This privacy notice for Vali Group Sh.P.K. ("Company," "we," "us," or "our") describes how and why we collect, store, use, and/or share ("process") your information when you use our services ("Services"), such as when you:

• Download and use our mobile application Valipik (available on Google Play and the App Store), or any other application of ours that links to this privacy notice;
• Participate in the Valipik loyalty programme, including scanning or entering product activation codes, collecting points, and requesting cash payouts;
• Engage with us in other related ways, including customer support, sales, marketing, or events.

Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at it@valifix.com.

This summary provides key points from our privacy notice. Use the table of contents below to find the section you are looking for.

What personal information do we process? We process the information you give us when you create an account (your name and mobile phone number), the loyalty activity generated by your use of the app (activation codes, points, and cash payout requests), a random identifier for your app installation, and — only if you allow notifications — a push notification token for your device. See Section 1.

Do we process any sensitive personal information? No. We do not process sensitive personal information such as biometric, health, precise location, racial or ethnic origin, or political data.

What about the camera? The app uses your camera only while you are on the code-scanning screen, and only to photograph a product activation code. The photo is sent over an encrypted connection to be read by an automated text-recognition service and is deleted immediately after the code is read. We do not use the camera for facial recognition or biometric identification, and we never access it in the background. See Section 5.

Do we receive any information from third parties? No. We do not buy or receive personal information about you from data brokers, advertising networks, or social media platforms.

Do we use analytics or advertising trackers? No. Valipik contains no third-party advertising SDKs, no analytics SDKs, and no cross-app tracking. We do not collect your device's advertising identifier.

How do we process your information? To create and secure your account, run the loyalty programme, pay out the money you have earned, send you the notifications you asked for, prevent fraud, and comply with law. See Section 2.

In what situations and with which parties do we share personal information? Only with the service providers that host our systems and deliver our messages, and where the law requires it. We do not sell your personal information. See Section 4.

How can you delete your account and data? Directly in the app: open Opcionet and tap "Kërko fshirjen e llogarisë dhe të dhënave" ("Request deletion of my account and data"). You can also email or call us. See Section 12.

What are your rights? Depending on where you live, you may have rights of access, correction, deletion, restriction, objection, and portability. See Section 11.

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
5. HOW DO WE USE YOUR CAMERA AND OTHER DEVICE PERMISSIONS?
6. HOW DO WE HANDLE PUSH NOTIFICATIONS?
7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
8. HOW LONG DO WE KEEP YOUR INFORMATION?
9. HOW DO WE KEEP YOUR INFORMATION SAFE?
10. DO WE COLLECT INFORMATION FROM MINORS?
11. WHAT ARE YOUR PRIVACY RIGHTS?
12. HOW CAN YOU DELETE YOUR ACCOUNT AND DATA?
13. CONTROLS FOR DO-NOT-TRACK FEATURES
14. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
15. DO WE MAKE UPDATES TO THIS NOTICE?
16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

In Short: We collect the personal information that you voluntarily provide to us.

When you register for a Valipik account, use the loyalty features, or contact us, we collect:

• First name and last name — provided by you during sign-up.
• Mobile phone number — used as your account identifier and to send you a one-time SMS verification code.
• SMS verification codes — the five-digit code we send you to confirm that the phone number belongs to you. It is short-lived and becomes invalid once used or expired.
• Cash payout request details — the amount in EUR you request and any optional note you choose to write when submitting the request.
• Support and deletion requests — the contents of any request you send us, including account-deletion requests submitted from within the app.

Sensitive information. We do not process sensitive personal information.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Using the loyalty programme creates records that are linked to your account:

• Activation records — the product activation codes you scan or type in, their serial numbers, the associated product name, and the date each code was used.
• Loyalty balance and statistics — your points balance, points earned per period, and how many codes you have activated.
• Cash payout history — the amount requested, the points spent, the conversion rate applied, the status of the request, the relevant dates, and any signed payout agreement document we make available to you in the app.
• Notification preferences — whether you opted in to promotional notifications, and when that choice was recorded.

In Short: We collect a small amount of technical information that is necessary to keep your account secure and to deliver notifications.

• Installation identifier. The first time you open the app, it generates a random eight-character identifier and stores it in your device's secure storage. We use it to bind your account to this installation, so that a session stolen from one device cannot be replayed from another. It is generated by the app itself — it is not your advertising ID, IMEI, MAC address, or hardware serial number, and it cannot be used to identify you outside of Valipik.
• Platform and app version. Whether your device runs Android or iOS, and which version of Valipik is installed, so that we can send notifications correctly and diagnose issues.
• Push notification token. Only if you grant notification permission. See Section 6.
• Notification delivery records. Whether a notification we sent you was accepted or rejected by Apple or Google, so that we can stop sending messages to devices that no longer exist.

