Privacy Policy

The controller of personal data processed through the Pikkoh platform is:

• Pikkoh Sh.P.K.
• Johan V Hahn 23, Prishtina, Kosovo
• Contact: hello@pikkoh.com

Pikkoh connects customers with service businesses located in Kosovo and Albania. The businesses and services offered on the platform are exclusively based in these two countries. There is no restriction on a customer's country of residence — anyone may create an account and book an appointment, as the service itself is always rendered at the business's physical location in Kosovo or Albania. Pikkoh does not direct or market its service supply to the European Union market; the German language option exists primarily for German-speaking users of the platform.

Processing is governed by Law No. 06/L-082 on Protection of Personal Data of the Republic of Kosovo. That law is aligned with Regulation (EU) 2016/679 (GDPR), and Pikkoh applies the same protection standards even where the GDPR does not apply directly.

We process only the data necessary for the following purposes:

• Account data (name, email, phone number, language preference, encrypted password) — to create and administer your account. Legal basis: performance of a contract.
• Phone verification via WhatsApp OTP — mandatory for creating both customer and business accounts; without verification no account is created. Booking as a guest requires no verification. Legal basis: performance of a contract (a condition of account creation) and legitimate interest (platform security and fraud prevention).
• Booking data (customer name, phone, email, service, staff member, date and time, optional notes, cancellation reason) — to carry out the booking and communicate with the business. Legal basis: performance of a contract.
• Booking notifications by email and WhatsApp (confirmation, reminder, change, cancellation) — a necessary part of the booking service. Legal basis: performance of a contract; for additional reminders, legitimate interest in reducing no-shows.
• Reviews, comments and business replies (rating, text, linked booking, displayed name, the business's reply text) — for transparency towards other customers. A review is always tied to a completed booking and is published on the business profile together with any reply. Legal basis: legitimate interest; the review invitation is sent after the visit has taken place.
• Business and staff data (trading name, address, geographic coordinates, verified phone number, registration number NUIS/NIPT if provided, opening hours, images, staff names) — to publish the profile and operate the calendar. Legal basis: performance of a contract.
• Support ticket content and correspondence — to respond to your requests. Legal basis: performance of a contract and legitimate interest.
• Campaigns and promotions sent by businesses to their own customers — Legal basis: consent, withdrawable at any time via the unsubscribe link.
• Technical logs (email and WhatsApp delivery logs, audit log, error reporting) — for security, troubleshooting and proof of delivery. Legal basis: legitimate interest.
• Billing and payment data (plan, invoice history, amounts) — Legal basis: performance of a contract and legal obligation (accounting and tax).
• Visit statistics and advertising measurement (Google Analytics 4 / Google Tag Manager, Meta Pixel) — only if you consented in the cookie banner. Legal basis: consent, withdrawable at any time (see section 14).

Most data is collected directly from you. In some cases we receive it from third parties: when a business creates or changes a booking on your behalf from its dashboard, when a business adds a staff member or customer record to its own register, or when you are invited by email to join a business account. The same rights and retention periods apply.

We do not sell your data. We share it only as far as necessary with:

• The business you book with — it receives your name, contact details and booking details, and acts as an independent controller for its own customer register.
• Supabase (database, authentication and hosting infrastructure) — data is stored in the AWS eu-central-1 data centre, Frankfurt, Germany.
• Meta Platforms Ireland Ltd. / WhatsApp Business Platform — for verification codes and booking notifications; involves a transfer to Meta Platforms, Inc. in the United States, covered by the EU Standard Contractual Clauses.
• Google Ireland Ltd. (Maps and Places API) — for geocoding business addresses and address suggestions; may involve a transfer to the United States, covered by Standard Contractual Clauses.
• The Lovable platform's transactional email provider — for confirmations, reminders and support replies.
• Payment provider — subscription payments are not yet integrated; once activated, payment data will be processed directly by a licensed payment institution and this policy will be updated with its name beforehand.
• Google Ireland Ltd. (Google Analytics 4 and Google Tag Manager) — only after your consent in the cookie banner; visit statistics with anonymised IP and Google Consent Mode v2. Transfers to the United States are covered by Standard Contractual Clauses and the EU–US Data Privacy Framework.
• Meta Platforms Ireland Ltd. (Meta Pixel) — only after your consent in the cookie banner; measurement of advertising performance on Facebook/Instagram, with Standard Contractual Clauses for transfers to the United States.
• Public authorities — only where required by law.

