A new market, an additional marketing channel, or a new feature in the online shop: at HOLY, change is part of everyday life. Numerous processes now span various channels and countries. And wherever customer data is processed, data protection plays a role.

For a long time, the topic was handled on the side. Individual requirements were resolved internally as they arose. But with growth, it quickly became clear that case-by-case solutions were no longer sufficient. 

Together with heyData, the company has restructured its approach. Today, there are clear workflows, dedicated points of contact, and a hub for data protection questions that actually provides help in day-to-day business.

HOLY: A brand with many touchpoints

HOLY develops modern alternatives to classic soft drinks – from energy and hydration drinks to iced tea, milkshakes, and syrups. An important part of the brand is the HOLY Squad, the community surrounding the products.

For data protection, this means a multitude of different touchpoints with customer data: from the online shop, email, and WhatsApp marketing to the rewards program, reviews, and marketplaces. 

HOLY is now active in several EU countries and the UK. This increases the demands on data protection: in addition to the overarching GDPR requirements, country-specific regulations must be taken into account.

As businesses grow, the demand for data protection increases

In the early years, HOLY focused primarily on basic data protection measures. This included employee training and a privacy policy. Individual requests or problems were solved internally on a case-by-case basis. Initially, there was no fixed structure for the topic.

The decisive change came as HOLY continued to grow: more products, more markets, more employees, and an ever-increasing number of tools in use.

Instead of just reacting to individual requirements, HOLY wanted to develop its data protection in a targeted manner and integrate it into its own processes for the long term. What was needed was a combination of professional expertise, a platform for documentation, and personal support for specific issues.

“Since we didn't have the expertise in-house, it was clear that it would have to be an external partner. And if we were going external, we wanted a 360-degree service that supports us with all GDPR topics and isn't just there on paper.” - Fabian Plato, (Interim) General Counsel at HOLY

This is exactly the combination heyData offers: an external data protection officer, a central platform, and expertise that doesn't just categorize legal requirements but provides concrete recommendations for action. In doing so, heyData addresses HOLY's individual processes and works with the team to develop suitable solutions.

Faster assessments and more security for specific data protection questions

The impact of the collaboration on day-to-day operations is most evident in specific data protection inquiries. Whether an information or deletion request comes in or a potential data breach needs to be assessed, the HOLY team now knows how to proceed. 

Rather than having to familiarize themselves with the legal requirements for each case, the team receives a well-founded assessment from heyData in a timely manner. This allows tickets to be processed faster and with greater confidence.

“Since we started working with heyData, our data protection has grown along with the company, whether it’s a new market, a new tool, or a new process.” - Fabian Plato, (Interim) General Counsel at HOLY

Operational implementation remains with HOLY. The difference: the team no longer has to research every issue from scratch and can rely on external expertise for assessments.

In parallel, the foundation for data protection work was also improved. Privacy policies were updated and localized for the various markets. Data protection processes surrounding the shop were also set up more clearly.

Data protection from a single source: Why HOLY has relied on heyData for years

HOLY and heyData have been working together for several years. During this time, HOLY has also grown: new markets, additional tools, and increasingly complex processes. The partnership has evolved accordingly - from initially reactive support to proactive guidance from heyData.

Today, HOLY particularly values the combination of an external data protection officer, a platform for documentation, and dedicated points of contact who offer pragmatic solutions to specific questions.

“With heyData, you get everything from a single source: a DPO, a platform where everything is documented, and dedicated contacts who tell you pragmatically what to do in specific cases instead of just sending you paragraphs of legal text. Especially when you are growing fast and don't want to build your own data protection department, this is a real game-changer.” - Fabian Plato, (Interim) General Counsel at HOLY

One insight from the collaboration is that, while external support can handle a lot, it also requires an internal counterpart. Data protection only became more deeply integrated into company processes at HOLY when the legal function took responsibility for the topic.

What would HOLY therefore recommend to other growing companies? Don't reduce data protection to just documents:

“The mistake you should avoid: reducing data protection to just documents. A good privacy policy is of little use if a deletion request doesn't reach every system - like your shop, email tool, WhatsApp, and reviews. The processes have to be solid.” - Fabian Plato, (Interim) General Counsel at HOLY

The development at HOLY shows how data protection can be integrated into everyday business life step by step. With clear internal responsibility, reliable external contacts, and processes that continue to work even as you grow.

‍