PRIVACY POLICY

HAPPY Shpk

Adress: Rr. Tish Daija, Kompleksi KIKA 2, Pallati Nr.2, 1060, Tiranë, Shqipëri

NUIS: M02219018E

Phone number: +35544803999

E-mail: loyalty@happy.al

WhatsApp 0684076096

Contact Details of the Data Protection Officer: dpo@happy.al

HAPPY Shpk, within the scope of its activities and processing operations, acts as a “Controller” for the Loyalty Program and as a “Processor” when providing services to other companies that are considered its clients under the relevant agreement.

Personal data are collected directly from the data subject during registration, use of the application, interaction with the Loyalty Program, or through business partners when identifying a member for the purpose of awarding loyalty points.

In its capacity as a Controller, HAPPY Shpk collects and processes the following categories of personal data:

a) Within the framework of the Loyalty Program, for Happy members, at the time of registration, we collect and process, based on the data subject’s consent (after providing prior information in accordance with the applicable registration method), two categories of personal data. Optional data are not required for registration, and membership in Happy is not affected by whether or not the data subject chooses to provide such information.

Personal data required for registration in the Program
Optional (if the data subject chooses to provide it)

Name Surname
E-mail
Gender
Address
Phone number
Child's date of birth
Town
-
Date of Birth
-

The data are collected through the website www.happy.al and through the HAPPY application.

Processing of personal data of interested individuals/visitors through the website. Through the website's “Contact Us” section, which enables interested individuals and visitors to obtain information regarding Happy membership procedures and services, we collect the following personal data:

Full name
Email address
Telephone number
Address
Message content

Step Data: If the Customer provides their explicit consent, the Happy application may connect to an authorized physical activity tracking application that counts steps (e.g., Google Fit, Apple Health) in order to access and process data relating to the number of daily and/or monthly steps. The Company applies the principle of data minimization and does not retain detailed historical records of such physical activity data. This information is used solely to verify whether the user has reached the step thresholds required to earn reward points. The data are retained only for the relevant monthly period, to the extent necessary to fulfill this purpose, and are automatically deleted upon its completion.

These data are accessed only when the Customer personally activates the step-counting feature within the application.

Your data will be processed in accordance with this Privacy Policy and applicable legislation, ensuring confidentiality and security. We do not sell personal or sensitive data to third parties. Step data will be displayed within the application and obtained from the step-counting application only with your consent. Such data will not be stored or used for any purpose other than rewarding customers for achieving their monthly goals.

Consent for access to step data may be withdrawn (disabled) at any time through the application settings or by disconnecting the relevant tracking application.

During the administration and operation of the Happy Loyalty Program, we process your personal data in accordance with Part II, Chapter I of Law No. 124/2024 “On Personal Data Protection”, as well as the terms and conditions of the Loyalty Program, applying the principles of lawfulness, accountability, transparency, confidentiality, accuracy, data minimization, storage limitation, proportionality, and security.

Based on your consent, we process your membership data in accordance with Article 7(1)(a) of Law No. 124, dated 19.12.2024, “On Personal Data Protection.” Within this framework, members may be contacted through telephone calls, SMS, WhatsApp, Viber, email, and other communication channels.

The purposes for which we process members’ personal data are in accordance with applicable legal requirements and depend on the nature of the interaction with Happy Shpk.

(i) Registration in the Happy Loyalty Program. When registering for the Happy Loyalty Program, you provide the data necessary for the identification of the individual. Your personal data are processed only where the data subject has provided explicit consent.

(ii) Use of the Happy Application When you use the Happy application, we rely on your consent for the processing of your personal data and, where applicable, on the necessity of processing for limited purposes related to the performance of the contract concluded with you (for example, purchases made through the application). For the administration of your account and loyalty points, your personal data are necessary for the following purposes:

Communication, this includes notifications regarding new products or services, changes thereto, general offers relating to benefits, redemption of loyalty points accumulated by the members, and similar communications. Promotional communications and direct marketing messages are sent only where the data subject has provided explicit consent. Such consent may be withdrawn at any time without affecting the use of Happy Shpk’s products and services.

