Privacy Policy
Read how Baboon collects, uses, and protects your personal data when you use our app, website, or services.
Updated: October 2026
1. Who We Are
Eatit Shpk, operating under the trade name Baboon, is the controller of your personal data. Baboon is the leading local on-demand delivery platform in Albania and Kosovo and connects more than 450,000 users with 1,000+ partners through 500+ active couriers.
2. Legal Framework
This policy is based on the following legal framework:
- Law No. 9887/2008 “On Personal Data Protection” of the Republic of Albania and related amendments.
- Regulation (EU) 2016/679 (GDPR), used as a reference standard.
- Law No. 06/L-082 on Personal Data Protection of the Republic of Kosovo.
- Law No. 9918/2008 on Electronic Communications and cookie-related rules.
The competent supervisory authority is the Commissioner for the Right to Information and Protection of Personal Data (KDIM), Tirana, Albania.
3. What Personal Data We Collect
3.1 Data you provide directly
- When you register: first name, last name, email, phone number, and encrypted password.
- When you place an order: delivery address and specific delivery instructions.
- When you contact support: any information you choose to share during communication.
3.2 Data we collect automatically
- IP address, device type, operating system, and app version.
- Login date and time, visited pages or features, and preferred language.
- Unique device identifier and technical usage data related to the platform.
3.3 Location data
- Approximate location to show nearby partners, only with your permission.
- Precise location only during an active delivery, for real-time tracking and only with explicit permission.
3.4 Financial data: Baboon does not collect or store payment card numbers or bank details. Payments are processed directly by Raiffeisen Bank and partner payment providers in their own secure systems.
4. How We Use Your Data
| Purpose | Legal basis | Details |
|---|---|---|
| Order fulfillment | Contract | Processing, confirming, and delivering your order. |
| User account | Contract | Creating and managing your Baboon account. |
| Payments | Contract | Passing the transaction to Raiffeisen Bank or payment providers. |
| Communication with you | Contract / Legitimate interest | Confirmations, status updates, and customer support. |
| WhatsApp messages | Contract / Legitimate interest | Verification codes, order and delivery updates, and customer support. |
| Push notifications | Consent | Promotional notices and order status notifications. |
| Analytics and improvements | Legitimate interest | Understanding usage patterns to improve the service. |
| Direct marketing | Consent | Email, SMS, and promotional messages only with your permission. |
| Security and fraud prevention | Legitimate interest | Protecting the platform and users from suspicious activity. |
| Legal obligations | Legal obligation | Compliance with tax laws and authority requests. |
5. Third Parties We Share Data With
We work with trusted service providers who help us operate the Baboon platform. Each third party is contractually required to protect your data.
5.1 Our service providers
| Provider | Purpose | Country |
|---|---|---|
| Google Analytics (Google LLC) | Website and app analytics | USA (SCCs) |
| Google Maps (Google LLC) | Maps display and route calculation | USA (SCCs) |
| Firebase (Google LLC) | App infrastructure, databases, authentication | USA (SCCs) |
| Meta (Meta Platforms, Inc.) | Advertising and social analytics | USA (SCCs) |
| WhatsApp Business Platform (Meta Platforms, Inc.) | Sending verification codes, order updates, and support messages | USA / EU (SCCs) |
| Apple Inc. | iOS app distribution, Apple Pay | USA (SCCs) |
| Raiffeisen Bank | Payment processing | Albania |
| Cookiebot (Cybot A/S) | Cookie consent management | EU (Denmark) |
5.2 Courier partners
When you confirm an order, your name, phone number, and delivery address are shared with the courier handling the delivery. Couriers only receive the information necessary to complete the delivery.
5.3 Partner restaurants and stores
Our commercial partners receive the details of your order, such as items, prices, and instructions, but not your payment information or precise location.
5.4 When required by law
We may disclose your data to competent authorities when required by law, court order, or regulatory authorities.
We never sell your personal data to third parties.
6. Cookies and Tracking Technologies
6.1 What are cookies?
Cookies are small text files stored on your device to remember your preferences, improve your experience, and support platform analytics.
6.2 Types of cookies we use
| Category | Name/Provider | Purpose | Duration |
|---|---|---|---|
| Strictly necessary | Session, CSRF token | Platform functionality and security | Session |
| Functional | Language preferences, city | Experience personalization | 12 months |
| Analytics | Google Analytics (_ga, _gid) | Visit statistics and reporting | 24 months |
| Marketing | Meta Pixel, Google Ads | Personalized advertising | 90 days |
6.3 How to control cookies
Baboon uses Cookiebot to manage your consent. You can accept, refuse, or customize cookies and change your preferences at any time from the cookie management panel.
