Privacy Policy

• 1. Who processes the data
• 2. What data and why
• 3. On what basis
• 4. To whom we pass data
• 5. Transfers to other countries
• 6. Cookies and browser storage
• 7. Your rights
• 8. How long we keep data
• 9. How we protect data
• 10. Children
• 11. Changes to this policy

This policy explains what personal data the Moonberry marketplace (https://moonberry.am; the "platform") processes, why, on what basis, to whom it passes it, how long it keeps it and how you can control it. It follows the Law of the Republic of Armenia on Protection of Personal Data (the "Personal Data Law"). The Armenian text is legally binding; texts in other languages are translations.

1. Who processes the data

1.1. The data is processed by MOONBERRY LLC (TIN 03594126, state registration 999.110.1611928, address: Street 6, Building 21, Apartment 55, Zovuni village, Nairi community, Kotayk Province, 2406, Armenia; "Moonberry", "we").

1.2. For questions about personal data write to info@moonberry.am; for general questions to info@moonberry.am, phone 37433060333.

1.3. The seller you bought goods from receives the data needed to fulfil your order (clause 4.1) and processes it as an independent processor.

2. What data and why

2.1. Account: name, email address, phone number (if the registration form asks for it), password — only as an irreversible hash — language, chosen notifications. Why: so that you can sign in, place orders and receive messages about them.

2.2. Orders: the recipient's name and phone, the chosen Haypost office, the goods, prices and sums, the statuses of the order and parcels, tracking numbers, and what was shown to you before the order button. Why: to perform the contract of sale and prove its terms.

2.3. Payment: amount, status, the bank's transaction identifiers. You enter card details only on the bank's page — we neither receive nor store them. Why: to take payment and refund money.

2.4. Returns and claims: your description, the photos you attached, the decisions and their history. Why: to consider the request and refund the money.

2.5. Sellers: legal form, legal name, TIN, legal address, the head's name and position, contact phone, bank and account number (stored encrypted), uploaded documents, and the names and emails of the seller's staff. Why: to check the seller, show buyers who sells, and settle accounts with the seller.

2.6. Security: IP address and browser at sign-ins and sign-in attempts, the devices you are signed in on, confirmation codes (only as a fingerprint), the log of Moonberry staff actions. Why: to protect accounts from takeover and to investigate abuse.

2.7. Proof of consent: which version of a document you accepted, when, in which language, from which IP address and in which browser. Why: the law puts on us the duty to prove that consent was given.

2.8. Messages: the log of letters and SMS sent to you — which message, when and whether it was sent; the address is stored masked in the log. If you allowed notifications in the Moonberry app — the phone's push notification token: Apple or Google deliver a notification to that phone by it. The token is deleted when you sign out on the phone or turn the app's notifications off in the phone's settings.

2.9. Analytics — only with your consent (section 6): how the platform's pages are used, in aggregate.

2.10. Reviews: the mark, words and photos of a review of goods you received, its language, the signature "First name L." from your account's name, your "helpful" votes and your complaints about other reviews. Why: to show the review to other buyers, to have a moderator check it and to count the rating of the product and the shop. The storefront shows only the signature, the mark, the words, the photos and the variant bought — never your email, phone or full surname. Three days after you collect a parcel we ask you once to rate its goods — this is part of performing the order, not a mailing of offers; like the other emails about orders, it can be switched off in the "Notifications" section.

3. On what basis

3.1. Contract (Personal Data Law, Article 9, part 4, point 2): the data needed to perform the Terms of Use, the contract of sale and the Seller Agreement — clauses 2.1–2.6, 2.8 and 2.10 (you publish a review yourself, under the rules of the Terms of Use).

3.2. Law: keeping order, payment and return data under the law on accounting, taxes and consumer rights protection; answering lawful requests of state bodies.

3.3. Your consent: registration with the "I accept" tick (clause 2.7), newsletters with news and offers, analytics. Consent to newsletters and analytics is given separately, is never pre-ticked and can be withdrawn at any time (section 7).

4. To whom we pass data

4.1. The seller of your order — the recipient's name and phone, the delivery office, the contents of the order, and for a return — your description and photos. The seller may use them only for the order and the return.

4.2. Haypost — the recipient's name and phone and the office, to deliver the parcel; for a return — the data of the return parcel.

4.3. The bank taking the payment — the amount and order number; you give your card details to the bank yourself on its page.

4.4. Those who process data on our instructions (Article 14 of the Personal Data Law), each receiving only what its work needs:

• Vultr — servers and file storage in Amsterdam (the Netherlands);
• Brevo — sending emails (European Union);
• an SMS provider — sending SMS, once connected;
• Sentry — information about software errors without your names, addresses or request contents (Germany);
• Google Analytics — analytics, only with your consent (USA);
• Cloudflare Turnstile — checking that forms are filled in by a person, not a program (USA);
• Apple and Google — delivery of push notifications to the Moonberry app: the phone's token and the text of the notification (USA);
• Telegram — internal notices to Moonberry staff about new accounts and seller applications, with the name and contacts.

