Datum des Inkrafttretens: 22 August 2026
1.1 This Privacy Policy explains what personal data Wow Pets Palace collects, why, what we do with it, who we share it with, how long we keep it, and what rights you have.
1.2 It applies to https://wowpetspalace.com, our mobile applications, our GPS tracking service, and all related services (the "Platform").
1.2.1 Where we operate. We currently offer the Platform to users in Albania and the EU/EEA. This policy is written for those users.
1.3 It should be read with our Cookie Policy and our Terms and Conditions.
1.4 Last updated: 22 August 2026.
1.5 The short version. We collect what we need to run a pet marketplace and a pet tracking service. Your pet records are private unless you make them public. Your pet's location is never shared with other users unless you turn sharing on, and even then we never publish exact coordinates. We do not sell your personal data. We do not connect location data to advertising. You can access, correct, export or delete your data at any time.
2.1 Controller. The controller of your personal data is:
Wow Pets Palace Rruga Irfan Tomini, Tirana 1001, Albania Registration number: [REGISTRATION NUMBER - SEE NOTE] Email: legal@wowpetspalace.com
2.2 We are established in Albania. Because we offer services to, and monitor the behaviour of, people in the EU/EEA and the UK, the EU GDPR and the UK GDPR apply to us, in addition to Albanian Law No. 124/2024 on Personal Data Protection.
2.3 Representatives.
| Role | Appointee | Purpose |
|---|---|---|
| EU establishment | Estonia | Once our EU company is registered, it will be our establishment in the Union and no separate Article 27 representative is required |
2.4 Data Protection Officer. We have not appointed a Data Protection Officer. We keep this under review as the service grows - see §20. You can reach our privacy team at legal@wowpetspalace.com.
2.5 Contact. For anything in this policy, including exercising your rights: legal@wowpetspalace.com.
3.1 Where you interact with another user - a Seller, a Pet Sitter, someone rehoming an animal - that user is an independent controller of the personal data you give them. We do not control what they do with it.
3.2 Our payment providers, and the operators of social login services, act as independent controllers for their own purposes as well as processing on our behalf. Their own privacy policies apply to those activities.
3.3 Section 10 sets out the role of each third party.
4.1 Important. The table below lists what we may collect. We do not collect all of it from every user. What we actually hold about you depends entirely on which features you use. If you never buy anything, we hold no order data. If you never buy a tracker, we hold no location data. If you never upload a photo, we hold no photos.
4.2 You can see what we actually hold about you at any time by requesting a copy (§15).
| Category | Examples | Where it comes from | Do we always have it? |
|---|---|---|---|
| Account data | Name, email, phone, password (hashed), username, profile photo, account settings, language | You | Yes - email and password always; the rest optional |
| Age confirmation | Your confirmation that you are 18 or over | You | Yes - at registration |
| Identity data | Identity documents, seller or breeder licence numbers, business details | You | Only for Sellers, Pet Sitters, and where law requires |
| Address data | Delivery address, billing address, approximate location from IP | You; derived | Only if you order or use location features |
| Marketplace data | Listings, descriptions, prices, photos, trader status declaration, transaction records | You | Only if you list or transact |
| Order data | Items, quantity, price, order status, delivery, returns, refunds | You; carriers | Only if you order |
| Payment data | Last four digits, card type, payment status, transaction ID, billing name. We do not store full card numbers | Payment providers | Only if you pay |
| Pet profile data | Pet name, species, breed, sex, age, photos, microchip or registration number, description | You | Only if you create a pet profile |
| Pet health data | Vaccinations, medical notes, allergies, special needs, medication, diet, weight, height, other physical statistics | You | Only if you use pet records |
| Location data | GPS coordinates from a tracker, location history, timestamps, movement data, geofence events, approximate location from IP or device | GPS Device; your device | Only if you use a GPS Device or enable a location feature |
| Device and technical data | IP address, device identifiers, device type, operating system, browser, app version, language, time zone, crash logs | Your device | Yes, in some form |
| GPS device telemetry | Device ID, SIM identifier, battery level, signal strength, firmware version, connection status, data-quality flags | GPS Device | Only if you use a GPS Device |
| Content | Photos, videos, reviews, comments, listings, forum posts | You | Only if you upload |
| Messages | Content and metadata of messages between users | You and the other user | Only if you message |
| Social login data | Name, email, profile photo, provider account ID | Social login provider, with your permission | Only if you use social login |
| Push and notification data | Push tokens, notification preferences, delivery status | Your device; push provider | Only if you enable notifications |
| Usage and analytics data | Pages viewed, features used, searches, clicks, session duration, referral source | Your device | Yes, subject to your cookie choices |
| Marketing data | Marketing consents, preferences, email open and click data, campaign response | You; email provider | Only if you consent |
| Advertising data | Advertising identifiers, pixel data, audience segments | Your device; ad platforms | Only with your consent |
| Support data | Support tickets, correspondence, call notes, complaint records | You | Only if you contact us |
| Safety and fraud data | Reports made and received, moderation decisions, enforcement actions, fraud signals, blocked-device signals | You; other users; automated systems | Only where relevant |
4.4.1 Do not enter information about other people into pet records. Free-text fields such as "medical notes" and "special needs" are for information about your animal. Do not enter health information about yourself, family members or anyone else. If you do, we will treat it with additional protection, but the better outcome is that it is never entered.
