Who is responsible
HexaWin SHPK is the controller for the Hexa application and loyalty programme. NUIS: M61907034U. Registered office: Rruga "Ibrahim Rugova", Nd. 42, H. 7, Ap. 17, Njësia Bashkiake nr. 5, Tirana, Albania. For data-protection matters, write to office@hexa.win or the registered office. General support is available at office@hexa.win.
Your account and sign-in
We process your first and last name, email address, mobile number, account status and registration time to create and operate your account. Sign-in and verification use a hashed password, temporary one-time codes, and access and refresh tokens. Verification codes expire within minutes. These account details are needed to provide the loyalty service; without the required information and verification, we cannot activate the account.
Purchases and points
Participating kiosks send the date and time, kiosk identifier, payment-method category, total amount in ALL, and item-level purchase information: product name, SKU, quantity, unit price and line total. We record the points awarded, resulting balance and ledger reference. Payment-method information means categories such as cash, card or mobile payment; Hexa does not collect your card number through this loyalty transaction record. The history substantiates your points balance and helps resolve errors.
Your QR code and redemptions
Your loyalty code contains a rotating code value linked to your customer and Hexa identifiers, with issue and expiry times. It rotates every 15 minutes; earlier codes remain only as scan records linked to transactions. Kiosk staff receive scan confirmation and redemption eligibility, not your name, contact details or purchase history from Hexa. For rewards we record the reward, points spent, quantity, voucher code, status, relevant kiosk, tier and redemption or use times.
Profile and optional features
We use language and notification preferences, favourite products and a preferred kiosk to support your account experience. A profile photograph is optional and is processed with your consent; you can remove it in the app. If you allow location access, the kiosk locator uses your device coordinates to calculate nearby locations and distances. You can withdraw location permission in your device settings. Coordinates are used for that request; technical request logs may also contain request information, including coordinates.
Activity summaries
We calculate summaries such as total and average spend, transaction count, favourite kiosk, lifetime points and redemption totals from the loyalty ledger. These support your activity view and membership tier. Aggregate business reporting uses information with customer identifiers removed. We do not use this processing to make solely automated decisions that have legal or similarly significant effects on you.
Notifications
Service messages concern your account, points, redemptions or participation activity. We process a notification token, device identifier, operating system, message category and read status to deliver and manage them. Promotional messages unrelated to your own account activity require separate consent. You can manage notification preferences in the app and device settings. Agreeing to receive launch notifications is not permission for ongoing marketing.
Support and security
When you ask for help, authorized staff may review your contact details, balance, transaction history and relevant account flags. Manual corrections record a reason, the staff member and the action time in an audit trail. Authentication events, failed sign-in attempts, lockout status and request logs help protect accounts and investigate misuse. Passwords are stored as hashes; access to administrative functions requires authorization.
Why we may process this information
Under Article 7 of Albanian Law no. 124/2024, we rely on performance of the service contract for accounts, purchases, loyalty codes, rewards, account summaries and service notifications; consent for optional photographs, location access and promotional messages; legal obligations for required records and disclosures; and legitimate interests for security, accountable administration and aggregate reporting. Optional information is not required for the core loyalty account. You may withdraw consent without affecting earlier lawful processing.
Service providers and other recipients
An external software development and maintenance provider supports the application and can access production information for support. Fly.io hosts the application and database. Tigris stores profile photographs and uploaded files. Twilio delivers verification SMS messages. Google Firebase supports push notifications and mobile analytics. Kiosk operators process the scan on Hexa’s behalf and act separately for their own sales records. Personal data is not sold or rented. Information may also be disclosed to competent authorities where legally required.
Processing outside Albania
The application and database are hosted through Fly.io in Frankfurt, Germany. Our software development and maintenance provider is established in the United States, and maintenance access can involve processing there. Tigris, Twilio and Google Firebase may involve processing or access in other countries. European hosting does not by itself rule out access from outside Europe. Contact office@hexa.win for details of the locations and transfer arrangements applicable to your data, including information about available safeguards.
How long we keep information
Account details, the points ledger, purchase history and redemption records are retained for the life of the account plus 24 months. Account preferences are kept while the account is active. A profile photograph is removed on your request. Notification history is kept for 12 months; notification tokens are kept until the device is unregistered or inactive. Administrative audit records are kept for six years from the entry, and promotion records for six years. Activity summaries are calculated from the ledger rather than kept independently beyond it.
Deletion, logs and backups
Closing an account does not remove records that must still be retained for an applicable legal obligation or a separate audit purpose. Those records remain restricted to that purpose. After the relevant retention period, information is deleted or irreversibly anonymised. Server logs and backup copies have separate storage arrangements; contact office@hexa.win for information about the periods that apply to your data. Anonymous aggregate figures that can no longer identify anyone may be retained.
This website
You can read this website without creating an account. We use your browser language and the country inferred by our hosting provider to suggest the homepage language. A language-preference cookie remembers your explicit choice for one year. We do not request your precise location. We use Umami Cloud to understand website visits and improve the site. Website analytics are separate from early-access signup details; we do not send form names, email addresses or phone numbers to Umami. URL query strings and fragments are excluded from tracking. We do not use advertising tracking. When you join early access, we collect your full name, email, phone number, language and signup-consent record. Resend stores these details and sends the confirmation and launch emails you request. Your phone number is stored with the signup; we do not send SMS. This does not create an app account or subscribe you to ongoing marketing. You can stop launch emails through the unsubscribe link in your confirmation email, or request deletion at office@hexa.win. Signup details are retained while needed for the requested launch notifications; withdrawal and deletion requests are handled at office@hexa.win. A page request necessarily sends connection information to the hosting service to deliver the page. If you contact us by email, we use the information you send to answer your enquiry.
Your rights
Subject to the conditions in Law no. 124/2024, you can request access, correction, deletion, restricted processing and portability. You can object to legitimate-interest processing on grounds relating to your situation, and to direct marketing at any time. Send requests to office@hexa.win. We may verify your identity. We respond within 30 days; any lawful extension is explained within that period. You may complain to Albania’s Commissioner for the Right to Information and Personal Data Protection at idp.al or seek judicial protection.
Changes to this notice
We update this notice when processing or the service changes. Where a new use requires information or consent, that is provided or requested before that use begins. The privacy notice does not remove any of your rights under applicable law.