Last updated: 09 Nov 2026
This policy explains which personal data Perfito collects, why, who sees it, how long it is kept and how you exercise your rights. It covers customers who hold cards and business users.
For customer data inside a business’s programme the business is the controller and Perfito sh.p.k processes it on its behalf (see “Data processing”). For the customer’s portal account, business accounts and platform security the controller is Perfito sh.p.k.
For any request about your data write to [email protected].
Your phone number (to find your card and send your sign-in code); first and last name; email; birthday (for the birthday gift) and gender, when you give them at sign-up.
Card history: every stamp, point, reward and correction with date, time, business location and staff member. The device a card was added to in Apple or Google Wallet (a technical identifier, not your number).
Technical data for security: IP address and time of sign-ins, codes sent and whether they were used.
Business name, tax ID and address when given, the owner’s and staff’s names and emails, billing details and dashboard actions (audit log).
To keep your card and balance right; to send your sign-in code; to update your card in Apple and Google Wallet; to send messages you agreed to; for security, fraud prevention and complaints; for billing businesses and legal obligations.
Legal bases: performing the service you asked for (card and account), your consent (promotional messages and birthday gift), legitimate interest in security, and legal obligations such as accounting.
Each business sees only its own customers and cards; businesses never see each other’s customers. The platform administrator may see data for support, security and troubleshooting, and every such access is logged.
We do not sell your data or share it for advertising.
Server hosting; WhatsApp and SMS delivery; email delivery; Apple (Apple Wallet) and Google (Google Wallet), which receive what is shown on the card (name, balance, QR code) when you add it to your phone. Each processes data only for the service it provides us.
Some of them may process data outside Albania; in that case we require equivalent protection as the law provides.
While you have an active card or account. After an account is deleted or a business closes, personal data is deleted or anonymised within 30 days. Transaction history is kept only in anonymous form for statistics and accounting. Backups are deleted automatically after 14 days.
You may ask for access, correction, deletion, restriction, portability and object to processing. You can withdraw consent to messages at any time.
Most of this you can do yourself from your portal profile (edit details, delete the account, unsubscribe). For the rest write to [email protected]; we reply within 30 days.
If you think your data is not handled properly you may complain to the Commissioner for the Right to Information and Personal Data Protection.
Connections are encrypted (HTTPS). Sign-in codes are stored hashed and expire after 5 minutes. Passwords are never stored readable. Every business’s data is separated from the others and important actions are logged.
The service is not aimed at children under 16. If we learn we hold a child’s data without a parent’s consent we delete it.
When we change this policy in an important way we tell you in the portal or by message. The last update date is shown at the top of the page.
Questions about this document go to [email protected].
Apple, Apple Wallet and iPhone are trademarks of Apple Inc., registered in the U.S. and other countries. Google Wallet and Android are trademarks of Google LLC.