Privacy Policy of the East Gate Mall mobile application

Last updated: 5 October 2026

1. About this policy

This is the privacy policy of the East Gate Mall mobile application for Android and iPhone (“the app”), listed as “East Gate Mall” on Google Play (developer name “Skopje East Gate”) and on the App Store. It explains which personal data version 1.3.64 of the app accesses, collects, uses and shares, why, for how long, and your choices and rights.

It covers the app only. The mall's website and its other processing of personal data are not covered here; for them see https://eastgatemall.mk/en/privacy. Version 1.3.64 of the app also shows older texts written before some of its features existed. Where they say something different, this policy describes how the app handles your data today.

2. Who is responsible

The controller of your personal data is EAST GATE MALL DOOEL import-export Skopje, with registered seat at Str. Belasica no. 2, 1000 Skopje, Gazi Baba, Republic of North Macedonia, EMBS 7339046, EDB 4043019526203 (“East Gate Mall”, “we”).

You can write to our Personal Data Protection Officer by e-mail at personal.data@seg.mk or by post at the address above.

3. Location and Bluetooth

The app accesses the precise and approximate location of your phone and scans for the mall's Bluetooth beacons. It does so only when it holds the phone's location permission, and also in the background, when the app is not in use. On Android, a foreground service keeps scanning after you leave the app and shows the notification “East Gate scanner active · Tap to manage”; if you have turned the app's notifications off, it scans without it. On iPhone, the app asks for “While Using the App” and then “Always”, and the system can start the app when the phone comes within range of the mall's beacons. Location is used for “Nearby offers” (notifications about offers of stores you pass, and statistics about visits to stores), for the check “near the mall” that keeps scanning to about 1 km around the mall between 09:00 and 22:00, for an evening reminder to scan your receipts, for QR rewards that can be claimed only at the mall, and for the position marker in indoor navigation. What leaves the phone: which beacons it hears and the store derived from them, your visits to stores and their length; for navigation, the floor and the point on the floor plan where you start; latitude and longitude only when you claim a QR reward that requires you to be at the mall. The position read for the check “near the mall” stays on the phone. Visit records are kept on our servers under a pseudonym for 180 days and used for statistics, which staff accounts of our system can open; the coordinates of a QR reward claim are kept in your loyalty account, with no deletion period set. The records themselves are not passed to advertisers or to the stores. To switch this off, use the “Nearby offers” switch in the app or withdraw the phone's Location permission.

“Nearby offers” is on unless you switch it off; scanning can start as soon as the app has the location permission, for example because you allowed location for a QR reward, in an earlier version of the app or in the phone's settings. For a QR reward the phone asks for location without an explanation by the app. On Android the app does not ask for “Allow all the time”.

In detail

Beacon events are sent only while you are signed in: entering or leaving the mall or the area of a store, a beacon detected, a nearby-offer notification requested, shown, withheld or tapped, with the time, the store, the signal strength and the time spent there, without GPS coordinates; also whether location, Bluetooth and notifications were allowed. They are stored under a pseudonym (a code computed from your account identifier and a secret key) and are not anonymous: we hold the key, and the same code is written into your receipt-scan and coupon records, which is how visits are related to purchases.
To choose, withhold or adapt a nearby offer, our server uses your points balance and your history of scanned receipts; its decision is kept under the same pseudonym for 90 days.
For navigation, our routing service also receives the destination, route options, search words and the code of a scanned QR plate. It keeps one record per route request (time, start floor, destination, distance, result) under its own pseudonym, without the start point and the plate code; no deletion period is set. Your moving position is computed on the phone and not sent continuously.
Each nearby-offer notification shown to you is also saved, with the store, the offer and the time, in the notification list of your account at Google Cloud Firestore (section 8); this record is not under a pseudonym.

Statistics and who sees them

The statistics computed from beacon events show totals for groups, not the records of one person. Administrators of our system can list the individual events, which carry the pseudonym and not your name. With the settings in force in the software today, a store appears in them only if at least 10 different app users were detected there in the period, a movement between two stores only with at least 3, and a path of three or four stores only with at least 5; the overview also gives plain totals without such a minimum (per store, nearby-offer notifications shown and tapped and receipts that followed; per zone, detections and different users of the last seven days). Staff accounts of our system, including accounts used by stores of the mall, can open these statistics. Reports are also e-mailed to the recipients we set.