4.4.2 Do not send us sensitive information you do not need to send. We do not ask for information about your health, race, religion, political opinions, sexual orientation, trade union membership, or biometric or genetic data, and we do not want it.
4.5.1 Information about your pet is not, in itself, personal data about a human being. Data protection law protects people, not animals.
4.5.2 But pet data can still be about you. A pet's vaccination record is linked to your account and tells someone something about you and your household. A pet's location tells someone where you are. We therefore treat pet data linked to your account as your personal data, and give it the same protection.
5.1 Why this has its own section. A pet tracker is attached to an animal that lives in your home and travels with you. Location data from that tracker reveals where you live, when you are out, where you go and what your routine is. Treated carelessly, it is the most dangerous data we hold. So we treat it separately.
5.2.1 You control the tracking. You buy the device, you fit your own SIM, and you decide whether it transmits at all. You turn transmission on and off, you set how often it records, and you set your own geofences. If you turn it off, we receive nothing.
5.2.2 When transmission is on, we collect: GPS coordinates; timestamps; location history; movement derived from those points; geofence entry and exit events; and technical information about the device such as battery level and connection status.
5.2.3 How the data reaches us. The device records locations on the device itself. When it has a working connection it sends the stored records to us, usually in a batch. Without a connection it cannot transmit, and the data stays on the device until a connection is available.
5.2.4 The recording interval is yours to set. More frequent recording means more detail and shorter battery life. Less frequent recording means fewer data points. It is your choice, and you can change it whenever you like.
5.2.5 Your SIM is your own arrangement. The device uses a SIM card you provide. Your mobile network operator is your provider, not ours - its handling of your connection data is governed by your agreement with them, not by this policy.
5.2.6 We do not collect Wi-Fi-based location. If that changes, we will update this policy and tell you before it starts.
5.2.7 Separately from the tracker, we may derive an approximate location from your IP address, and - only with your permission - a device location where you use a feature that needs one, such as searching for services near you.
5.2.8 How we hold it. Location data is stored end-to-end encrypted.
| Purpose | Legal basis (EU/UK/Albania) |
|---|---|
| Providing the GPS Service you subscribed to - showing your pet's location and history | Contract |
| Sending alerts you have configured, such as geofence alerts | Contract |
| Sharing your pet's location with other users through location sharing or nearby-pet search | Consent - separate, opt-in, revocable |
| Diagnosing device and service faults | Legitimate interests - keeping the service working |
| Investigating misuse of tracking, including suspected tracking of a person | Legitimate interests and legal obligation |
5.3.1 We do not use location data for advertising, and we do not share it with advertising platforms. This is an architectural rule, not just a policy.
5.3.2 We do not sell location data, and we do not share it with data brokers.
5.4.1 By default, only you.
5.4.2 Location sharing is off by default. It is on only if you turn it on.
5.4.3 Where you enable sharing, we reduce the precision of the location shown to other users. We do not publish your pet's exact coordinates. The location others see is deliberately approximate, and the imprecision is applied in a way that cannot be defeated by looking repeatedly.