We do not collect your precise or approximate location, your contacts, your photo library, your browsing history, your advertising identifier, or any behavioural profile. Valipik does not embed third-party analytics or advertising software development kits.

Some information never leaves your phone. The app stores your signed-in session (account ID, phone number, name, points, and registration date), your installation identifier, and your notification preference in your device's encrypted secure storage, and it caches your wallet and activation history locally so that those screens still work when you are offline. This local data is removed when you sign out or uninstall the app.

If you updated in place from an older version of Valipik, the app reads the sign-in details that the previous version had already saved on your device, one time only, and uses them to keep you signed in so that the update does not log you out. This data is read locally from your own device — it is not obtained from any third party, and the check is not repeated after the first launch.

In Short: We process your information to run the loyalty programme, secure your account, pay out what you have earned, communicate with you, prevent fraud, and comply with law.

• To create and manage your account. We use your phone number and the SMS verification code to confirm your identity, and your name to personalise the app.
• To keep your account secure. We match your installation identifier against your account on every request, so that a session cannot be used from a device you did not authorise.
• To operate the loyalty programme. We record which activation codes you have used, award the corresponding points, and show you your history.
• To read activation codes from a photo. When you use the scanner, we process the captured image to extract the code. See Section 5.
• To process cash payouts. We use your request details, points balance, and contact information to verify, approve, and pay out your request, and to produce the associated agreement document.
• To send you notifications you asked for. Account notifications about your points, codes, and account changes; and — only with your separate opt-in — promotional offers. See Section 6.
• To handle your requests. Including account-deletion requests, which our operators receive and process, and which may involve a follow-up call to you.
• To prevent and detect fraud and abuse of the loyalty programme, such as reuse of activation codes.
• To comply with our legal obligations, including accounting and tax record-keeping for cash payouts.
• To save or protect an individual's vital interests, such as to prevent harm.

We do not use your personal information for automated decision-making that produces legal or similarly significant effects about you, and we do not use it to build advertising profiles.

In Short: We only process your personal information when we have a valid legal reason to do so.

The General Data Protection Regulation (GDPR), the UK GDPR, and Kosovo's Law No. 06/L-082 on Protection of Personal Data require us to explain the legal bases we rely on. We may rely on the following:

• Performance of a Contract. Most processing described in this notice is necessary to provide the Valipik service you signed up for: creating your account, awarding and displaying points, and paying out your balance.
• Consent. We rely on your consent for promotional notifications and for access to your camera. You can withdraw either at any time — turn the promotional switch off in Opcionet, or revoke camera access in your phone's settings. Withdrawal does not affect the lawfulness of processing carried out before it.
• Legitimate Interests. We rely on our legitimate interest in keeping accounts secure, preventing fraud in the loyalty programme, and keeping our systems working reliably. We balance these interests against your rights and use the minimum data needed.
• Legal Obligations. Where processing is necessary to comply with law, such as retaining payout records for accounting and tax purposes, or responding to a lawful request from a competent authority.
• Vital Interests. Where processing is necessary to protect your vital interests or those of another person.

In Short: We share information only with the service providers that operate our infrastructure, and where the law requires it. We do not sell your personal information.

Service providers. We use a small number of processors, each bound by a written contract to process data only on our instructions:

We may also need to share your personal information in the following situations:

• Legal obligations and defence of rights. Where we are required to do so by law, or where disclosure is necessary to establish, exercise, or defend legal claims.
• Business transfers. In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Vital interests. Where necessary to prevent serious harm to any person.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not disclose it to advertising networks, data brokers, or social media platforms.

In Short: The camera is used only to read an activation code you point it at, and the photo is deleted as soon as the code has been read.

Camera. Valipik asks for camera permission the first time you open the scanning screen. The camera is active only while that screen is open. When you take a picture:

1. A single photo is captured and stored temporarily on your device.
2. It is uploaded over an encrypted HTTPS connection to our server, where an automated text-recognition service reads the characters visible in the image and returns the candidate activation codes.
3. The image is deleted from our server immediately after the code is read. We do not archive it, and no person at Vali Group reviews it.
4. The temporary copy on your device is deleted by the app as soon as the upload finishes.