How to switch it off

In the app: Settings > Notification preferences > “Nearby offers”. Scanning stops at once; the last event of an open visit is still sent within a few minutes. In the current version the check “near the mall” continues about every 15 minutes while the app runs; its result is then not used.
On the phone: withdraw the app's Location permission. This ends every use of location, and with it nearby-offer notifications, the moving position marker in navigation and QR rewards that require presence.

4. Account and profile

The app shows stores, offers and events without an account; the loyalty programme and the personal features need one.

Sign-in: with your phone number and an SMS code, or with your Google or (on iPhone) Apple account and a phone number, through Google Firebase Authentication, which holds your phone number, name and e-mail address.
Profile: name, surname, e-mail address and, if you choose to give them, date of birth, gender, city and interests; stored in Google Cloud Firestore with your consents (terms and privacy policy; newsletter box), saved offers and events, visit list and reminders.
Loyalty account on our server: Firebase account identifier, 13-digit member code (Loyalty ID), e-mail address, points balance, time of last use, date of birth if given, referral code and referrer, scan-streak counters, e-mail unsubscribe times, and the block mark and internal notes staff can add.
App lock (optional) is checked by the phone itself; no biometric data reaches us.

5. Loyalty programme and receipts

To earn points you photograph a fiscal receipt. The text of a QR code in the photo is first sent to our server to ask whether it is a reward code; otherwise the photo is uploaded as a receipt, with details of how it was taken.
From it we read the receipt number, date, time and total, the store (fiscal device number, tax number, category), the data-matrix code and whether the scan was accepted; for rejected photos, part of the recognised text.
The photo is stored with Amazon Web Services under your member code, as you took it (it can show more than we need, such as card digits). A recognition service on Microsoft Azure reads its text through a link that contains your member code, not your name.
Loyalty history: points earned and spent; vouchers (code, value, when and where used, confirming staff member); points gifts (sender, recipient, amount, message); coupons, missions, badges, Lucky Spin and leaderboard results (others see a nickname), prize-game entries and referrals.
We also log the suggestion card the home screen showed you each day and every push notification and service e-mail sent to you.

6. Camera

The app records no sound and cannot open your gallery or files; the Android app declares microphone and storage permissions but never asks for them.

QR codes (a member's code for a points gift, a QR plate for navigation) are read from the live picture, which is not saved or sent; only the code's text is sent. In navigation's camera view any code in view that looks like a plate code, even a member code on another phone, is sent to the routing service.
Codes are recognised on the phone, by Google ML Kit or by iOS. Google states that ML Kit does not send the images to Google, but sends device and app information, per-installation identifiers and performance data.

7. Contacts

The app reads your contacts (names and phone numbers) only when you open “Invite from contacts” and tap “Choose contacts”, and does not upload them. When you tap WhatsApp, Viber or SMS next to a contact, that application receives the number and the invitation text. Invited numbers stay on your phone until you sign out or delete your account.

8. Notifications and e-mail

Google Firebase Cloud Messaging delivers notifications and gives the app a push token, which the app registers on our server while you are signed in, with the platform, app and system versions, language and whether notifications are allowed.
The app subscribes the phone at Firebase Cloud Messaging to groups for the app language, nearby offers, mission reminders and, if you gave them, your gender, age band and interests; the language, gender, age and interest subscriptions stay when you sign out or delete your account.
Every notification shown is also saved in your account in Google Cloud Firestore (title, text, time, links, whether opened), up to 150 entries, unopened ones up to 500.
We send e-mails about your membership (points, vouchers, gifts, expiring vouchers), and marketing e-mails only if you ticked the newsletter box at sign-up; these and voucher reminders carry an unsubscribe link.
Settings > Notification preferences has three switches: announcements and campaigns, nearby offers, and mission reminders. Personal notifications about your account (points, vouchers, gifts, reminders) have no switch in the app; you can turn off all notifications of the app in the phone's settings. The newsletter choice cannot be changed in the app. To withdraw your newsletter consent, write to us at the address in the last section.