5.4.4 The location shown to other users is deliberately imprecise.
5.4.6 You can turn sharing off at any time, immediately, in your settings.
5.5.1 Location history is retained for up to approximately 4 months, or a shorter period if you select one where settings allow.
5.5.2 You can delete location history at any time.
5.5.3 When you cancel the GPS Service or delete your account, location history is deleted in accordance with §14.
5.6.1 GPS Devices are for tracking your own animal. Using one to monitor a person is a serious breach of our Terms, may be a criminal offence, and will result in termination and may be reported to the authorities.
5.6.2 If you believe someone is using our service to track you, contact us immediately at safety@wowpetspalace.com. We will treat it as urgent.
6.1 For users in the EU/EEA, UK and Albania, we must have a legal basis for every processing activity. This table sets them out. We do not rely on consent for everything - consent is the right basis for optional things, and the wrong basis for things we must do to run the service.
| # | Processing activity | Data used | Purpose | Legal basis | Our role |
|---|---|---|---|---|---|
| 1 | Account creation and management | Account, age, device | Create and secure your account, authenticate you | Contract | Controller |
| 2 | Age confirmation | Age confirmation | Ensure the Platform is used only by adults, as our Terms require | Contract; Legal obligation | Controller |
| 3 | Publishing Listings | Marketplace, content, pet profile | Display your listing so others can find it | Contract | Controller |
| 4 | Adoption listings | As above | Enable rehoming | Contract | Controller |
| 5 | Animal traceability information in listings | Identity, licence numbers, microchip and registration numbers | Comply with animal identification, registration and licensing law | Legal obligation; Contract | Controller |
| 6 | Pet sitter connections | Account, listings, messages, reviews | Enable bookings | Contract | Controller |
| 7 | Order processing and fulfilment | Order, address, payment | Sell and deliver Our Products | Contract | Controller |
| 8 | Payment processing | Payment, order | Take payment, prevent payment fraud | Contract; Legal obligation (AML, tax) | Controller / provider is independent controller for its own purposes |
| 9 | Subscription billing | Payment, account | Bill the GPS Service | Contract | Controller |
| 10 | Refunds and returns | Order, payment | Honour statutory and contractual rights | Contract; Legal obligation | Controller |
| 11 | Pet profiles and health records | Pet profile, pet health | Let you record and manage your animal's information | Contract | Controller |
| 12 | Making pet information public | Pet profile, pet health | Show what you choose to show | Consent | Controller |
| 13 | GPS tracking (your own view) | Location, telemetry | Provide the service you paid for | Contract | Controller |
| 14 | Location sharing and nearby-pet search | Location | Let others see your pet's approximate location | Consent | Controller |
| 15 | Messaging | Messages, account | Let users communicate | Contract | Controller |
| 16 | Reviews and ratings | Reviews, account | Build trust in the marketplace | Contract; Legitimate interests | Controller |
| 17 | Content moderation and enforcement | Content, messages, safety, device | Keep the Platform lawful and safe; comply with platform law | Legal obligation; Legitimate interests - protecting users and animals | Controller |
| 18 | Fraud prevention and security | Device, safety, usage, account | Detect and prevent fraud, scams, abuse and unauthorised access | Legitimate interests; Legal obligation | Controller |
| 19 | Customer support | Support, account, order | Answer you and resolve problems | Contract; Legitimate interests | Controller |
| 20 | Service emails (transactional) | Account, order | Confirmations, delivery updates, security alerts, service notices | Contract | Controller |
| 21 | Marketing emails | Marketing, account | Send you offers and news | Consent (soft opt-in where lawful - see §8) | Controller |
| 22 | Analytics | Usage, device, cookies | Understand how the Platform is used and improve it | Consent where cookies or similar are used | Controller |
| 23 | Advertising and retargeting | Advertising, usage, cookies | Show relevant ads | Consent | Joint or independent controllers with ad platforms - see §10 |
| 24 | Product improvement | Usage, aggregated data | Improve features | Legitimate interests | Controller |
| 25 | Legal claims | Any relevant | Establish, exercise or defend legal claims | Legitimate interests; Legal obligation | Controller |
| 26 | Accounting and tax | Order, payment | Keep records the law requires | Legal obligation | Controller |
| 27 | Responding to authorities | Any relevant | Comply with lawful requests | Legal obligation | Controller |
| 28 | Emergency situations | Location, account, contact | Protect someone's life in a genuine emergency | Vital interests | Controller |
6.2 For processing marked Contract, providing the data is necessary to use the relevant feature. If you do not provide it, we cannot provide that feature.