We do not use the camera for facial recognition, biometric identification, or any form of identity verification. We never access the camera in the background or while the scanning screen is closed. We do not request access to your photo library.

You can revoke camera permission at any time in your phone's settings. If you do, the scanning feature stops working, but you can still enter activation codes manually.

Notifications. Valipik asks for notification permission separately. See Section 6.

Network state. The app checks whether your device is online in order to show an offline notice. This check happens entirely on your device and is not transmitted to us.

Valipik does not request location, microphone, contacts, calendar, storage, or health permissions.

In Short: Account notifications and promotional notifications are two separate choices, and you control both.

If you allow notifications, your device is issued a push token by Google (Firebase Cloud Messaging on Android) or Apple (Apple Push Notification service on iOS). We store that token on our servers in encrypted form, together with your account ID, your installation identifier, your platform, your app version, your permission status, and the time the device was last seen. We need the token because it is the only way to address a notification to your device.

We use two separate categories:

• Account notifications ("Njoftime të llogarisë") — points, codes, and changes to your account. These follow the notification permission you granted to the app.
• Promotional notifications ("Oferta dhe promovime") — selected offers. These require a separate, explicit opt-in which is off by default. You can turn it on or off at any time using the "Oferta të personalizuara" switch in Opcionet. We record when you gave or withdrew this consent.

When you sign out, we deactivate the association between your account and that installation, so the device stops receiving notifications for your account. You can also disable notifications entirely in your phone's settings at any time. We do not use notification tokens for tracking, profiling, or advertising measurement.

In Short: Your data is hosted in the European Union. A limited amount may be processed by our notification providers outside it.

Our servers, databases, and file storage are hosted with Amazon Web Services in the Europe (Frankfurt), Germany region. Vali Group Sh.P.K. is established in Kosovo, so accessing and administering your data necessarily involves a transfer to Kosovo.

Push notification delivery involves Google LLC and Apple Inc., which may process the push token and the notification content outside the European Economic Area, including in the United States. Where personal data leaves the EEA or the United Kingdom, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

You may request a copy of the relevant safeguards by contacting us at it@valifix.com.

In Short: We keep your information for as long as you have an account with us, unless a longer period is required by law.

When you ask us to delete your account, we remove your personal information from our active systems without undue delay. Copies held in routine backups are overwritten in the normal backup rotation; until that happens, they are isolated from any further processing.

When we no longer have a legitimate business or legal need to process your personal information, we either delete it or anonymise it.

In Short: We protect your personal information through organisational and technical security measures.

Our measures include:

• All communication between the app and our servers uses encrypted HTTPS connections.
• Your session and installation identifier are held in your device's operating-system-provided encrypted storage (Android Keystore / iOS Keychain), not in plain application storage.
• Every request from the app is checked against the installation identifier bound to your account, so a session cannot be replayed from another device. If that check fails, the app signs you out immediately.
• Push notification tokens are stored encrypted, and are never placed in request URLs or server logs.
• Access to production data is limited to the personnel who need it.

However, despite our safeguards, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. You should only access the Services within a secure environment.

In Short: We do not knowingly collect data from or market to children under 18 years of age.

Valipik involves cash payouts and is intended for adults. We do not knowingly solicit data from or market to children under 18. By using the Services, you represent that you are at least 18 years old. If we learn that personal information from a user under 18 has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from a child under 18, please contact us at it@valifix.com.

In Short: You may review, change, or delete your account at any time.

Depending on where you are located, you may have the following rights under applicable data protection law, including the GDPR, the UK GDPR, and Kosovo's Law No. 06/L-082:

• Access — to request confirmation of whether we process your personal information, and to obtain a copy of it.
• Rectification — to have inaccurate or incomplete information corrected.
• Erasure — to have your personal information deleted. See Section 12.
• Restriction — to ask us to limit how we process your information.
• Objection — to object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Portability — to receive the information you provided to us in a structured, commonly used, machine-readable format.
• Withdrawal of consent — to withdraw consent where we rely on it, at any time, without affecting the lawfulness of prior processing.
• Complaint — to lodge a complaint with a supervisory authority.

Some of these you can exercise directly in the app: your name, phone number, account ID, and registration date are shown in Opcionet, your full activation and payout history is available under Historia and Kuleta, and your promotional-notification consent is a switch you control. For anything else, email us at it@valifix.com.

We will respond to your request within the period required by applicable law — one month under the GDPR, extendable by two further months for complex requests, in which case we will tell you. We may need to verify your identity before acting, normally by confirming the phone number registered to your account.

