Applies to website and mobile users, passengers, account holders, guest bookers, partner contacts, and support correspondents.
Controller and contact
ShowMeBus is the controller for marketplace accounts, searches, booking administration, support, fraud prevention, and platform operations. For data used by a transport operator to perform a journey, that operator may act as a separate controller. Privacy questions and rights requests can be sent to [email protected] or the address in our Legal Notice.
Data we collect
We process account and contact data; passenger names and journey details; bookings, tickets, QR and check-in events; payment status and limited provider references; support messages; device, security, language, and session information; operator and partner contacts; and records required to investigate incidents, refunds, or legal claims. We do not store full payment card numbers or CVV codes.
Sources of data
Data comes from you, a person booking on your behalf, transport operators, payment providers, our security and support systems, and—where relevant to migrated booking history—the former ShowMeBus service. If you provide another passenger’s data, you must be authorised to do so and tell them how to access this Policy.
Purposes and legal bases
We use data to provide accounts, quotes, bookings, payments, tickets, journey support, refunds, and security; to comply with tax, accounting, transport, sanctions, and lawful authority requests; and to pursue legitimate interests in preventing fraud, improving reliability, resolving disputes, and measuring service performance. Where optional cookies or direct marketing require consent, that consent is requested separately and can be withdrawn.
Who receives data
Necessary information may be shared with the selected transport operator, station or check-in personnel, payment and wallet providers, hosting and communications suppliers, professional advisers, insurers, public authorities where legally required, and a buyer or successor during a properly controlled business transaction. Suppliers may use data only for contracted purposes and appropriate safeguards are required.
International transfers
Some providers or operators may process data outside Albania or the country where you live. When required, we use adequacy decisions, contractual safeguards, or another lawful transfer mechanism. You may contact us for information about safeguards relevant to your data.
Retention and security
We retain information only for as long as needed for the purpose collected, active account and booking support, ticket validation, financial and tax records, fraud prevention, disputes, and statutory limitation periods. Retention differs by record type. We use access controls, encryption where appropriate, audit records, backups, token hashing, and payment-provider separation, but no internet service can promise absolute security.
Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection; withdraw consent where processing relies on consent; and complain to the Albanian Information and Data Protection Commissioner or another competent supervisory authority. We may need to verify identity and may retain information where law or a valid legal claim requires it.
Children, automated decisions, and updates
Accounts are not intended for children who cannot lawfully enter a contract. Passenger data for minors must be supplied by an authorised adult. ShowMeBus does not make decisions producing legal or similarly significant effects solely through automated profiling. We will update this Policy when data practices materially change and show the current effective date on this page.