HAZE — The world's best sunglasses, in one place.

This Privacy Policy explains how DIGITA SHPK(the operator of the HAZE brand) collects, uses, and protects your personal data when you use our website and purchase our products. We comply with Albanian Law No. 9887 "On the Protection of Personal Data" and the principles of the EU General Data Protection Regulation (GDPR).

1. Who we are (Data Controller)

DIGITA SHPK
NIPT: M01812006I
Address: Rruga Abdyl Frasheri, Pallati HEKLA, Seksioni B, Kati 2, Ap. 1, Tirana, Albania
Email: info@haze.al
Phone: +355 69 966 6670

2. What data we collect

We collect the following categories of personal data:

Account data: first name, last name, email, hashed password, phone number (optional at registration).
Order data: products purchased, prices, shipping address (city, street, postal code, phone), payment method, order status.
Identity data from Google: if you sign in with Google, we receive your name, email, and unique Google identifier (Google ID).
Technical data: IP address, browser and device type, pages visited — only if you have consented to analytics cookies.
Communications: messages sent via the contact form or email.

3. Why we use your data (purposes and legal bases)

Performance of contract: processing your order, delivery, invoicing, and customer service. Phone number is used to coordinate delivery — without it we cannot fulfill the order.
Your consent: sending marketing emails (only if you ticked the relevant box) and optional cookies (analytics, marketing).
Legal obligation: retention of invoicing and accounting documents under Albanian law.
Legitimate interest: site security, fraud prevention, and service improvement.

4. Who we share your data with

We do not sell your data. We may share it with service providers who help us operate the business, only as strictly necessary:

Google LLC— Google authentication (when you choose "Sign in with Google").
PayPal — online payment processing (when you choose PayPal as the payment method).
Cloudinary — hosting and delivery of product images.
Logistics companies / couriers: your name, address and phone for order delivery.
Our hosting provider: the technical infrastructure protected by standard security measures.

Some of these providers (e.g. Google, PayPal, Cloudinary) may transfer data outside the European Economic Area. In such cases we rely on standard legal mechanisms (Standard Contractual Clauses or adequacy decisions).

5. How long we keep your data

Customer account: as long as the account is active. If you delete your account, the data is deleted within 30 days, except for what we are legally required to retain.
Order and invoice data: 10 years, as required by Albanian tax law.
Contact messages: up to 2 years after the inquiry is resolved.
Optional cookies: up to 12 months or until you withdraw consent.

6. Your rights

You have the right to:

request access to the personal data we hold about you;
request correction of inaccurate or incomplete data;
request erasure of your data (the "right to be forgotten");
request restriction of processing;
object to processing for marketing purposes;
request data portability (in a machine-readable format);
withdraw any consent you have given at any time (this does not affect the lawfulness of processing carried out beforehand).

To exercise these rights, contact us at info@haze.al. We respond within 30 days.

7. Complaint to the supervisory authority

If you believe your rights have been infringed, you have the right to lodge a complaint with the Commissioner for the Right to Information and the Protection of Personal Data (IDP) — the Albanian data protection authority (www.idp.al).

8. Cookies

We use cookies that are essential for the site to work (session, login, cart) and, only with your explicit consent, optional cookies for analytics and marketing. You can change your preferences at any time from the "Cookie Settings" link at the bottom of every page.

9. Data security

We apply reasonable technical and organizational measures to protect your data from loss, unauthorized access, and alteration (HTTPS connections, hashed passwords, restricted access). No system is 100% secure — if we discover an incident affecting your data, we will notify you as required by law.

10. Children

Our site is not directed at persons under 16. If we discover we have collected data from a child without parental consent, we will delete it immediately.

11. Changes to this policy

We may update this policy from time to time. The latest version will always be posted on this page with the update date. For significant changes, we will notify you by email or via a prominent notice on the site.

12. AI Try-On feature

Our website offers an AI-powered virtual try-on that places frames you are shopping onto a selfie you provide. This is an optional feature; you may use HAZE without it.