If you are located in Kosovo, you may complain to the Information and Privacy Agency of the Republic of Kosovo (www.aip-rks.org). If you are located in the EEA or the UK, you may complain to your local supervisory authority; contact details are available at https://ec.europa.eu/newsroom/article29/items/612080. If you are located in Switzerland, contact details are available at https://www.edoeb.admin.ch/edoeb/en/home.html.

In Short: You can request full deletion of your account and data directly inside the Valipik app, in two taps.

1. Open Valipik and sign in.
2. Go to the Opcionet ("Options") tab.
3. Scroll to the bottom and tap "Kërko fshirjen e llogarisë dhe të dhënave" ("Request deletion of my account and data").
4. Confirm when the app asks you to. The request is sent to our operators immediately.

You do not need to contact anyone or fill in a form. You may receive a follow-up call asking about your experience, but the deletion proceeds whether or not you take that call.

If you can no longer access the app, or you have already uninstalled it, send a deletion request from any address to it@valifix.com, or call us on +383 44 600 880. Include the mobile phone number registered to your Valipik account so that we can locate it. We will verify that the number is yours before deleting anything.

Deleting your account removes:

• Your name and phone number;
• Your account record, points balance, and activation history;
• Your notification preferences and any registered push notification tokens;
• The link between your account and any device installation.

We must retain records of cash payouts already made to you for as long as accounting and tax law requires, and we keep a minimal record showing that your deletion request was received and completed. We may also retain information where necessary to prevent fraud, resolve a dispute, or comply with a legal obligation. Anything retained on these grounds is isolated from further use.

Deletion is permanent and cannot be undone. Any unredeemed points are forfeited when your account is deleted — if you have a balance you want paid out, submit your cash payout request in the Kuleta tab before requesting deletion. Signing out of the app, or uninstalling it, removes the data stored on your device but does not delete your account on our servers; use one of the options above for that.

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. Valipik does not track your activity across other apps or websites in any case. At this stage no uniform technology standard for recognising and implementing DNT signals has been finalised, so we do not respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy notice.

In Short: Yes. If you are a California resident, you have specific rights regarding your personal information.

Valipik is offered primarily in Kosovo, but this section is provided in case you use the Services as a California resident. The California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), gives you the rights described below.

We have collected the following categories of personal information in the past twelve (12) months:

We retain each category for the periods set out in Section 8. We may also collect other personal information outside these categories when you interact with us directly, for example when you receive help through our customer support channels or take part in a survey.

Vali Group Sh.P.K. has not sold or shared any personal information for cross-context behavioural advertising in the preceding twelve (12) months, and will not do so in the future. We have not sold or shared the personal information of consumers under 16 years of age. We disclose personal information to the service providers listed in Section 4 for the business purposes described there, under written contracts that prohibit them from using it for their own purposes.

• Right to know what personal information we collect, the purposes for which we use it, the categories of sources, and the categories of third parties to whom we disclose it.
• Right to delete the personal information we collected from you, subject to exceptions provided by law.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information. We do not sell or share personal information, so there is nothing to opt out of.
• Right to limit the use of sensitive personal information. We do not collect sensitive personal information.
• Right to non-discrimination for exercising your privacy rights. We will not discriminate against you.

To exercise these rights, email us at it@valifix.com, or use the in-app deletion path described in Section 12.

Upon receiving your request, we need to verify your identity to confirm you are the person about whom we hold information. We normally do this by confirming the mobile phone number registered to your account. We will only use information provided in your request to verify your identity, and we delete any additional verification information as soon as verification is complete. You may designate an authorised agent to make a request on your behalf; we may deny a request from an agent who does not provide proof of valid authorisation.

California Civil Code Section 1798.83 permits California residents to request, once a year and free of charge, information about categories of personal information we disclosed to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes. If you are a California resident under 18 with a registered account, you may request removal of data you publicly posted on the Services by contacting us at it@valifix.com.

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Last updated" date and will be effective as soon as it is accessible. If we make material changes, we may notify you either by prominently posting a notice of such changes or by sending you a notification directly. We encourage you to review this privacy notice frequently to be informed of how we are protecting your information.

If you have questions or comments about this notice, or you want to exercise any of the rights described above, you may contact us:

• Email: it@valifix.com
• Phone: +383 44 600 880
• Website: www.valifix.com

Postal address:

Vali Group Sh.P.K.
Rr. Besim Shala nr. 33
Prizren 20000
Kosovo

To review, update, or delete the personal information we hold about you, see Section 12.