Last updated: 09 Nov 2026
This agreement applies when a business uses Perfito for its customers. For programme customer data the business is the controller and Perfito sh.p.k is the processor.
We process customer contact details and card transactions only to run the programme the business configured, and only on its instructions given through the dashboard or the API.
We keep the data confidential and use it only for the service; our staff access it only when needed for support or security; we notify the business without delay (within 72 hours) of a security breach affecting its data; we help it answer its customers’ rights requests.
The business makes sure it has a legal basis for the data it collects and that messages go only to people who agreed; informs its customers about the processing; and uploads no data the programme does not need.
Hosting, message delivery (WhatsApp, SMS, email) and wallet providers (Apple, Google). The current list is available on request and changes are announced before they take effect; the business may object to a new sub-processor.
Encryption in transit, hashed codes and tokens, separation of data between businesses, an audit log of every administrative action, nightly backups and full backups on the administrator’s request.
The business can export its customers and history as CSV at any time. On request, or within 30 days of closing the account, customer data is deleted and the history anonymised.
Questions about this document go to [email protected].
Apple, Apple Wallet and iPhone are trademarks of Apple Inc., registered in the U.S. and other countries. Google Wallet and Android are trademarks of Google LLC.