6.3 For processing marked Consent, it is entirely optional. You can refuse, and you can withdraw consent at any time without affecting anything else. Withdrawing does not affect processing that already happened.
6.4 Vital interests (row 28) is deliberately narrow. It covers a genuine emergency threatening someone's life - for example, a lawful and urgent request from emergency services. It is not a general-purpose basis and we will not use it as one.
Where we rely on legitimate interests, we have weighed our interest against your rights. In summary:
| Interest | Why it is legitimate | How we limit the impact | Your right |
|---|---|---|---|
| Keeping the Platform safe and lawful | Users and animals are at real risk from fraud, cruelty and abuse on pet marketplaces | Access restricted to trained staff; retention limited; automated flags reviewed by a person before significant action | Object (§15) |
| Preventing fraud | Pet sales fraud is common and causes serious financial and emotional harm | Only data needed for the purpose; no automated decisions with legal effect without human review | Object |
| Security | Protecting accounts and infrastructure | Standard security telemetry only | Object |
| Improving the Platform | We need to know what works | Aggregated and pseudonymised wherever possible | Object |
| Publishing reviews | A marketplace without reviews is less safe | Reviews tied to genuine transactions; personal data of others prohibited | Object |
6.5.1 You can ask for our full legitimate interests assessment for any of these by emailing legal@wowpetspalace.com.
7.1 We use automated systems to help detect fraud, scams, prohibited listings and abusive content, and to rank and recommend content.
7.2 We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing, without human involvement.
7.3 Where an automated system flags your content or account, a person reviews it before we take significant action such as suspending or terminating your account.
7.4 If an automated decision does significantly affect you, you have the right to obtain human intervention, to express your point of view, and to contest the decision. Contact legal@wowpetspalace.com.
7.5 We use limited profiling to personalise what you see - for example, showing listings near you or matching pets to your stated preferences. You can object to this (§15).
7.6 We do not use profiling to make automated decisions about pricing.
8.1 We send marketing only where you have consented, or where the law permits us to email existing customers about similar products and they were given a clear chance to opt out (the "soft opt-in"), and only where that applies to you.
8.2 Marketing consent is separate from creating an account and from accepting our Terms. You can use the Platform fully without agreeing to marketing.
8.3 You can unsubscribe at any time - one click in any marketing email, or in your account settings. We act on it promptly and it is free.
8.4 Unsubscribing from marketing does not stop service messages such as order confirmations, delivery updates, security alerts and notices about changes to this policy. Those are part of the service.
8.5 We do not sell your contact details to anyone for their marketing.
9.1 We use cookies, SDKs, pixels, local storage and similar technologies. Our Cookie Policy explains them in full.
9.2 Strictly necessary technologies are used without consent because the Platform cannot work without them.
9.3 Analytics, personalisation and advertising technologies are used only with your consent in the EU/EEA. You can change your choices at any time through https://wowpetspalace.com/cookie-settings.
9.4 The rules differ between the EU and the UK. Since 5 February 2026, UK law exempts certain narrowly defined statistical and appearance cookies from the consent requirement. We currently apply the stricter EU standard everywhere, so nothing non-essential is set until you agree. If that changes, the Cookie Policy will say so.
10.1 We share personal data only as described here. We do not sell personal data.
10.2.1 Information you choose to make public - listings, public profile, public pet profiles, reviews - is visible to other users and may be visible to anyone on the internet, including search engines.
10.2.2 When you transact with another user, we share what is necessary to complete it: for example, your name and delivery address with a Seller shipping to you.