Personalized Special Offers. To provide personalized special offers that are exclusively available to the member as additional benefits associated with cardholder privileges, in accordance with their preferences.

Complaint Handling. To receive, manage, and respond to complaints and inquiries submitted by members.

Service Improvement. To analyze and improve our products, services, and user experience.

Personalized Benefits. Data such as Gender, Address, City, Date of Birth, and Child’s Date of Birth are processed for the purpose of providing personalized benefits, offers, and rewards.

Step Data. Step data are processed for the purpose of monitoring daily physical activity and awarding loyalty points based on the number of steps achieved.

Consent for the processing of step data may be withdrawn at any time, and such withdrawal will not affect the use of Happy Shpk’s products and services.

(iii) Purchases from Our Partners When you purchase products from our Partners, personal data are necessary to enable us to fulfil the contract concluded with you. During purchases, you use your Happy Card, through which information relating to the transaction amount and the merchant is recorded. This information is necessary to credit loyalty points to your Happy Card in accordance with your purchase/order.

(iv) Visits to Our Website When you visit our website, you receive information about our products and services. We collect only the minimum technical data necessary for the operation and security of the website. Our website does not use cookies for marketing or user profiling purposes. If you submit a request or complaint through our website, we process the data that you voluntarily provide during the communication. However, we ask and encourage you not to submit unnecessary personal data or special categories of personal data that are not required for handling your concern. For this purpose, we only require data such as your full name, email address, telephone number, and the content of your request or complaint. The legal basis for this processing is our legitimate interest in managing customer requests and complaints, as well as compliance with our legal obligations under applicable legislation and the legal requirement to address your inquiry.

The legal bases for processing personal data are:

a) Performance of a Contract. Processing is necessary for establishing and maintaining a relationship with customers (Article 6(1)(b) GDPR; Article 7(1)(a) and (b) of Law No. 124/2024 “On Personal Data Protection” of Albania).

b) Legal Obligation Processing is necessary for compliance with applicable legal requirements relating to the implementation of the agreement (Article 6(1)(c) GDPR; Article 7(1)(c) of Law No. 124/2024 “On Personal Data Protection” of Albania).

c) Legitimate Interest. Processing is necessary for the establishment, exercise, or defense of legal claims, where required (Article 6(1)(f) GDPR; Article 7(1)(dh) of Law No. 124/2024 “On Personal Data Protection” of Albania).

Data Retention Periods. The retention period of personal data also depends on the manner in which you interact with Happy Shpk. Upon expiration of the applicable retention period, personal data are securely deleted or anonymized.

Loyalty Program Members. The Company maintains and processes your personal data for as long as your membership card/account remains active. Following five (5) years from the deactivation of the Happy card/account or the last purchase made, the data are automatically deleted from the database. Inactivity for a continuous period of five years results in the complete deletion of the customer's data.

Website Visitor Technical Data. Technical data relating to website visitors are retained for a maximum period of six (6) months from the date of collection, for security purposes, system administration, and protection against unauthorized access or interference.

Requests and Complaints. Personal data submitted by users in connection with requests or complaints are retained for the purpose of handling and administering the relevant request and, in any event, for no longer than three (3) years following the conclusion of the communication, unless applicable legislation requires a longer retention period.

Your personal data are stored electronically on the Company's servers located in the Republic of Albania, as well as on the servers of Inteliqua in Greece, a Member State of the European Union. Both we and Inteliqua have implemented appropriate technical and organizational measures to ensure the security of your personal data and to prevent accidental loss, unauthorized access, use, alteration, or disclosure. These measures include, among others, data encryption, restricted access controls based on the need-to-know principle, and secure data backup procedures.
Access to personal data is restricted solely to authorized employees of Happy and Inteliqua, and only to the extent necessary for the provision of the contracted services. All individuals with access to personal data are required to maintain confidentiality and to process personal data in accordance with Albanian personal data protection legislation, the GDPR (where applicable), and the relevant contractual arrangements between the parties governing the controller–processor relationship.
In addition, the Company's internal policies and procedures relating to personal data protection and information security are implemented and enforced.

