Personal Data Processing Policy

Version 2.0 of 2026-09-25.

1. Controller

1.1. The controller of personal data is IE Kristine Ghukasyan, TIN 26811509, ք. Երևան, Կենտրոն, Մարտի 8-ի փ., տ. 34, 0070 (Ереван, Кентрон, ул. 8 Марта, д. 34), e-mail [email protected] (the "Platform").

1.2. Processing is carried out in accordance with the Law of the Republic of Armenia "On Protection of Personal Data" (HO-49-N of 18 May 2015).

2. Data processed

2.1. Buyers: name, phone number, e-mail address, chosen pick-up point, order history, reviews and questions.

2.2. Sellers and their representatives: company name and TIN, representative's name, phone and e-mail, bank details, transaction history.

2.3. Technical data: IP address, browser data, sign-in times, cookies necessary for the website to work.

2.4. The Platform does not process special categories of personal data or biometric data.

3. Purposes

3.1. Concluding and performing contracts: placing, delivering and handing over orders, returns, settlements with sellers.

3.2. Compliance with the law: tax and accounting records, responding to requests from state authorities.

3.3. Security: account protection, fraud prevention, activity logs.

3.4. Order status notifications. Marketing messages are sent only with separate consent, which may be withdrawn at any time.

4. Legal grounds

4.1. The data subject's consent given on registration or when placing an order (in electronic form).

4.2. Necessity for performing a contract with the data subject and legal requirements.

5. Recipients

5.1. The seller of the goods — only the name and data needed to fulfil the order.

5.2. Delivery services and pick-up points, banks and payment institutions — to the extent needed for delivery and settlements.

5.3. State authorities — in the cases and manner provided by law.

5.4. Data is not sold or passed to third parties for their marketing. No cross-border transfer takes place; the Platform's servers are located in the Republic of Armenia.

6. Retention

6.1. Data is kept while the account exists and, after deletion, for as long as necessary to meet tax and accounting requirements and to defend rights in a dispute (no longer than the general limitation period of three years unless the law requires longer retention).

7. Security

7.1. Passwords are stored only as cryptographic hashes; sessions as token hashes.

7.2. Staff access is role-based; staff can sign in only with two-factor verification; staff actions are logged.

7.3. Data between the browser and the website is encrypted (HTTPS).

8. Data subject rights

8.1. Data subjects may: obtain information about their data and how it is processed; demand correction, blocking or deletion; withdraw consent; complain to the authorised personal data protection body of the Republic of Armenia or to the courts.

8.2. Requests should be sent to [email protected]. We respond within 10 business days unless the law sets another period.

9. Cookies

9.1. Only necessary cookies are used: sign-in, shopping cart, selected language. There are no advertising or tracking cookies.

10. Changes

10.1. A new version is published on the website with its date. Registered users are notified of material changes.