1. Who is responsible for data
lavuvat.am is a directory of companies in Armenia with reviews and discussions. The personal data controller is the person who organises processing during the platform's operation.
- Controller's legal name
- [TO COMPLETE: full legal name of the organisation, sole trader or individual]
- Registration details
- [TO COMPLETE: country of registration, registration number and tax number, where applicable]
- Controller's address
- [TO COMPLETE: registered or postal address for requests]
- Email for personal data enquiries
- [TO COMPLETE: active email for data requests]
2. What data we use and why
- Browsing the site. The server receives an IP address and technical request information, including the page address and browser details. These are used to load pages, diagnose errors and protect against abuse.
- Login and registration. Your email, provided name, email verification details, login attempts and sessions are needed to create an account, send a code and protect access. No password is requested for personal login.
- Reviews. The author's name, rating, text, selected company or branch and date of experience, if provided, are needed to publish and moderate a review. A guest review does not require an email or phone number. Reviews from accounts retain a link to the author.
- Discussions and votes. Message texts, replies, votes, account links and action history are needed for discussions, vote counting and preventing repeated actions.
- Company representation. Account details, position or relationship with a company, work contacts, correspondence and documents provided on request are used to verify authority and grant or revoke access. Official replies and profile changes are linked to the current representative.
- Complaints and support. The contents of a request, attachments, sender details and decisions are needed to investigate the situation and contact the applicant.
- Directory and imports. Company information, published business contacts and imported reviews also come from public sources. Imported reviews show their source; author details may be included in the original publication.
- Nearby search. With browser permission, location is used to find nearby companies. The visitor's original position is not stored on the platform server.
Do not include other people's contacts, passport details, payment data or health information in public texts. In documents for verifying authority, keep only necessary information and redact unnecessary details.
3. What other visitors can see
After publication, visitors can see the author's name, rating, review text, dates and specified branch, as well as published discussion messages and official company replies. Company profiles show public contacts and a verified representative badge where available.
Your login email, codes, sessions, private requests, support correspondence and verification documents are not published on company pages or alongside reviews. Access is limited to the participants in the relevant request and the authorised team within their permissions.
Other people can read and copy public texts. Only post information about yourself that you are willing to share. Publication rules are set out in the review and reply guidelines.
4. Legal bases for processing
Processing takes applicable legislation into account, including the Law of the Republic of Armenia On Personal Data Protection. Depending on the action, the basis is your consent, the public availability of the source or another basis expressly provided by law.
We collect, record, store and use data for the purposes described in this policy; where necessary, we update it, publish the portion intended for publication, restrict access or delete data. Opening this page does not constitute consent to all processing methods. Where consent is needed for a specific action, it should be obtained when that action is performed.
5. Cookies and browser storage
Service session cookies are used for login. The personal account cookie lasts up to 7 days; logging out ends the corresponding session. Login and restricted areas do not work without service cookies.
Discussion message drafts may be stored in the current tab's sessionStorage to preserve typed text. This storage is in your browser; sending a message to the server happens separately. On a shared device, log out and close tabs.
Yandex Metrica is used on public pages for visit statistics, without Session Replay. You can manage cookies and site data in your browser settings.
6. Who receives data
The platform team processes data according to assigned permissions. Infrastructure services receive the information necessary to perform their functions:
- Hosting and storage: the application server, database, files and backups. [TO COMPLETE: hosting provider name and countries where data and backups are stored].
- Resend: the recipient's email and the contents of a service email containing a login or company verification code are shared to deliver that email.
- OpenStreetMap: when loading a map, the browser contacts the map tile provider, which receives the IP address and map request parameters.
When you follow external links, the rules of the relevant site apply. Data may also be provided to authorised authorities where there is a lawful basis.
[TO COMPLETE: providers' legal entities and processing countries, and applicable grounds and conditions for cross-border transfers. This information requires confirmation by the owner.]
7. Retention periods
Data must not be retained longer than necessary for the stated purposes and compliance with the law. In the platform's current operation:
- personal login codes are valid for 10 minutes and personal sessions for up to 7 days; expiry does not automatically delete all login attempt records;
- private company verification documents are configured for daily cleanup after 30 days from the decision on the request;
- daily server backups have a configured retention period of 14 days; deletion from the live system and expiry of backups happen separately.
[TO COMPLETE: retention periods for accounts, reviews, discussions, votes, requests, correspondence, access and action logs; deletion or anonymisation procedures and exceptions for disputes or legal retention obligations.]
8. Data protection
The site uses HTTPS, access permission checks and limits on code entry attempts. Verification documents are stored outside the public file directory and served only after an access check. General access to administration is closed. These measures reduce the risk of unauthorised access but do not guarantee absolute security.
9. Your rights and requests
You can request information about the processing of your data, correction of inaccurate information and, where provided by law, blocking, deletion or cessation of processing, including when withdrawing consent. You may appeal the controller's actions to the authorised personal data protection body of the Republic of Armenia or to a court.
Use the controller's email in section 1 for requests. Specify the data concerned, a link to the publication or company, and the action needed. To protect against requests by others, you may need to confirm that the data relates to you; do not send your password or login code.
Until the email in section 1 is completed, no contact channel for this policy is specified. [TO COMPLETE: working contact channel and response procedure taking statutory deadlines into account].
If processing necessary for an account or verification of authority is stopped, the corresponding access may become unavailable. Deletion requests are considered taking into account lawful grounds for further retention; logging out does not itself delete the account or publications.
10. Changes to this policy
The current version is published at this address with an update date. Changes to purposes, data categories or providers require an update to this policy; where the law requires new consent, publishing a new version does not replace it.