Data security is essential for protecting information and personal data, maintaining integrity, and ensuring compliance with legal and ethical standards. Our Company conducts its activities in accordance with the applicable personal data protection legislation and has established the necessary policies and systems for this purpose.

We have implemented strict technical and organizational measures to reduce the risk of personal data breaches, loss, unauthorized access, or misuse. These measures include, among others, access controls, encryption, role-based access restrictions, system monitoring, and security mechanisms designed to protect personal data during processing and transmission.
Within the framework of our cooperation with the service provider INTELIQUA, privacy and personal data protection are ensured through the implementation of appropriate technical and organizational measures by both parties, including data pseudonymization, the use of secure communication channels, and access restrictions limited to authorized personnel. In addition, where required by applicable legislation, your informed consent is obtained before the collection and processing of personal data.
Personal information will not be disclosed to third parties except as provided in this Privacy Policy or where disclosure is required by applicable law. Individuals enjoy the rights arising from personal data protection legislation, including the rights of access, rectification, restriction of processing, and erasure of personal data, subject to the conditions established by law.

To protect personal data and preserve the integrity of our processing activities, we implement the following measures:

• Data Storage: We use encrypted storage solutions and databases with restricted access to protect personal data.
• Access Control: We implement strict access controls to limit access to personal data, ensuring that only authorized personnel may view, access, modify, or delete specific information or data.
• Secure Communication Channels: We use secure channels for the exchange and communication of information, including encrypted email services, to prevent unauthorized interception of data.
• Physical Security: The equipment and facilities where personal data are stored are located within secure environments with restricted physical access (e.g., locked rooms).
• Technical Security Measures: We use firewalls, strong passwords, antivirus software, and other security measures, including encryption and pseudonymization, to safeguard personal data.
• Data Retention Policy: We have adopted rules governing data retention periods and secure disposal procedures to mitigate the risk of unauthorized access to outdated or unnecessary data once their retention period has expired.
• Data Security Training: Before assuming their responsibilities, relevant personnel receive training and, where applicable, certification in the field of data protection. Staff are regularly updated on our data security standards, policies, data management practices, and security protocols.

Pursuant to Articles 12–20 of Law No. 124, dated 19.12.2024, “On Personal Data Protection”, you enjoy a number of rights regarding your personal data and may request additional information at any time concerning the processing of your personal data.
In accordance with Law No. 124, dated 19.12.2024, “On Personal Data Protection”, in relation to the personal data processed by HAPPY Shpk, you have the following rights:

• Right to Information: Happy is required to inform data subjects about the processing of their personal data, including the purpose of processing, legal basis, retention period, recipients, their rights, and any automated decision-making or international data transfers. This information is provided before the processing begins or within the timeframes established by law.
• Right of Access: You have the right to request, at any time, confirmation as to whether personal data relating to you are being processed by HAPPY Shpk and to obtain access to such data, together with information regarding the purposes of processing, retention periods, legal basis, categories of personal data processed, and categories of recipients.
• Right to Request Restriction, Rectification, or Erasure: If you become aware that your personal data are inaccurate, incomplete, outdated, or have been collected and processed in violation of the law, you have the right to request the rectification or deletion of such personal data and the immediate restriction or cessation of processing, where applicable.

• Right to be Forgotten: You have the right to request that Happy erase your personal data and notify other relevant parties accordingly. You may also request the removal of outdated information from search engine results where such information may adversely affect your reputation, in accordance with applicable law.
• Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to decisions producing legal effects concerning you, or similarly significantly affecting you, where such decisions are based solely on automated processing of personal data.

• Right to Object: Under certain circumstances, you have the right to object to the processing of your personal data for specific purposes, in accordance with Article 19 of Law No. 124, dated 19.12.2024, “On Personal Data Protection”.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to request the direct transfer of your personal data from Happy Shpk to another controller, where technically feasible and legally applicable.
• Right to Lodge a Complaint: If you believe that your rights, freedoms, or legitimate interests regarding your personal data have been violated, you may submit a written complaint to our official address or by email at: loyalty@happy.al
• Right to Compensation: If you can demonstrate that you have suffered damage as a result of unlawful processing of your personal data, you have the right to seek compensation in accordance with the provisions of the Civil Code and applicable legislation.