7. WhatsApp Messaging
When you use your phone number with Baboon, we may contact you on WhatsApp. For this purpose we collect and use your phone number and your WhatsApp messages to:
- Send verification codes (for registration, login, and password reset).
- Send order and delivery updates, such as confirmation, status, and courier arrival.
- Provide customer support when you message us or we reply to you on WhatsApp.
WhatsApp messages are processed through Meta Platforms, Inc.’s WhatsApp Business Platform. Meta acts as a service provider for us and processes messages under its own WhatsApp Business terms. We do not use your messages for personalized advertising.
We keep your phone number while your account is active (and up to 30 days after it is deleted). Order and support messages are kept for 3 years, and verification codes only as long as needed to complete verification. See the table in Section 8.
You can stop non-essential WhatsApp messages at any time by replying STOP or by contacting support. For deletion requests, see Section 12.
8. How Long We Keep Your Data
| Data category | Retention period |
|---|---|
| User account (active) | Until account deletion + 30 days |
| Order history | 5 years |
| Analytics data | 26 months, anonymized after 14 months |
| Security logs | 12 months |
| Support communications | 3 years |
| WhatsApp messages (order updates and support) | 3 years |
| Verification codes | Only as long as needed to complete verification |
| Marketing data | Until consent is withdrawn |
| Payment references | 10 years under tax legislation |
After the relevant retention periods expire, data is securely deleted or anonymized.
9. How We Protect Your Data
- TLS/SSL encryption for all communications between your device and our servers.
- Database encryption for sensitive data.
- Two-factor authentication, where available for your account.
- Restricted access only for authorized staff, based on the principle of minimum need.
- Regular auditing of systems and security procedures.
- Incident management protocols and notification within 72 hours where legally required.
10. International Data Transfers
Some of our service providers host servers outside Albania, mainly in the USA and the EU. Where international transfers occur, they are carried out with adequate legal safeguards.
- Standard Contractual Clauses (SCCs) approved by the European Commission.
- Internal corporate policies where applicable.
- Adequacy decisions of the European Commission where available.
Our core operations and most data storage take place in Albania and Kosovo.
11. Your Rights
Under Albanian personal data law and GDPR standards, you have the following rights:
| Right | What it means |
|---|---|
| Right of access | To receive a copy of the personal data we hold about you. |
| Right to rectification | To correct inaccurate or incomplete data. |
| Right to erasure | To request deletion of your data within legal limits. |
| Right to restriction | To limit the way we use your data. |
| Right to object | To object to processing based on legitimate interest or marketing. |
| Right to portability | To receive your data in a structured format and transfer it. |
| Right to withdraw consent | To withdraw consent at any time without affecting earlier processing. |
How to exercise your rights
Send an email to [email protected] with the subject “Privacy Request — [Your Name]”. We will respond within 30 calendar days.
Complaints
- Website: www.idp.al
- Email: [email protected]
- Address: Abdi Toptani St., No. 1, Tirana, Albania
12. Data Deletion
You can request deletion of your account and personal data at any time.
12.1 How to delete your account
- In the app: open Profile → Edit Profile → Delete Account and confirm the deletion.
- By email: send a message to [email protected] with the subject “Account deletion request” from the email address or phone number linked to your account. You can also contact customer support.
12.2 What gets deleted
- Your profile: name, email, phone number, and password.
- Saved addresses, favourites, and app preferences.
- Data linked to your WhatsApp messages and push notifications.
Some data may be kept for as long as the law requires, such as order and payment records under tax legislation, and is then deleted or anonymized.
12.3 Timeline
Your account and personal data are deleted within 30 days of receiving your request.
12.4 Opting out of WhatsApp messages
You can stop WhatsApp messages without deleting your account by replying STOP or by contacting support.
13. Changes to This Policy
Baboon may update this policy from time to time to reflect changes in our service, technology, or legal requirements.
- By email, if you have an active account.
- Through an in-app notification.
- With a visible notice on our website.
The update date at the top of this page always shows the current version. Continued use of Baboon after changes take effect is considered acceptance of them.
14. Contact Us
For any question, concern, or request related to your privacy:
Baboon — Eatit Shpk
Rruga Nikolla Tupe, No. 1, Tirana, 1001, Albania
https://baboon.al
Contact us. Our team is ready to help.