Privacy Policy

Avagyans Jewelry ('we', 'us', 'our') is committed to protecting the privacy of every visitor, customer, and correspondent. This policy explains how we collect, use, share, and safeguard personal data, and the rights you may exercise under the General Data Protection Regulation (EU 2016/679), the Armenian Law on the Protection of Personal Data (ZR-49), and other applicable privacy laws.

Plain-language summary: we collect only what is needed to serve you — your order, your contact details, your preferences — and we share it only with the service providers who help us deliver those orders. You may ask us to export or delete your data at any time through your account settings.

1. Controller and European Representative

The data controller is Avagyans Jewelry, operating under UMAKS LLC, 27 Amiryan Street, Yerevan, Republic of Armenia.

For visitors residing in the European Union, our Article 27 representative is DataRep (DataRep.com), The Cube, Monahan Road, Cork T12 H1XY, Ireland. You may contact DataRep on data-protection matters at datarequest@datarep.com, referencing 'Avagyans Jewelry' in the subject line.

For general enquiries about this policy, write to privacy@avagyans.com.

2. Personal Data We Collect

We collect the minimum personal data necessary for each interaction. The categories are:

• Identity and contact data — name, email address, postal address, telephone number, and where offered, date of birth for appointment bookings.
• Order and transaction data — items purchased, delivery address, billing address, payment method (last four digits of card, never full card data), order value, and fulfilment status.
• Account data — username, securely hashed password, language and region preferences, and any saved addresses or wishlists.
• Communications data — enquiries, appointment requests, and correspondence with our client-care team.
• Technical data — IP address, browser type, device identifiers, and pages visited; collected only where you have granted analytics or marketing consent.
• Marketing preferences — whether you have opted in to newsletters and the categories of content you wish to receive.

3. Purposes and Lawful Bases

We process personal data for the following purposes, relying on the lawful bases set out in Article 6 of the GDPR:

• To perform the contract of sale — processing your order, arranging delivery, managing returns and refunds, and corresponding with you about your purchase. Lawful basis: Article 6(1)(b), performance of a contract.
• To comply with our legal obligations — retaining transaction records for tax and accounting purposes for the periods required by Armenian and applicable foreign law. Lawful basis: Article 6(1)(c), legal obligation.
• To send marketing communications — where you have granted explicit consent via our newsletter opt-in or account preferences. Lawful basis: Article 6(1)(a), consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• To operate and improve the website — including analytics, error reporting, and fraud prevention. Lawful basis: Article 6(1)(f), legitimate interests, balanced against your rights and freedoms.

4. Recipients of Your Personal Data

We share personal data only with the service providers who help us operate our business. Each provider is bound by a data processing agreement incorporating the European Commission's Standard Contractual Clauses where international transfers apply.

• Stripe, Inc. (United States) — payment processing. Processes card details under PCI-DSS Level 1.
• Vercel Inc. (United States) — website hosting and content delivery.
• Neon Database and Railway Corp. (Amsterdam, European Union) — primary application database and API hosting.
• Upstash Inc. (European Union) — session and cart persistence.
• Sanity.io (European Union) — content management for editorial imagery and policy text.
• Resend Inc. (United States) — transactional and marketing email delivery.
• Sentry.io (United States) — error monitoring and observability, configured to scrub personally identifying information before storage.
• DHL Express, shipping insurers, and customs brokers — for the fulfilment of international delivery where your order requires.
• Tax authorities, law-enforcement agencies, and regulators — where we are legally obliged to disclose.

We do not sell personal data, nor do we share it with third parties for their own marketing purposes.

5. International Transfers

Armenia is our principal place of establishment. Where personal data is transferred outside the European Economic Area or the United Kingdom, we rely on one or more of: the European Commission's Standard Contractual Clauses; the United Kingdom's International Data Transfer Addendum; adequacy decisions where applicable; or, for clearly necessary contractual performance, the derogations in Article 49 of the GDPR. You may request a copy of the relevant safeguards by writing to privacy@avagyans.com.

6. Retention Periods

We keep personal data only for as long as is necessary for the purposes for which it was collected, then delete or anonymise it.

• Order and tax records — seven years after the end of the tax year in which the order was placed, in line with Armenian and applicable foreign tax law.
• Account data — for as long as you maintain an account with us. You may delete your account at any time via your account settings, at which point we anonymise your personal data on the next processing cycle (typically minutes).
• Marketing contacts — until you withdraw consent, then deleted from our active systems and retained only in suppression lists to honour your opt-out.
• Website technical logs — thirty days, then aggregated and anonymised.
• Customer-service correspondence — three years after the most recent contact, for quality and warranty support.

7. Your Rights

Under the GDPR and equivalent laws, you may exercise the following rights at any time:

• Right of access (Article 15) — request a copy of the personal data we hold about you. You may initiate an export directly from your account settings; the file arrives by email within one processing cycle.
• Right to rectification (Article 16) — correct any inaccurate or incomplete personal data.
• Right to erasure (Article 17) — request deletion of your account and the anonymisation of your order history. You may initiate deletion directly from your account settings.
• Right to restriction of processing (Article 18) — require us to limit our processing in defined circumstances.
• Right to data portability (Article 20) — receive your data in a structured, commonly used, machine-readable format. The self-service export satisfies this right.
• Right to object (Article 21) — object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent (Article 7(3)) — at any time, without affecting the lawfulness of prior processing.
• Right to lodge a complaint (Article 77) — with the Personal Data Protection Agency of the Republic of Armenia or the supervisory authority of your habitual residence in the European Union.

To exercise any right that is not available through your account settings, write to privacy@avagyans.com. We respond within thirty days, or explain any necessary extension.

8. Security

We protect personal data with technical and organisational measures appropriate to the risks of the processing. These include TLS encryption in transit, encryption at rest with our hosting providers, role-based access controls within our team, logging and monitoring of administrative actions, and regular review of our suppliers' security practices.

No system is perfectly secure. If we become aware of a personal-data breach likely to result in a risk to your rights and freedoms, we notify our supervisory authority within seventy-two hours and inform affected individuals without undue delay.

9. Cookies and Tracking

We use cookies and similar technologies in line with our cookie policy. Analytics and marketing cookies are deployed only after you have granted consent. You may change your preferences at any time through the cookie-settings link in our footer.

10. Children

Our website and services are intended for adults. We do not knowingly collect personal data from children under sixteen. If you believe a child has provided personal data, write to privacy@avagyans.com and we will delete it.

11. California Residents

Avagyans Jewelry does not meet the thresholds for the California Consumer Privacy Act at this time. Should our circumstances change, we will update this policy with any additional rights applicable to California residents.

12. Changes to This Policy

We may revise this policy from time to time. The current version, its effective date, and its version number are shown at the top of this page. Material changes are communicated to account holders by email.

13. Contact

Questions, requests, and complaints: privacy@avagyans.com. European Union enquiries: datarequest@datarep.com referencing 'Avagyans Jewelry'. Postal: UMAKS LLC, 27 Amiryan Street, Yerevan, Republic of Armenia.