A written request must include your signature and be accompanied by a valid copy of your identification document to prevent misuse by third parties.

Requests should be submitted in writing to HAPPY Shpk, addressed to the Data Protection Officer (DPO), or sent by email to: dpo@happy.al
You may exercise your rights free of charge.
Within 30 days of receiving your request, we will provide the requested information or explain the reasons for any refusal to provide information or comply with your request.
If you are dissatisfied with the way HAPPY Shpk has handled your request, you have the right to contact the Office of the Commissioner for the Right to Information and Personal Data Protection, located at Rr. “Abdi Toptani”, Nd. 5, Tirana, Albania. For further information, please visit the Commissioner's website: www.idp.al
Where the processing of personal data is based on your consent, you may withdraw that consent at any time. To withdraw your consent, please contact us at: Email: dpo@happy.al Telephone: +355 44 803 999
The withdrawal of consent shall not affect the lawfulness of processing carried out prior to the withdrawal.

We may disclose your personal data to our service providers engaged by our Company to perform legitimate services on our behalf, under our supervision and in accordance with our instructions, for the purpose of delivering high-quality services to you.
Service agreements concluded with such providers contain specific provisions regarding confidentiality, security, and the protection of personal data, in compliance with applicable legislation.
This includes:

• Registration System Services – provided by INTELIQUA under a service agreement.
• IT Services – provided by the Balfin Group, of which our Company is a part, under a service agreement.
• Disclosure of data within the framework of partnerships and projects implemented for the benefit of citizens/members.
• Disclosure of data to partner companies for the purpose of awarding and processing loyalty points when purchases are made at merchants participating in the program. The data involved may include the cardholder’s name, surname, and telephone number. Such information is displayed within the HAPPY platform and is viewed by the merchant only at the time the membership card is presented.
• IT service arrangements with the Balfin Group (as parent company) for the purpose of ensuring the security and integrity of the IT network.
• Data sharing within projects or collaborations related to the operation of the Loyalty Program, member benefits, promotional communications, and marketing activities, where the data subject has previously provided the relevant consent.

We may also disclose your personal data to third parties, including authorities responsible for the prevention and investigation of criminal offences, fraud, money laundering, and other law enforcement authorities, where necessary to comply with our legal obligations.
Where we transfer your personal data to third countries, we take all necessary measures and implement appropriate safeguards to ensure that the level of protection of your personal data and your rights remains equivalent to that provided under Albanian law and applicable data protection standards.

The website uses technical cookies, which are necessary for its proper operation and for the provision of basic services to users. These cookies enable essential functions such as website security, session management, and the storage of basic navigation preferences.
Technical cookies are necessary for the functioning of the website and cannot be disabled through the website's systems, as the website would not function properly without them.
The use of these cookies is based on the legitimate interest of Happy Shpk in ensuring the technical functionality and security of the service and does not require the user's prior consent under applicable personal data protection legislation.
Users may restrict or block cookies through their browser settings; however, doing so may affect the full functionality of the website.

If you have any complaint or concern regarding the processing of your personal data, you may submit it in writing to HAPPY Shpk, addressed to the Data Protection Officer, or by email at: dpo@happy.al

The complaint should contain sufficient identifying information to prevent misuse by third parties. HAPPY Shpk may request additional information or documentation to properly handle the request or complaint and to verify your identity, thereby preventing unauthorized access to or misuse of personal data by third parties.

Within 30 days of receiving your complaint, we will provide you with a response. In cases involving complex requests or a high volume of requests, this period may be extended by up to 60 days, and you will be informed within the initial 30-day period of the reasons for the extension.

If you are dissatisfied with the handling of your complaint by HAPPY Shpk, you have the right to contact the Office of the Commissioner for the Right to Information and Personal Data Protection, located at: Rr. “Abdi Toptani”, Nd. 5, Tirana, Albania. For further information, please visit the Commissioner's website: www.idp.al.

Last Updated: 25 May 2026 Previous Version: July 2025