Privacy policy

1General provisions

1.1.This Policy applies to all personal data processed by Guarantor through the Site and the Platform and is binding on Guarantor’s employees and authorised persons.

1.2.Personal data is processed in accordance with the Constitution of the Republic of Armenia, the Law and other legal acts, in observance of the principles of lawfulness, proportionality, reliability and minimum engagement of subjects.

1.3.Additional terms for the processing of personal data in the course of a Partner’s use of the Platform are set out in the Public Offer. In the event of a conflict between the Public Offer and this Policy, the Public Offer prevails in relations with the Partner.

1.4.This Policy is drawn up in Armenian. The Russian and English versions are provided for information; in the event of any discrepancy between them and the Armenian version, the Armenian version prevails.

2Definitions

2.1.In this Policy, the terms “personal data”, “processing of personal data”, “processor of personal data”, “data subject”, “authorised person”, “third party”, “blocking of personal data”, “destruction of personal data” and “depersonalisation of personal data” have the meanings given to them in Article 3 of the Law.

2.2.“Site” means the guarantor.am website.

2.3.“Platform” means the GUARANTOR software system, available via web, mobile and application programming interface (API), through which Partners issue and service Guarantee Records and Consumers receive, keep and present them.

2.4.“User” means a natural person who uses the Site or the Platform, including a Consumer and a representative or employee of a Partner.

2.5.The terms “Partner”, “Consumer”, “Guarantee Record” and “Public Offer” have the meanings given to them in the Terms of Service and the Public Offer.

2.6.“Authorised Body” means the authorised body for the protection of personal data, being the Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia.

3Processor of personal data

3.1.Guarantor is the processor of personal data processed for the purposes of User accounts, identification and security, contractual relations and settlements with Partners, and the performance of Guarantor’s obligations under law.

3.2.In respect of data relating to a Consumer that a Partner includes in a Guarantee Record (data on the purchased goods or services, price, guarantee terms, guarantee claims and other data), the processor of personal data is the Partner that issued the Guarantee Record. Guarantor processes such data on the Partner’s assignment, as an authorised person, in accordance with Article 14 of the Law and the Public Offer.

3.3.The Partner is responsible for the existence of a legal ground for processing the personal data it enters into the Platform, for the accuracy of such data, and for providing data subjects with the information required by the Law.

3.4.Guarantor’s official details are set out at the end of this Policy.

4Personal data processed

4.1.Guarantor processes the following categories of personal data:

• (a) identification and contact data: name, email address, phone number, the GuarantorID identifier assigned on the Platform, and, where provided by the User, date of birth, sex and time zone;
• (b) account data: a cryptographic hash of the password, the confirmation status of the email address and phone number, and the dates of account registration, activation and sign-in to the Platform;
• (c) Guarantee Record data: data on the goods or services, the purchase, the price, the guarantee period and terms, data on verification of the Guarantee Record and on sharing it with other Users, as well as descriptions of guarantee claims and documents attached to them;
• (d) data on Partner representatives and employees: name, contact details, their roles and permissions in the Partner’s account, and the details of the Partner’s contact person;
• (e) data on acceptance of legal documents: the type and version of the accepted document, the moment of acceptance, the IP address and browser data (user agent);
• (f) technical data: IP address, browser and device data, and records of actions performed on the Platform and of security events;
• (g) payment and subscription data: the Partner’s pricing plan, settlements, payment documents and documents confirming payment.

4.2.The name, TIN, registered address and other organisational data of a Partner that is a legal entity are not personal data, except where the Partner is an individual entrepreneur or the data relates to a natural person.

4.3.Guarantor does not collect special category or biometric personal data. Partners and Users are prohibited from entering such data into the Platform, including in Guarantee Records, descriptions of guarantee claims and attached documents.

4.4.Registration on the Platform and receipt of Guarantee Records require the User’s name and email address or phone number. If these are not provided, the Platform’s services cannot be provided. Providing a date of birth and sex is optional.