4.5. The site's fonts are loaded from Google Fonts servers: Google then receives the IP address and browser details, but not your account data. When a new password is checked against leak databases, only the first five characters of the password's fingerprint are sent to the Have I Been Pwned service — the password itself is never sent.

4.6. State bodies — only when the law requires it.

4.7. We do not sell personal data or pass it on for other people's advertising.

5. Transfers to other countries

5.1. The platform's servers are in the Netherlands; some processors are in other countries of the European Union and in the USA.

5.2. Data is transferred to countries that ensure an adequate level of data protection, including the parties to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, because this is needed for the purposes of processing (Article 27 of the Personal Data Law). Data goes to the USA only for the services listed in clause 4.4, and for analytics only with your consent.

6. Cookies and browser storage

6.1. Necessary — the platform does not work without them, and no consent is required:

• moonberry-session — your session: sign-in, and a guest's cart, favourites and comparison; lasts 2 hours after your last action;
• XSRF-TOKEN — protection of forms against forgery; lasts as long as the session;
• remember_web_… — "Remember me" at sign-in, only if you chose it; up to 400 days or until you sign out;
• mb_locale and mb_market — the chosen language and country; 1 year;
• mb_consent — your answer in the cookie window (whether analytics is allowed); 180 days, then we ask again.

6.2. In browser storage (not sent to the server): your last five searches (mb.search.recent) and a page-transition mark for the life of the tab.

6.3. Analytics — Google Analytics _ga and _ga_…, up to 2 years; set only after you allow analytics in the cookie window. You can change your choice at any time through the "Cookie settings" link at the bottom of the page.

7. Your rights

7.1. You have the right (Articles 15 and 20 of the Personal Data Law):

• to learn which of your data we process, why, where it came from, to whom it is passed and how long it is kept, and to see it — we reply within 5 days of the request;
• to demand that incomplete, inaccurate, outdated, unlawfully obtained or unnecessary data be corrected, completed, blocked or destroyed — we do it at once, or, if that is not possible, within 3 working days;
• to withdraw consent — we stop processing and destroy the data within 10 working days unless the law requires us to keep it, and tell you within 3 working days of destroying it;
• to challenge our actions before the authorised body for personal data protection or in court.

7.2. You can download all your data and delete your account yourself, in the "My data" section of your account: the file of your data is ready at once. Send other requests from the address in your account to info@moonberry.am or through the "Help" section of your account. If we refuse, we give a written reasoned answer with a reference to the law within 5 days.

7.3. You can opt out of newsletters in the "Notifications" section of your account or through the link in a letter, and out of analytics in "Cookie settings".

7.4. Deleting an account does not delete orders, payments and returns the law requires us to keep: instead, the name, email, phone and addresses in them are de-identified. While an order is on its way, a return is open or money has not come back to you, the account cannot be deleted — the "My data" section tells what to wait for.

8. How long we keep data

• the account — while you use it or until you ask us to delete it;
• orders, payments, parcels and returns — as long as the law on accounting and taxes requires, but no less than 5 years after the year of the order; the recipient's name and phone in an order and on a parcel are wiped 3 years after the order's completion (collection and the end of the period of withdrawal) — enough for disputes and the two years of the warranty;
• proof of consent (clause 2.7) — while the contract is in force and 3 more years, the limitation period;
• the seller's data and documents — while the Seller Agreement is in force and 5 more years;
• reviews — until you remove them; when the account is deleted, a published review stays on the storefront without your name (signed "Buyer"), your votes are deleted and your complaints lose their link to you;
• the log of sign-in attempts — 90 days; the sessions of the applications (device, IP address) — 90 days after they end; the push notification token — while the phone uses it, but no longer than 400 days after its last update; confirmation codes — 30 days; the message log — 180 days; a guest's cart — 30 days after its last change;
• database backups — 14 days;
• the log of staff actions — 3 years, as proof of their actions, without change; the entries are then deleted.

The periods are written in the platform's table of periods of keeping data, and the deletion by them runs automatically every day.

9. How we protect data

9.1. The connection to the platform is encrypted (HTTPS). Passwords are stored only as irreversible hashes, bank account numbers encrypted, seller documents and return photos in private storage reachable through links that expire after 15 minutes.

9.2. Staff see only what their work needs; sign-in to the admin panel is protected by a second factor, and every change of data by a staff member is logged.

9.3. In the event of a data leak, we publish a notice at once and report it to the Police of the Republic of Armenia and to the authorised body for personal data protection (Article 21 of the Personal Data Law).

10. Children

The platform is meant for adults. We do not knowingly process the data of people under 16; if you learn that such a person has registered, write to info@moonberry.am and we will delete their data.

11. Changes to this policy

We publish a new version on this page with the date from which it applies; we announce material changes by email in advance. Earlier versions open on this page by their numbers.