1. About this Policy

This Privacy Policy explains how «Grig Track» LLC ("Grig Shin", "we", "us" or "our") collects, uses, stores, shares and protects personal data when you use https://www.grigshin.com (the "Service"), create an account, place an order or contact us.

We process personal data in accordance with the Law of the Republic of Armenia "On the Protection of Personal Data" and other applicable laws.

2. Who is responsible for your data

• Company: «Grig Track» LLC
• Tax ID / registration number: 08246231
• Registered address: 19/1 Arin Berd Street, Yerevan, Republic of Armenia
• Email: info@grigshin.com
• Phone: +374 44 222215

3. Data we collect

We may collect:

• Account and contact data: name, email address, phone number and securely hashed password.
• Order and delivery data: delivery address, ordered products, quantities, prices, discounts, order history, returns and refunds.
• Payment and SMS-link information: phone number, order and payment identifiers, payment method, amount, currency, status, date and refund information. Card details are entered directly on the ArCa or bank payment gateway. We do not receive or store the full card number, expiry date or security code.
• Communications: requests, complaints and other correspondence with us.
• Technical and security data: IP address, browser and device information, session identifiers and security or administrative logs.
• Preferences: preferred language, cart and wishlist information.
• Location data: approximate or precise location only if a location feature is enabled and you permit its use.

We normally receive this information directly from you. We may also receive payment confirmation from the payment provider and delivery status from the courier.

4. Why we use your data

We use personal data to:

• create and manage accounts;
• process payments, orders, delivery, cancellations, returns and refunds;
• maintain order history and apply quantity or loyalty discounts;
• send account, security and order-related messages;
• send payment links by SMS, monitor payment status and process refunds;
• respond to questions and complaints;
• send marketing messages only with consent or where otherwise permitted by law, with an easy way to opt out;
• secure the Service, prevent misuse and keep necessary records; and
• comply with accounting, tax, consumer-protection and other legal obligations.

5. Legal basis

We process personal data when:

• you have given consent;
• the data is received in connection with a contract with you and is used for that contract, including processing and delivering an order;
• processing is required or expressly permitted by law; or
• the data comes from a lawfully available public source.

You may withdraw consent where processing is based on consent. Withdrawal does not affect processing already carried out or processing required on another lawful basis.

6. Sharing personal data

We do not sell personal data. Where necessary, we may share it with:

• the ArCa or bank payment gateway;
• banks, payment processors and SMS delivery providers used to send payment links and status messages;
• email and messaging service providers;
• hosting and cloud-storage providers used to operate the Service;
• couriers and logistics providers;
• professional advisers; and
• courts, regulators or public authorities where required by law.

Providers acting on our instructions may process data only for the agreed services and under applicable data-protection obligations. Banks, payment providers, couriers and public authorities may also process data as independent organisations under their own legal obligations and privacy notices.

7. International transfers

Some providers may process personal data outside Armenia. We make an international transfer only when it is permitted under Armenian law—for example, with the data subject's consent or where the transfer is necessary for the stated processing purpose—and when the destination provides an adequate level of protection or the required authorisation and contractual safeguards are in place.

8. Retention

We retain personal data only for as long as necessary for the stated purpose, while an account or contract is active, until consent is withdrawn where consent is the only lawful basis, and for any period required by accounting, tax, consumer-protection or other applicable law. After the applicable period, data is securely deleted or anonymised. Limited backup copies may remain until overwritten under our backup cycle.

9. Security

We use appropriate technical and organisational safeguards, including encryption in transit, secure password hashing, access controls, logging, monitoring and restricted administrative access. No system is completely secure, but we take reasonable measures to prevent unauthorised access, loss, alteration or misuse.

10. Your rights

Subject to Armenian law, you may ask us to:

• confirm whether we process your personal data;
• explain the purposes, legal basis, methods, sources, recipients and retention periods;
• provide access to your personal data free of charge;
• correct, update, block or delete data that is inaccurate, outdated, unlawfully obtained or no longer necessary;
• stop processing based on withdrawn consent, where no other lawful basis applies; or
• opt out of marketing and non-essential SMS messages;
• explain any legal consequences arising from the processing of your data.

You may also complain to the Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia or seek judicial protection and compensation where provided by law.

We generally respond to a valid written request within five days. Where correction, blocking or deletion is required, we act promptly and, where immediate action is not possible, within the period required by law. We may ask for information necessary to verify your identity.

11. Children

The Service is not directed to children. A minor should place an order only through, or with the authorisation of, a parent or legal representative where required by law. If you believe a child has provided personal data without appropriate authorisation, contact us.

12. Cookies

We use cookies and similar technologies as explained in our Cookie Policy. We use necessary technologies for authentication, security and essential functions. Optional analytics or marketing technologies are used only when permitted by law and with consent where required.

13. Changes and contact

We may update this Policy. The current version and its revision date will be available on the Service. Where appropriate, we will notify users of material changes.

For questions or rights requests, contact:

• Email: info@grigshin.com
• Phone: +374 44 222215
• Address: 19/1 Arin Berd Street, Yerevan, Republic of Armenia