transferred there. We use providers that commit to recognised safeguards, such as the European Commission's standard contractual clauses, for those transfers.

• Enquiries that do not turn into a booking: up to 12 months from your last message, in case you come back to us.
• Booking, payment and accounting records: six years from the end of the financial year, as required by Kosovo tax rules.
• Signed waivers and rental agreements: three years after the ride, which covers the period in which a claim can be brought, and longer only if a claim is actually open.
• Medical details on a waiver: deleted once the tour is over and the waiver is archived, unless an incident occurred on that ride.
• Analytics data: retained according to the settings in Google Analytics, currently 14 months.

Cookies and similar identifiers are set by Google Tag Manager and the tags it loads, and are used to measure how the site is used and to measure the performance of our advertising. They are not needed for the site to work, and you can block or delete them in your browser settings at any time. Blocking them does not affect your ability to enquire, book or ride with us.

You can opt out of Google Analytics across all sites using Google's browser add-on, and you can adjust advert personalisation in your Google and Meta account settings.

The whole site is served over HTTPS and sends a strict transport security header, so browsers are told to use an encrypted connection on every future visit. Card details are handled entirely on the bank's payment page, which uses 3-D Secure authentication, and never touch our systems. Booking documents and waivers are held in access-controlled storage, and only the people running your ride can open them.

No system is perfectly secure. If a breach ever affects your data and creates a real risk to you, we will tell you and the supervisory authority as the law requires.

Under Kosovo's Law No. 06/L-082 on Protection of Personal Data, and under the GDPR where it applies to you as a visitor from the European Union, you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong or out of date;
• delete data we no longer have a reason to keep;
• restrict how we use it while a dispute about it is resolved;
• send your data to you or another provider in a portable format;
• stop processing based on our legitimate interests, including any marketing;
• withdraw a consent you gave, without affecting what we did before you withdrew it.

Write to hello@tad-adventure.com and we will respond within 30 days. There is no charge. If you think we have handled your data badly, you can complain to the Information and Privacy Agency of the Republic of Kosovo, or to the data protection authority in your own country if you are in the European Union.

Our tours, training and rentals are for adults. We do not knowingly collect data from anyone under 18. Riders under 18 can only take part with a parent or guardian who signs the waiver on their behalf, and in that case we collect the guardian's details too.

If we change how we handle personal data, we will update this page and change the date at the top. If the change is significant and affects a booking you already have with us, we will tell you directly.

The terms that govern bookings and payments are set out separately in our Terms of Use.