Data is stored primarily within the European Union (Frankfurt, Germany). Where a processor transfers data outside the EU or Kosovo — specifically Meta (WhatsApp, Meta Pixel) and Google (Maps/Places, Analytics/Tag Manager) — the transfer is protected by the Standard Contractual Clauses approved by the European Commission, for Google additionally by the EU–US Data Privacy Framework, together with supplementary technical measures. You can request information about these safeguards at hello@pikkoh.com.

• Account and booking history — for the lifetime of the account; deleted after the account is closed.
• Invoicing and accounting records — 6 years, under Kosovo tax legislation.
• Support tickets — 2 years after the ticket is closed.
• Phone verification (OTP) records — 30 days.
• Email and message delivery logs — 12 months.
• Reviews — remain public after account deletion, but in anonymised form (no name, no link to the account).
• Security audit log — 12 months.
• Statistics data in Google Analytics 4 — 14 months maximum.
• Cookie consent record (pikkoh_consent cookie with timestamp) — 12 months.

At any time you have the right:

• to access your data and receive a copy of it;
• to have inaccurate data corrected;
• to erasure ("the right to be forgotten"), where no legal retention obligation applies;
• to restriction of processing;
• to data portability in a machine-readable format;
• to object to processing based on legitimate interest;
• to withdraw consent at any time, without affecting the lawfulness of prior processing.

If you believe your data is not being handled properly, please contact us first at hello@pikkoh.com — we respond within 30 days. You also have the right to lodge a complaint with the Information and Privacy Agency of the Republic of Kosovo (Agjencia e Informimit dhe Privatësisë, AIP) in Prishtina.

If you are resident in a European Union member state and consider that we have processed your data, you also have the right to lodge a complaint with the national supervisory authority of your country of residence.

We do not use solely automated decision-making or profiling producing legal or similarly significant effects on you. The automatic assignment of a staff member when you choose "any specialist" is based only on schedule availability and does not evaluate you as a person.

The service is not directed at or intended for children. Creating an account requires a minimum age of 16. If we establish that an account belongs to a younger person, we delete it.

We apply appropriate technical and organisational measures: encrypted transport (HTTPS), encryption of stored data, row-level access control in the database, role separation, hashed passwords and audit logging of sensitive actions. No system is entirely secure; in the event of a high-risk breach we will notify affected individuals and the AIP within the statutory deadlines.

Strictly necessary cookies are set on the basis of our legitimate interest, without consent. Statistics and marketing cookies are set ONLY after you consent in the cookie banner (Art. 6(1)(a) GDPR / Law No. 06/L-082) — before that they are not downloaded at all. The categories are:

• Strictly necessary: authentication session cookie/storage; a cookie storing your chosen language (12 months); local storage for the sidebar state in the business dashboard; your consent cookie (pikkoh_consent, 12 months); technical error reporting from the hosting platform.
• Statistics (consent required): Google Analytics 4 / Google Tag Manager — measuring visits, popular pages and traffic sources. IP addresses are anonymised and Google Consent Mode v2 is enabled. Provider: Google Ireland Ltd.; transfers to the USA are covered by Standard Contractual Clauses and the EU-US Data Privacy Framework.
• Marketing (consent required): Meta Pixel — measuring advertising performance and building advertising audiences on Facebook/Instagram. Provider: Meta Platforms Ireland Ltd., under Standard Contractual Clauses.
• You can change or withdraw your consent at any time via the “Cookies” link in the footer. Withdrawal does not affect processing already carried out.

This policy may be updated. The version and effective date are shown at the top of the page. For material changes we give at least 30 days' notice by email or within the platform.

For any question or to exercise your rights: hello@pikkoh.com, or by post: Pikkoh Sh.P.K., Johan V Hahn 23, Prishtina, Kosovo.