5Purposes of processing

5.1.Guarantor processes personal data for the following purposes:

• (a) registration and identification of Users and servicing of their accounts;
• (b) creation of Guarantee Records, their delivery to the Consumer, storage and verification, and enabling the Consumer to share them with other Users at the Consumer’s initiative;
• (c) registration of guarantee claims and provision of information on them to the Consumer;
• (d) sending service notifications relating to the operation of the Platform by email, SMS or through the Platform;
• (e) ensuring the security of the Platform and of accounts, and preventing and detecting unauthorised access and abuse;
• (f) conclusion and performance of agreements with Partners, including settlements and payments;
• (g) recording the fact of acceptance of legal documents;
• (h) handling Users’ applications and enquiries;
• (i) performance of Guarantor’s obligations under the legislation of the Republic of Armenia.

5.2.Personal data is not used for purposes not provided for in this Policy without the data subject’s consent.

5.3.Advertising messages are sent only where the User has given separate consent, which may be withdrawn at any time.

5.4.Guarantor may use depersonalised and aggregated data for statistical and analytical purposes and to improve the Platform.

6Legal grounds for processing

6.1.Personal data is processed in accordance with Articles 8 and 9 of the Law on the following grounds:

• (a) the data subject’s consent, which is deemed given where the personal data has been obtained on the basis of an agreement concluded with the data subject, including the Terms of Service accepted on registration on the Platform, and is used for the purposes of the operations provided for by that agreement (Article 9(4)(2) of the Law);
• (b) the data subject’s separate consent, in the case provided for in clause 5.3 of this Policy;
• (c) cases directly provided for by law (Article 9(5) of the Law);
• (d) in respect of Guarantee Record data, the Partner’s assignment (Article 14 of the Law).

6.2.Consent to the processing of personal data of a data subject who is under sixteen years of age, legally incapable or of limited legal capacity is given by the data subject’s legal representative (Article 9(9) of the Law).

6.3.Guarantor records the fact of acceptance of legal documents by retaining the data referred to in clause 4.1(e) of this Policy.

7Provision of personal data to third parties

7.1.Personal data is provided to third parties exclusively in the following cases and to the minimum extent necessary for the purpose:

• (a) to the Partner that issued a Guarantee Record, for servicing and verifying that Guarantee Record and handling related guarantee claims;
• (b) at the initiative or with the consent of the data subject, including where a Consumer shares a Guarantee Record with another User or presents it for verification;
• (c) to banks and payment service providers, limited to the data necessary to carry out a payment;
• (d) to competent state bodies, on the basis of a request made in the cases and manner prescribed by law;
• (e) in other cases provided for by the Law and other laws.

7.2.Guarantor may assign individual personal data processing operations, including data storage and delivery of notifications, to authorised persons in accordance with Article 14 of the Law, on the basis of a written assignment setting out the purpose of processing, the list of data processed, and the technical and organisational measures for protecting the data. An authorised person processes personal data solely within the scope of the assignment and is obliged to ensure its confidentiality and security.

7.3.Payment card data (card number, CVV/CVC code) is entered and processed exclusively within the PCI DSS–compliant environment of the bank or payment service provider. Guarantor has no access to such data and does not store it.

8Transfer of personal data to other states

8.1.Personal data may be transferred to another state, including stored on servers located outside the territory of the Republic of Armenia, where this stems from the purposes of processing or is necessary to achieve them, or with the data subject’s consent (Article 27(1) of the Law).

8.2.Without the permission of the Authorised Body, personal data is transferred only to states that ensure an adequate level of protection of personal data, either under international agreements or by virtue of inclusion in the list officially published by the Authorised Body. Personal data may be transferred to other states only with the permission of the Authorised Body, in the manner prescribed by Article 27(3) and (4) of the Law.

9Retention periods

9.1.Personal data is retained for the period objectively necessary to achieve the purposes of processing (Article 9(2) of the Law), in particular:

• (a) account data, for the entire life of the account;
• (b) Guarantee Record and guarantee claim data, for the validity period of the Guarantee Record and, after it expires, for the limitation period established by the legislation of the Republic of Armenia for claims arising from it;
• (c) payment data, payment documents and data on acceptance of legal documents, for the periods established by accounting, tax and other legislation, or, in the absence of such periods, for the limitation period following the end of the relevant contractual relationship;
• (d) technical data and records of security events, for the period necessary to ensure the security of the Platform.

9.2.Once the purpose of processing has been achieved or the retention period has expired, Guarantor stops processing the personal data and destroys or depersonalises it, unless otherwise provided by law (Article 19(1) and Article 21(5) of the Law).

9.3.When an account is closed, the account data is destroyed or depersonalised, except for data whose retention is provided for in clause 9.1(b) and (c) of this Policy.

