Privacy

This page explains what personal data webmall.am processes, why and how. Processing follows the Law of Armenia on Protection of Personal Data.

What we collect

Account: name, e-mail and password (stored only as a hash).
Application and store: store name, address, domain, phone number, business description.
Payments: order amounts, periods, payment method and the bank transaction number. Card details are entered only on the bank's page; we never receive or store them.
Messages: the conversation between you and our team in Messages.
Technical data: IP address, sign-in times and license check records, for security and troubleshooting.

To provide the service, review applications, take payments and run your store.
To send service notices (approval, payment, expiry, changes to the terms). We send no marketing e-mails without your consent.
For security, abuse prevention and our legal obligations.

The basis is your consent, given when you register and send an application (Articles 8 and 9 of the law).

You are the controller of your buyers' data. We store and process it only on your instructions, as an authorised person (Article 14).
We do not use that data for our own purposes and do not pass it on, except where the law requires.

The bank and payment system, only to process payments.
Hosting and e-mail delivery services, only to provide the service and under the same protection.
Public authorities, only where the law provides (Article 26).
We do not sell data or share it for advertising.

Account data is kept while the account exists.
When you delete your account, your personal data is deleted. Payment records are kept for the period the law requires, no longer linked to your account.
When a store's period ends, its data is kept for 30 days and then deleted.

Connections are encrypted (HTTPS), passwords are stored as hashes and access to backups is restricted.
Only staff who need the data for their work can access it.

We use only necessary cookies: to keep you signed in and protect forms. No analytics or advertising cookies.

To learn about your data, the purposes of processing and its recipients (Article 15). We answer written requests within 5 days (Article 20).
To have inaccurate, outdated or unnecessary data corrected, blocked or destroyed. We do this at once or within 3 working days (Article 20).
To withdraw your consent (Article 9), which means deleting the account and ending the service.
You can change your name and e-mail, or delete your account, in Settings. For anything else, write to us in Messages.
To complain to the Personal Data Protection Agency or a court (Article 17).