10.2.3 Messages are shared with the person you send them to.
10.2.4 The other user becomes an independent controller of that data. We cannot control what they do with it.
The table below lists categories of provider we use or may use. Inclusion does not mean a service is currently active. Providers marked Under consideration are not currently in use.
| Provider / service | What it may process | Why we use it | Role | Status | Consent needed? |
|---|---|---|---|---|---|
| Cloudflare | All data stored on the Platform | Hosting and infrastructure | Processor | Live | No - contract/legitimate interests |
| Google Firebase | Device tokens, crash logs, app usage, authentication data | App infrastructure, push notifications, crash reporting | Processor | Not currently in use | Depends on component |
| Google Analytics 4 | Usage, device, IP, pseudonymous identifiers | Understanding Platform use | Processor / Google also processes for its own purposes | Live | Yes |
| Google Tag Manager | Tag delivery; may enable other tags | Managing tags | Processor | Not currently in use | Depends on tags deployed |
| Google Maps | Location, IP, device | Displaying maps | Independent controller for its own purposes | Not currently in use | Yes where it sets storage |
| Google Sign-In | Name, email, profile photo, account ID | Social login | Independent controller | Not currently in use | You choose to use it |
| Google Ads | Advertising identifiers, conversion data | Advertising | Joint / independent controller | Not currently in use | Yes |
| Stripe | Payment, order, billing, fraud signals | Payment processing | Processor and independent controller (fraud, compliance) | Live | No - contract |
| PayPal | Payment, order, billing | Payment processing | Independent controller | Live | No - contract |
| Meta / Facebook Pixel | Advertising identifiers, page and event data | Advertising measurement | Joint controller for collection and transmission | Not currently in use | Yes |
| Meta Ads | Audience data, advertising identifiers | Advertising | Joint / independent controller | Not currently in use | Yes |
| Microsoft Clarity | Session recordings, clicks, scrolls, device | Understanding user behaviour | Processor / Microsoft also processes for its own purposes | Live | Yes |
| Namecheap | Email, name, campaign engagement | Sending transactional and marketing email | Processor | Live | No for service email; yes for marketing |
| Namecheap | Phone number, message content | Verification and alerts | Processor | Live | Depends on message type |
| Your mobile network operator | Connection data for the SIM you supply | You supply your own SIM. Your operator is your provider, not ours, and its handling of your data is governed by your agreement with them | Not our processor | - | - |
| FedEx, DHL and other carriers | Name, address, phone, order reference | Delivering orders | Independent controllers | Live | No - contract |
| OpenAI | Not currently in use | Pending | Processor | Under consideration | Pending |
| Anthropic | Not currently in use | Pending | Processor | Under consideration | Pending |
11.1 We are based in Albania. Albania has not received an adequacy decision from the European Commission. Its data protection law, Law No. 124/2024, was enacted expressly to align with the GDPR, and Albania is a party to Council of Europe Convention 108, but that is not the same as adequacy.
11.2 What this means in practice - and what it does not mean. Where you give us your data directly, you are dealing directly with an Albanian company that is subject to the GDPR because of the services it offers you. That is not a "transfer" in the technical sense - the GDPR applies to us directly, and the protections in this policy apply to you in full.
11.3 Transfer safeguards are required where we send your data on to service providers outside your region, or where a provider inside your region sends it to us. For those flows we rely on:
11.4 Albanian Law 124/2024 separately requires us to carry out and document a transfer risk assessment for transfers out of Albania.
11.5 Where your data is stored. Our infrastructure is provided by Cloudflare, and data is stored on servers located in the United States.
11.5.1 This means personal data of users in the EU/EEA and the UK is stored outside those regions. We rely on Standard Contractual Clauses approved by the European Commission, and the UK Addendum, together with a documented transfer risk assessment, to protect it. You can ask us for a copy of the safeguards at legal@wowpetspalace.com.