9. Device data and technical records

Crash reports go to Google Firebase Crashlytics: the error trace, device model and system, app version, whether and how you were signed in, and your Firebase account identifier. The app has no switch for this.
Firebase App Check (Google Play Integrity on Android, Apple DeviceCheck on iPhone) lets Google check that requests come from the genuine app; Firebase also creates installation identifiers and records whether an in-app message was displayed and tapped.
The Android app uses no advertising ID and contains neither an advertising component nor Google Analytics. The iPhone app contains the Google Analytics for Firebase library. Our own code sends no events through it; the library can collect usage and device data by itself.
The app downloads its font from Google Fonts, and Settings > Air Quality shows a web page of another provider (app.aq-safe.com); each then receives the phone's IP address.
Our web servers keep access logs, which contain IP addresses and the addresses requested, for 14 days. Our servers also keep log files that can contain your member code and an audit log of changes staff make to your records.

10. Purposes and legal bases

Contract (the terms of the account and the loyalty programme): your account, receipts and points, vouchers and coupons, gifts, referrals, the prize game and other loyalty features, and membership messages.
Your consent: the data you give optionally, the newsletter and other commercial messages, and the phone functions you allow (location and Bluetooth, camera, contacts, notifications). You can withdraw it at any time.
Our legitimate interest in protecting our systems and preventing abuse and fraud: technical records, crash reports, the app-integrity check, and checking receipts for duplicates and misuse.
Our legitimate business interest in encouraging trade in the mall and improving and personalising the programme and its offers: analysing how the programme and the app are used and your purchase history from scanned receipts, and choosing the offers shown to you.
Legal obligation: where a law requires us to keep data or hand it over.

Our server decides automatically which nearby offer you are shown, or that none is, from your points balance, receipt history and earlier notifications, and selects who receives reminders and other personal notifications from account activity. Some users are placed in a comparison group that does not get a particular offer or kind of message.

11. Who receives your data

We do not sell your personal data. Inside East Gate Mall, access is limited to staff who need it for their work.

Mall staff, according to their permissions, see member accounts, receipts with photos, points, vouchers and other loyalty records; staff reports contain member codes and e-mail addresses. Administrators can list the sign-in accounts at Firebase. Authorised staff can export the e-mail address, name, surname and city of members together with their newsletter choice.
When you redeem a voucher or a coupon, store staff see (also by e-mail) your member code, the voucher code, its value and creation date, not your name, contact details, receipts, purchase history or location. Accounts used by stores can also open the statistics pages of our system (section 3).
The recipient of a points gift sees the sender's member code, the amount and the message; the sender sees the recipient's member code.

We use service providers who process data on our behalf and under our instructions:

Google LLC: the Firebase services, ML Kit and Google Fonts named in sections 4 to 9, and Google Sign-In.
Apple: Sign in with Apple and DeviceCheck.
Amazon Web Services: the receipt photos and the encrypted weekly backup of our database.
Microsoft (Azure): reading the text of receipt photos; daily export files of receipt scans and vouchers for the mall's reporting (member code, e-mail address, store, amounts, link to the photo).
The provider that delivers our e-mails; the hosting provider of our servers; the company that develops and operates the app and its servers for us, whose technical reports can contain member codes and e-mail addresses.

Data also reaches: the application you choose when you share an invitation, with the invitation text and a chosen contact's number; the provider of the air-quality page; competent authorities, on their order or where needed to meet our legal obligations or protect our rights; third parties in a reorganisation or transfer of our business.

12. Transfers outside North Macedonia

Our own servers for the app are in North Macedonia. Data handled by Google, Apple, Amazon Web Services and Microsoft is transferred and processed outside North Macedonia; Google states that Firebase Authentication processes data exclusively in the United States.

Where we send personal data to recipients outside the member countries of the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, we do so in accordance with the measures prescribed by law, for example standard contractual clauses.