10Security of personal data

10.1.Guarantor applies legal, organisational and technical measures to protect personal data against accidental loss, unauthorised access to information systems, unlawful use, recording, destruction, alteration, blocking, copying, dissemination and other interference (Article 19 of the Law), including:

• (a) exchange of data with the Site and the Platform exclusively over encrypted channels;
• (b) storage of passwords only as a cryptographic hash, which precludes their recovery in plain text;
• (c) digital signing of Guarantee Records, enabling verification of their integrity and authenticity;
• (d) restriction of access to data on the basis of roles and permissions, and logging of administrative actions;
• (e) limiting failed sign-in attempts to the Platform and controlling authentication sessions.

10.2.Guarantor’s employees and authorised persons are obliged to keep personal data confidential both while performing their duties and after their completion (Article 19(7) of the Law).

10.3.In the event of leakage of personal data from electronic systems, Guarantor immediately publishes an announcement thereof, simultaneously reporting it to the Police of the Republic of Armenia and the Authorised Body (Article 21(4) of the Law), and notifies affected Users and Partners without undue delay.

10.4.The User is responsible for keeping their account credentials confidential and must notify Guarantor immediately of any unauthorised use of their account or suspicion thereof.

11Rights of the data subject

11.1.In accordance with Articles 15 and 17 of the Law, the data subject has the right to:

• (a) receive information on the fact, grounds and purposes of the processing of their personal data, the methods of processing, the list of data processed and its source, the processing periods, the processor and its registered address, and the persons to whom their personal data has been or may be provided;
• (b) access their personal data;
• (c) require the rectification, blocking or destruction of their personal data where it is incomplete, inaccurate, outdated, unlawfully obtained or not necessary to achieve the purposes of processing;
• (d) withdraw their consent to the processing of personal data in the cases and manner prescribed by the Law and other laws;
• (e) appeal against the actions or inaction of Guarantor to the Authorised Body or in court;
• (f) claim compensation for damage in the manner prescribed by law.

11.2.Information is provided to the data subject free of charge, in an accessible form, and without the personal data of other data subjects (Article 15(4) and (7) of the Law).

11.3.Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Where the Platform’s services cannot be provided without processing the relevant data, withdrawal of consent results in the closure of the account, and the data referred to in clause 9.1(b) and (c) of this Policy is retained for the periods set out there.

11.4.Where a request concerns Guarantee Record data issued by a Partner, in respect of which the Partner is the processor of personal data, Guarantor forwards the request to that Partner and assists in fulfilling it within the scope established by the Law.

12Procedure for submitting and handling requests

12.1.To exercise their rights, the data subject, their representative acting under a power of attorney, or their legal representative submits to Guarantor a written request to Guarantor’s registered address, or an electronic request validated by an electronic digital signature via the official contact channels listed in the Contact section of the Site (Article 15(5) of the Law).

12.2.To confirm the identity of the applicant and to avoid disclosing personal data to third parties, Guarantor may request additional information.

12.3.Upon receipt of a written request, Guarantor:

• (a) within five days, provides the requested information or an opportunity to access the personal data (Article 20(1) of the Law);
• (b) immediately or, where that is not possible, within three working days, completes, updates, rectifies, blocks or destroys personal data that is incomplete, inaccurate, outdated, unlawfully obtained or not necessary to achieve the purposes of processing (Article 20(2) of the Law);
• (c) if it rejects the request, within five days provides the applicant and the Authorised Body with a reasoned written decision referring to the provisions of law on which the rejection is based (Article 20(4) of the Law).

13Cookies and browser storage

13.1.The Site does not use analytical, tracking or advertising cookies, or third-party analytics tools.

13.2.The Platform uses only strictly necessary cookies and browser storage items (local storage, session storage) to identify the User, maintain the sign-in session, ensure security and remember the selected language. They are necessary for the Platform to operate and are not used to track the User’s activity.

13.3.The User may block or delete cookies in their browser settings; in that case some Platform functions, including signing in, may become unavailable.

14Final provisions

14.1.Guarantor may amend this Policy. The amended Policy enters into force upon publication on the Site, unless it provides for a different date.

14.2.Guarantor notifies Users of material changes through the Platform or by email.

14.3.The current version of this Policy is always available on the Site.

14.4.Matters not governed by this Policy are governed by the legislation of the Republic of Armenia.