11.6 You can ask for a copy of the safeguards we rely on by emailing legal@wowpetspalace.com.
12.1 We keep personal data only as long as we need it, then delete or anonymise it.
| Data | Retention period | Why |
|---|---|---|
| Account data | For the life of the account, then 30 days after deletion | Providing the service; allowing account recovery |
| Age confirmation record | Life of the account + 30 days | Demonstrating the account was opened by an adult |
| Identity and licence data (Sellers) | Life of the account + period required by law | Legal obligation; fraud prevention |
| Listings | Until deleted by you, or 90 days after the listing expires | Providing the service |
| Order and transaction records | 7 years - set by tax and accounting law | Accounting and tax law |
| Payment records | As above; card data not stored by us | Legal obligation |
| Pet profiles and health records | Until deleted by you, or account deletion | Providing the service |
| Location history | Up to approximately 4 months (subject to review - see §5.5) | Providing the GPS Service |
| GPS device telemetry | 12 months | Service operation and fault diagnosis |
| Messages | 24 months - retained longer where subject to a report or investigation | Providing the service; safety |
| Reviews | Retained after account deletion in anonymised form | Marketplace integrity |
| Content (photos, videos) | Until deleted by you, or account deletion | Providing the service |
| Support correspondence | 2 years | Resolving and evidencing complaints |
| Moderation and enforcement records | 3 years from the action | Enforcing terms; preventing evasion; legal obligations |
| Fraud and security records | 3 years | Fraud prevention; legal claims |
| Marketing consent records | Until withdrawn + 3 years | Demonstrating consent |
| Suppression list (unsubscribes) | Indefinitely | So we do not email you again - deleting this would defeat its purpose |
| Analytics data | 14 months | Improving the service |
| Server and access logs | 12 months | Security |
| Backups | Overwritten on a rolling 30-day cycle | Disaster recovery |
12.3 Where a period is longer than needed for the original purpose, it is because a legal obligation, a live dispute, or a safety or fraud investigation requires it.
13.1 We take the security of your data seriously and use technical and organisational measures to protect it.
13.2 Measures we have in place:
13.3 Measures we are working towards. We are not there yet on all of these, and we would rather say so than imply otherwise:
13.3.1 We do not hold any security certification. We are not ISO 27001 certified, we do not hold a SOC 2 report, and we do not claim either.
13.4 No system is completely secure. We cannot guarantee absolute security, but we work to protect your data and to respond quickly if something goes wrong.
13.5 Your part. Use a strong, unique password. Do not share your login. Enable multi-factor authentication if available. Tell us immediately if you suspect unauthorised access.
14.1 We have procedures to detect, investigate, contain and report personal data breaches.
14.2 Where a breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, where required.
14.3 Where a breach is likely to result in a high risk to you, we will tell you without undue delay, and explain what happened, what data was involved, what we are doing, and what you should do.
14.4 We notify authorities and individuals in the USA in accordance with applicable state breach notification laws.
14.5 We keep a record of all breaches.
15.1 Your rights depend on where you live. This section sets out the core rights; §§18–19 add regional detail.
| Right | What it means |
|---|---|
| Access | Get confirmation of whether we process your data, a copy of it, and information about how we use it |
| Rectification | Have inaccurate data corrected and incomplete data completed |
| Erasure | Have your data deleted, where one of the legal grounds applies |
| Restriction | Have us limit what we do with your data while a dispute is resolved |
| Objection | Object to processing based on legitimate interests, and absolutely object to direct marketing |
| Portability | Receive data you gave us in a structured, machine-readable format, and have it sent to another provider where technically feasible |
| Withdraw consent | Withdraw consent at any time, for anything based on consent |
| Human review | Obtain human intervention in relation to automated decisions that significantly affect you |
| Complain | Complain to a supervisory authority |
15.3.1 Many things you can do yourself, immediately, in your account settings: correct your details, download your data, delete content, change privacy and location settings, manage marketing preferences, delete your account.
15.3.2 For anything else, email legal@wowpetspalace.com or use https://wowpetspalace.com/privacy-request.
15.3.3 It is free. We do not charge, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse - and we will explain why.
15.4.1 Identity. We need to be satisfied you are who you say you are, to avoid disclosing your data to someone else. We ask for the minimum needed. Usually, verifying you control the account email is enough.
15.4.2 Timing. We respond within one month in the EU/EEA, UK and Albania, and within 45 days in the USA. We may extend where a request is complex, and will tell you why within the original period.