13. How long we keep data

We keep personal data only as long as the purpose of the processing or the applicable regulations require. Our systems apply these rules:

Beacon events 180 days, offer decisions 90 days, statistics reports 400 days; the pseudonym code stays in your receipt-scan and coupon records.
Sign-in account and profile at Google Firebase: until you delete your account in the app; Google states that it then removes the data within 180 days and keeps crash data for 90 days. Push token: until you sign out, delete your account or it becomes invalid.
Loyalty records on our server (sections 4 and 5, with QR-reward claims and their coordinates): the system does not delete these automatically. We keep them for the duration of your membership; after you delete your account, see section 16.
Navigation records: no deletion period is set.
Backup copies of the database are made every week and kept for 84 days.
Export files, staff reports and the audit log are not deleted automatically; application log files are overwritten when they reach a set size.
On your phone: the app's settings and temporary files (such as notification pictures and receipt photo files) stay until you clear the app's data or remove the app.

14. Security

Data travels between the app, our servers and Firebase over encrypted connections; our servers accept a request for your account only with a valid sign-in token. Staff use individual accounts with permissions per kind of record and a second sign-in step by e-mail code.

15. Your choices and your rights

Your choices are described in sections 3, 8 and 16; your name, e-mail address and date of birth can be changed in Profile > Edit Profile.

You have the right to be informed about the processing of your personal data; to access your data and get a copy; to have it corrected and deleted; to restriction of the processing; to object to processing based on our legitimate interest and, at any time, to direct marketing and related profiling; to data portability; not to be subject to automated processing, including profiling, that has legal consequences for you or significantly affects you; and to withdraw a consent at any time, for the future.

To use these rights, write to our Personal Data Protection Officer from the e-mail address of your account, or state your member code; we can find location records stored under a pseudonym because we hold the key. We answer within the time the law sets. Where processing is an essential part of the loyalty programme, we may be unable to stop it or delete the data without deleting your membership account.

16. Deleting your account and your data

To delete your East Gate Mall app account and the data linked to it without using the app, write to our Personal Data Protection Officer at personal.data@seg.mk, naming the app and the e-mail address or phone number of your account, or your member code. We answer within the time the law sets. You can also end your loyalty membership by e-mail to loyalty@seg.mk.

In the app: Profile > Edit Profile > “Delete Account”. This removes your sign-in account (Google Firebase Authentication); your profile, consents, notification list, saved items, visit list and reminders (Google Cloud Firestore); and your phone's push registration on our server.

Your loyalty records on our servers (receipts and their photos, points, vouchers and the other records of section 5) are not removed by that step. To have them erased, write to personal.data@seg.mk. If you later create an account with the same e-mail address, a weekly process attaches the points and vouchers of the earlier account to the new one.

That step also leaves: beacon events and offer decisions under their pseudonym, until they are deleted (section 13); navigation records; the pseudonym in your receipt-scan and coupon records; your interests held at Google and the phone's notification-group subscriptions; copies in existing backups, export files and reports.

17. Complaints and the supervisory authority

You can complain to our Personal Data Protection Officer, and you have the right to submit an objection to the Personal Data Protection Agency (AZLP) if you believe that your right to personal data protection has been violated: bul. “Goce Delchev” no. 18, 1000 Skopje; info@privacy.mk; https://azlp.mk. You can also submit a lawsuit to the competent court.

18. Children

Membership in the loyalty programme is available only to persons over the age of 18. The app does not ask or verify your age; its optional date-of-birth field accepts only dates at least 6,570 days (about 18 years) back. Parents or guardians can contact our Personal Data Protection Officer about a child's data.

19. Changes to this policy

We change this policy when the app or the way we handle personal data changes. The date of the last update is shown at the top.

20. Contact

EAST GATE MALL DOOEL import-export Skopje, Str. Belasica no. 2, 1000 Skopje, Gazi Baba, Republic of North Macedonia.

Personal data and your rights: Personal Data Protection Officer, personal.data@seg.mk.

Loyalty programme: loyalty@seg.mk, telephone +389 71 381 454 (every day, 10:00–22:00).