![[$IC]](assets/logo-wordmark.svg){kind=logo}
This Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and what rights you have.
Vika Dunamalyan, of Torosyan 4/3 Street, Apartment 12, Spitak, Lori Province, Republic of Armenia, is the controller of the personal data described in this Policy, except where another party acts as an independent controller. You can reach us at privacy@sicarchives.com or at the postal address above.
We process personal data in accordance with the Law of the Republic of Armenia on the Protection of Personal Data (No. HO-49-N of 18 May 2015, as amended). Where we offer goods to individuals in the European Union or European Economic Area, or monitor their behaviour, we also process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). Where we offer goods to individuals in the United Kingdom, the UK GDPR and the Data Protection Act 2018 also apply.
We collect the following categories of personal data.
We do not knowingly collect special categories of personal data — such as data revealing health, religious belief or political opinion — and ask that you do not send us such data. We do not knowingly collect data from children under 16, and the Site is not directed at children.
Where we ask for data and you do not provide it, we may be unable to accept or fulfil your order.
We process personal data only where a lawful basis exists under the applicable law.
| Purpose | Data used | Legal basis |
|---|---|---|
| Taking, accepting and fulfilling your order; arranging delivery; communicating with you about it | Identity and contact, order, payment result | Performance of a contract with you |
| Creating and operating your account | Account, identity and contact | Performance of a contract with you |
| Answering your questions, handling returns, complaints and authenticity claims | Identity and contact, order, correspondence | Performance of a contract with you; our legitimate interest in running the business properly |
| Keeping accounting, tax and customs records | Order, payment result, identity and contact | Compliance with a legal obligation |
| Keeping product safety and compliance records | Order, Item records | Compliance with a legal obligation |
| Sending you our newsletter and other marketing | Marketing data | Your consent; or, where you have bought from us, our legitimate interest in marketing similar goods, subject to your right to opt out at any time |
| Preventing, detecting and investigating fraud and misuse | Order, payment result, technical and usage | Our legitimate interest in protecting the business and our customers |
| Keeping the Site secure, available and working | Technical and usage | Our legitimate interest in the security and integrity of the Site |
| Measuring how the Site is used and improving it | Technical and usage, consent data | Your consent, given through the cookie banner |
| Publishing reviews and customer content | Customer content, your name or display name | Your consent |
| Establishing, exercising or defending legal claims | Any of the above, as relevant | Our legitimate interest in defending our legal position; compliance with a legal obligation |
Where consent is the basis, it may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your interests or fundamental rights. You may ask us for details of that assessment, and you may object to the processing — see section 11.
We send marketing messages only where you have consented, or where you have bought from us and we are permitted to market similar goods to you on an opt-out basis. Every marketing message contains an unsubscribe link, and you can also opt out at any time by contacting us or by changing your account settings.
Opting out of marketing does not stop us sending you service messages about an order you have placed, such as order confirmations, dispatch notices and refund confirmations.
We do not sell your personal data. We share it only with the following categories of recipient, and only to the extent necessary.
Our service providers act on our documented instructions under written contracts that require them to keep your data secure, to use it only for the purposes we specify, and to return or delete it when their services end.
We are established in Armenia and your data will be processed there. Some of our service providers are located in other countries, including in the European Economic Area, the United Kingdom and the United States.
Armenia is a party to Council of Europe Convention 108 and its amending Protocol, and recognises the Member States of the European Union and the European Economic Area as providing an adequate level of protection.
Where personal data subject to the GDPR is transferred from the European Economic Area to Armenia, or to any other country not the subject of an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, supplemented where necessary by additional technical and organisational safeguards. You may request a copy of the relevant safeguards by writing to us at privacy@sicarchives.com.
We keep personal data only for as long as we need it for the purpose for which it was collected, and then delete it or anonymise it.
| Data | Retention period |
|---|---|
| Order records, invoices and payment records | For the period required by Armenian accounting and tax law, understood to be five years from the end of the relevant tax year, and in any event until any related dispute or claim is resolved |
| Customs and import documentation | For the period required by the customs authorities concerned |
| Account data | Until you close your account, and for 12 months afterwards in case you wish to reopen it |
| Correspondence about an order, a return or a complaint | 3 years from the last message, or until any related claim is resolved |
| Marketing data and the record of your consent | Until you unsubscribe, and for 24 months afterwards as proof that consent was given and withdrawn |
| Cookie and consent data | For the duration of each cookie, as set out in the Cookie Policy; the consent record is kept for 24 months |
| Technical and security logs | 12 months |
| Product safety and compliance records for an Item | 10 years from the date the Item was supplied |
Where a longer period is required by law, or where data is needed to establish, exercise or defend a legal claim, we keep it for that longer period.
We maintain technical and organisational measures appropriate to the risk, including encryption of the Site in transit (TLS), access controls limiting data to those who need it, hashed password storage, secure payment processing by certified providers, regular software updates, and confidentiality obligations on anyone who works with us.
No transmission over the internet can be guaranteed to be completely secure. Where a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, you, within the applicable time limits.
Subject to the conditions and exceptions in the applicable law, you have the right to:
To exercise any of these rights, contact us at privacy@sicarchives.com. We will respond within one month, or within the period required by the applicable law, and may extend that period by up to two further months for complex requests, telling you if we do. We may ask you for information to verify your identity. There is no charge, unless a request is manifestly unfounded or excessive.
We use cookies and similar technologies as described in our separate Cookie Policy. Non-essential cookies are set only in accordance with the consent mechanism on the Site and the requirements applicable to you.
If you are not satisfied with how we have handled your data, please tell us first so that we can put it right.
You also have the right to complain to a supervisory authority: in Armenia, the Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia; in the European Economic Area, the data protection authority of the Member State where you live or work, or where the alleged infringement occurred; in the United Kingdom, the Information Commissioner's Office.
We may update this Policy. The date at the top shows when it was last revised. Where a change is material, we will notify you by email or by a prominent notice on the Site before it takes effect. Previous versions are available on request.