Privacy and Cardholder Information Policy

ANQ.am Limited Liability Company is the data controller for personal data processed for Kaleske, except where an identified Supplier independently determines its processing. Questions and rights requests may be sent to [email protected]. This Policy covers website visitors, account holders, customers, passengers, attendees, recipients, advertising customers and supplier representatives.

We may process identity and contact data, account credentials, order and reservation records, passenger and ticket details, recipient and delivery data, advertising assets and business details, supplier data, communications, consent records, device identifiers, IP address, browser data, cookies, analytics events and permitted bank transaction references. Required fields vary by Item and are disclosed before collection.

Data is used to create and perform contracts, verify availability, process and reconcile payments, issue tickets, deliver goods and services, prevent fraud, secure accounts, provide support, handle refunds and complaints, keep legal and accounting records and improve the platform. Processing relies as applicable on contract, legal obligation, legitimate interests, protection of users and consent; optional marketing requires a separate choice that may be withdrawn.

Only necessary data is shared with the responsible Suppliers, tour operators, bus companies, event organizers, hotels, accommodation providers, delivery providers, advertising partners, banks, authorized payment processors, hosting and communications providers, professional advisers and government authorities where legally required. Each recipient receives information appropriate to its role; personal data is not sold as an unrelated commodity.

Kaleske does not store full card numbers and does not store CVV or CVC. Sensitive card information is entered only in the secure environment of the bank or an identified authorized processor; it must not pass through GraphQL or appear in application logs. We retain only permitted transaction references, masked details when lawfully returned, amounts, currencies and payment statuses. Kaleske does not claim PCI DSS certification unless independently verified certification is current.

Essential cookies support security, language, sessions and checkout. Analytics or marketing technologies are used only as permitted and, where required, after consent. Operational messages about orders, payment, fulfilment, security and support are distinct from optional marketing; withdrawing marketing consent does not stop necessary service messages.

Data is retained only as long as needed for the stated purposes, contractual claims, fraud prevention and Armenian tax, accounting and legal duties, after which it is deleted or anonymized. Suppliers or service providers may process data outside the customer’s country; where an international transfer requires safeguards, we use contractual or other lawful measures and limit the transferred fields.

We use role-based access, transport encryption, restricted secrets, audit records, data minimization and operational monitoring appropriate to risk. No system is risk-free. Confirmed incidents are investigated, contained and notified to affected persons or authorities when required. Customers should protect account credentials and report suspected misuse promptly to [email protected].

Subject to applicable law, a person may request access, correction, deletion, restriction or a copy of data, object to certain processing, withdraw consent without affecting prior lawful processing and complain to the competent Armenian authority. We may verify identity and preserve records that law requires. Requests should identify the account or order and be sent to [email protected]; unresolved privacy complaints may be escalated to the competent authority or court.