PRIVACY POLICY OF MAXIMA’S AITÄH LOYALTY PROGRAMME
Last updated on 10.02.2026
The Company processes your data when you join the AITÄH loyalty program, as well as during your membership in the loyalty program.
To participate in the loyalty program, you must have an AITÄH card, which can be an AITÄH plastic card and/or AITÄH digital card. You can have an AITÄH plastic card and an AITÄH digital card at the same time.
You can create a digital card using the MAXIMA app – you need to authenticate yourself with Mobile-ID, Smart-ID or ID-card. When issuing a plastic card in a store, we need your date of birth and an Estonian mobile phone number – the latter will be sent a confirmation code, which must be entered into the card payment terminal or told to the cashier. With this, the AITÄH card will be activated in the POS system and can be used.
Registering and creating an AITÄH account in the loyalty program
Based on your form data, we will create a unique account for the participant in the loyalty program in the system (hereinafter AITÄH-account). Based on this data, we can identify you as the owner of the respective AITÄH card, for example, if you exchange a worn or lost card for a new one, you want to merge the cards, you want to update or change your data, you contact us for personal information, the exercise of rights related to the processing of personal data, etc.
We also use the contact information (e-mail address, phone number) provided in your form to communicate with you, including to respond to your inquiries and comments, to provide you with important information about changes to the loyalty program, to contact you if you have forgotten your goods or wallet, or if we discover any errors in the transactions made, etc.
| Personal data | First and last name, date of birth, e-mail address and +372 prefix mobile phone number, personal identification number, preferred language of communication |
| Legal basis for processing | Article 6 (1) (b) of the General Data Protection Regulation (GDPR), i.e. performance of a loyalty programme agreement with you Article 6(1)(f) of the GDPR – legitimate interest |
| Data retention period | We will store your personal data while you participate in the loyalty programm. Wewill anonymize the data after the end of your participation in the programm. |
Receiving digital purchase receipts to your AITÄH account
| Personal data | User data about purchases made (date, place and time of purchase, receipt number, name of the products, quantity, total purchase price, amount of discounts, amount and balance of Maxima money used and collected, AITÄH card number. |
| Legal basis for processing | Article 6(1)(a) of the GDPR – With your consent Article 6 (1) (c) of the GDPR and § 12 (1) of the Accounting Act – an obligation arising from law |
| Data retention period | Digital purchase receipts are stored in the AITÄH account for two (2) years from the date of purchase. Your purchase data will be stored for seven (7) years from the date of the purchase, as this is required by law. |
Using birthday discounts and sending a notification about it
If you have securely logged in to the Loyalty Program of your AITÄH account using your ID card, Smart ID or Mobile ID and you have agreed to receive birthday discounts, we will send you a reminder (text message or e-mail) about the upcoming birthday discount.
| Personal data | Name, surname, date of birth, mobile phone number and e-mail address, personal identification code. |
| Legal basis for processing | Consent (Article 6(1)(a) GDPR). |
| Data retention period | Until you delete your app account or withdraw your consent. We will retain your consent and evidence of consent until the application account is deleted or, for a longer period of time, to defend against claims, claims or actions brought against us until a final solution is reached. |
To provide you with loyalty program offers and information
If you give your consent, we will send you newsletters and advertisements with offers from our partners, birthday discount reminders and Maxima balance notifications via the channels of your choice (SMS or e-mail).
| Personal data | Your AITÄH card number, your name, personal identification code, e-mail address and mobile phone number with +372 prefix, date of birth. |
| Legal basis for processing | The user has given consent (Article 6(1)(a) GDPR). Information notices: expiring money, birthday discounts, newsletters, changes to the privacy policy and the terms and conditions of the loyalty programme – GDPR art 6 (1) p f – legitimate interest. |
| Data retention period | During the time you participate in the loyalty program AITÄH. |
In newsletters, we use tracking pixels, which are small graphic elements in an email. They allow us to know if and when an email has been opened and which links have been clicked. We use this information to evaluate the effectiveness of our newsletters and, if necessary, to send repeat emails to recipients who have not opened the previous email.
It is possible to unsubscribe from newsletters by using the unsubscribe link provided with the notification. It is possible to unsubscribe from SMS messages by changing the channel for receiving the newsletter in the self-service.
In addition, it is possible to opt out of all notifications at once in the self-service or by contacting klienditugi@maxima.ee or by calling the information line 800 2121. We will stop sending offers to the programme as soon as possible, but no later than within seven (7) days.