What we collect: a single selfie photo per customer (replaceable and deletable at any time), and the AI-generated try-on images you produce.
How we use it: we process the selfie and the chosen product image through our AI try-on engine to generate the result. The result is saved to your HAZE gallery so you can review and share it. Your monthly allowance (10 generations) resets after each completed purchase.
Legal basis: your explicit consent (Art. 6(1)(a) GDPR), provided at the moment you upload a selfie. You may withdraw consent and delete your selfie at any time from your account settings.
Processing: the AI engine that generates your image processes data under contractual terms that prohibit training on your selfie. Data may be processed outside the EU under appropriate safeguards (Standard Contractual Clauses).
Retention: selfies and try-on images are kept until you delete them or close your account. Closing your account removes all selfies and try-on images permanently from our storage (Cloudflare R2).
Security: stored encrypted at rest (AES-256, Cloudflare R2 default) and transmitted over HTTPS. Try-on URLs are unguessable but should not be shared publicly if you wish them to remain private.
Your rights: the rights listed in Section 6 apply in full. You can delete an individual try-on (does not refund quota) or wipe your saved selfie via your account settings.

2. What data we collect

We collect the following categories of personal data:

Account data: first name, last name, email, hashed password, phone number (optional at registration).

Order data: products purchased, prices, shipping address (city, street, postal code, phone), payment method, order status.

Identity data from Google: if you sign in with Google, we receive your name, email, and unique Google identifier (Google ID).

Technical data: IP address, browser and device type, pages visited — only if you have consented to analytics cookies.

Communications: messages sent via the contact form or email.

3. Why we use your data (purposes and legal bases)

Performance of contract: processing your order, delivery, invoicing, and customer service. Phone number is used to coordinate delivery — without it we cannot fulfill the order.

Your consent: sending marketing emails (only if you ticked the relevant box) and optional cookies (analytics, marketing).

Legal obligation: retention of invoicing and accounting documents under Albanian law.

Legitimate interest: site security, fraud prevention, and service improvement.

4. Who we share your data with

We do not sell your data. We may share it with service providers who help us operate the business, only as strictly necessary:

Google LLC— Google authentication (when you choose "Sign in with Google").

PayPal — online payment processing (when you choose PayPal as the payment method).

Cloudinary — hosting and delivery of product images.

Logistics companies / couriers: your name, address and phone for order delivery.

Our hosting provider: the technical infrastructure protected by standard security measures.

5. How long we keep your data

Customer account: as long as the account is active. If you delete your account, the data is deleted within 30 days, except for what we are legally required to retain.

Order and invoice data: 10 years, as required by Albanian tax law.

Contact messages: up to 2 years after the inquiry is resolved.

Optional cookies: up to 12 months or until you withdraw consent.

6. Your rights

You have the right to:

request access to the personal data we hold about you;

request correction of inaccurate or incomplete data;

request erasure of your data (the "right to be forgotten");

request restriction of processing;

object to processing for marketing purposes;

request data portability (in a machine-readable format);

withdraw any consent you have given at any time (this does not affect the lawfulness of processing carried out beforehand).

To exercise these rights, contact us at info@haze.al. We respond within 30 days.

12. AI Try-On feature

Our website offers an AI-powered virtual try-on that places frames you are shopping onto a selfie you provide. This is an optional feature; you may use HAZE without it.

What we collect: a single selfie photo per customer (replaceable and deletable at any time), and the AI-generated try-on images you produce.

How we use it: we process the selfie and the chosen product image through our AI try-on engine to generate the result. The result is saved to your HAZE gallery so you can review and share it. Your monthly allowance (10 generations) resets after each completed purchase.

Legal basis: your explicit consent (Art. 6(1)(a) GDPR), provided at the moment you upload a selfie. You may withdraw consent and delete your selfie at any time from your account settings.

Processing: the AI engine that generates your image processes data under contractual terms that prohibit training on your selfie. Data may be processed outside the EU under appropriate safeguards (Standard Contractual Clauses).

Retention: selfies and try-on images are kept until you delete them or close your account. Closing your account removes all selfies and try-on images permanently from our storage (Cloudflare R2).

Security: stored encrypted at rest (AES-256, Cloudflare R2 default) and transmitted over HTTPS. Try-on URLs are unguessable but should not be shared publicly if you wish them to remain private.

Your rights: the rights listed in Section 6 apply in full. You can delete an individual try-on (does not refund quota) or wipe your saved selfie via your account settings.