15.4.3 Limits. Some rights are not absolute. We may not be able to delete data we must keep by law, or that we need to establish or defend a legal claim, or that is needed to protect another person. If we cannot do what you asked, we will tell you why, and tell you how to complain.
15.5.1 Please raise concerns with us first at legal@wowpetspalace.com - we would rather fix things directly.
15.5.2 But you can always complain to a supervisory authority. See §§18–19 for the one that covers you.
16.1 You must be 18 or over to use Wow Pets Palace. We do not offer accounts to anyone under 18, in any form.
16.2 The Platform is not directed to children, and we do not knowingly collect personal data from anyone under 18.
16.3 What we do if we find an underage account. If we become aware, or have reasonable grounds to believe, that an account is held or used by someone under 18, we suspend it immediately, stop processing the data other than as needed to resolve the situation, and delete the account and the personal data. We keep only a minimal record of the action so the account cannot simply be recreated.
16.4 We do not show advertising to anyone we believe to be under 18, and we do not knowingly sell or share the personal information of anyone under 18.
16.5 If you are a parent or guardian and you believe your child has created an account, contact us at legal@wowpetspalace.com and we will delete it.
16.6 Reporting. If you believe someone under 18 is using the Platform, tell us at safety@wowpetspalace.com. We treat these reports as a priority.
17.1 We may update this policy. The current version is always at https://wowpetspalace.com/privacy.
17.2 For material changes - new purposes, new categories of recipient, new international transfers, changes that reduce your rights - we will give at least 30 days' notice by email and on the Platform before they take effect.
17.3 Where a change requires your consent, we will ask for it. We will not start a new consent-based processing activity until you agree.
17.4 Previous versions are available at https://wowpetspalace.com/privacy/archive.
18.1 If you are in the EU or EEA, the EU GDPR applies and this section adds to the above.
18.2 Legal bases are set out in §6. We rely on Articles 6(1)(a) consent, 6(1)(b) contract, 6(1)(c) legal obligation, 6(1)(d) vital interests, and 6(1)(f) legitimate interests.
18.3 Special category data. We do not intentionally collect Article 9 special category data. Information about your animal's health is not special category data, because Article 9 concerns the health of a natural person. However, if you enter information about a person's health into a free-text field, that is special category data - which is why §4.4.1 asks you not to. Where we identify such data, we apply additional protection and will delete it where appropriate.
18.4 Your rights are those in Articles 15 to 22, as set out in §15.
18.5 Right to complain. You may complain to the supervisory authority in the Member State where you live, work, or where the alleged infringement occurred. A list is at edpb.europa.eu.
18.6 Our EU establishment.. You may contact us on any matter relating to your data at legal@wowpetspalace.com.
18.7 Content moderation. Where we restrict your content or account, you have rights under the Digital Services Act, set out in our Terms and Conditions, Annex A.
19.1 If you are in Albania, Law No. 124/2024 "On Personal Data Protection", in force since 1 February 2025, applies.
19.2 Your rights under that law substantially mirror those in §15.
19.4 International transfers. We carry out and document a transfer risk assessment for transfers of personal data out of Albania, as required.
19.5 Supervisory authority. You may complain to:
Commissioner for the Right to Information and Protection of Personal Data (IDP) Rruga Abdi Toptani, Tirana, Albania - idp.al
20.1 We have not appointed a Data Protection Officer, and on our current scale we do not believe we are required to. We keep this under active review.
20.2 This is deliberately left open rather than answered, because the answer depends on facts that are not yet settled. The analysis is set out in Part I (GDPR / Data Processing Information).
20.3 In summary: a DPO is required under GDPR Article 37(1)(b) where core activities consist of processing operations requiring regular and systematic monitoring of data subjects on a large scale.
20.4 The conclusion is therefore likely "no DPO required at launch, but this must be reassessed as the GPS subscriber base grows." The GPS product is the single factor most likely to convert that answer to yes.
20.5 We will keep this under review and will appoint a DPO if the position changes. We review this at each financial year end, and at every 10,000 additional GPS subscribers.
Privacy and data protection: legal@wowpetspalace.com
Wow Pets Palace Wow Pets Palace Rruga Irfan Tomini, Tirana 1001, Albania