Managing the AITÄH account and administering the AITÄH loyalty program
By processing this data, we can manage the AITÄH account and offer you the benefits of the AITÄH loyalty program.
| Personal data | Your AITÄH card number, the data provided during registration, the data provided in the AITÄH account (including login data to the AITÄH account, operations on the AITÄH account, technical browsing data: IP address, technical information about logging in and browsing), information about the status of the AITÄH card (active or blocked), personal data history, card activation time, consents given by you, purchase data (store address, date and time, name and quantity of products, total price (including before and after) deduction of all discounts), data on the money earned by MAXIMA (amount, amount used at the time of purchase, balance on the AITÄH account), the amount of discounts received with the AITÄH card, the history of personal offers made to you and information about their use, coupon numbers (identifying which offers are valid with the AITÄH card), technical information necessary for data transfer (e.g. session ID), information about the offers of the partners of the loyalty program AITÄH. |
| Legal basis for processing | Article 6(1)(b) GDPR, i.e. performance of the loyalty programme agreement with you Article 6 (1) (c) of the GDPR and § 12 (1) of the RPS – legal obligation |
| Data retention period | As a legal obligation, we store purchase data in the loyalty system for seven (7) years from the date of the purchase transaction. We store the rest of the data while you participate in the loyalty program AITÄH. At the end of the term, we will delete the personally identifiable data. We will only retain your personal data for the future if this is necessary for us to be able to defend ourselves in the event of claims, claims or actions against us (Article 6(1)(f) GDPR). After the disputes have reached a final resolution, the data will be deleted. |
The session ID and other data provided in the AITÄH account are necessary for the user to remain logged in, as well as for ensuring security and availability. For example, to verify account actions when actions have been performed on a user's account without their consent.
Creating statistics to analyze buyer behavior
We use automated data analysis to study statistical data, the market and consumer behaviour, and to prepare reports necessary for our business. For this analysis, we use your data, but do not process your contact information, only your personal identification code to identify your age and gender. Data analysis for the purpose of compiling statistics, our buyer behaviour and market research allows us to make important business decisions, such as designing a range of goods that meet the needs of our buyers, pricing, displaying goods, etc. Data analysis for the purpose of studying statistical indicators, the market and buyer behaviour does not bring you legal effects or have any other significant impact.
We may also analyse the data to provide additional benefits to certain categories of buyers: on the occasion of a birthday; for those who make their purchases in specific stores; for those who purchase certain products; or other offers.
Personal data | Gender and date of birth based on personal identification code, purchase data (including store, date and time of purchase, name and quantity of products, total purchase price, amount of discounts received with the AITÄH card). (When compiling statistics, no other information is used from the personal identification code than is necessary for determining a person's date of birth and gender – i.e. the result of the statistics is not personalised) |
| Legal basis for processing | The processing of personal data is necessary on the basis of our legitimate interest (Article 6 (1) (f) GDPR) It is in our legitimate interest to analyze data and prepare reports necessary for business in order to evaluate our activities and create value for both customers and the company. |
| Data retention period | Seven (7) years. If the User's participation in the AITÄH loyalty program is terminated earlier than the seven-year retention period of the purchase data, all the User's form data and other personal information will be deleted and the purchase data will be made anonymous (only the purchase history will remain) |
In which cases and to which third parties do we disclose data?
For the purpose of sending and managing newsletters, we share your personal data (name, e-mail address, date of birth, consent to receive newsletters, AITÄH account ID code) with our partner Sendsmaily OÜ, who provides e-mail marketing services. To display targeted advertising, we share an email address with Meta Platforms Ireland Limited (Facebook and Instagram). The data is used to show personalized ads based on our customers and visitors to the website/app and to create lookalike audiences to reach potential interested parties who may have similar preferences or interests.
The data may also be provided to the competent authorities or law enforcement authorities, such as the police or supervisory institutions, but only if they request it and only if it is required by the legislation in force.
We may exchange your data with Maxima Grupe companies that are partners of the AITÄH loyalty program, in particular with Supersa OÜ (Barbora online store), in order to apply discounts or promotions at the points of sale or service of the AITÄH loyalty program partners and to ensure the management of the AITÄH loyalty program.
For the purpose of administering the AITÄH loyalty program, we may forward the following information to the program partner: information about the status of your AITÄH card, detected errors regarding the status of the cards, AITÄH card number, MAXIMA cash balance on AITÄH card, coupon identification numbers, offers valid with your AITÄH card, technical information necessary for data transfer (e.g. session ID).