Privacy Policy

# Arpadan — Privacy Policy

**Last updated:** 21 July 2026 **Data controller:** Arpadan, Azerbaijan. **Contact:** support@arpadan.com

## 1. Scope This policy explains how Arpadan collects and uses personal data of Sellers (who run stores) and Buyers (who place orders through a Seller's store). Sellers are independently responsible for how they use their own customers' data once received.

## 2. What we collect

**From Sellers:** - Name, phone number (verified by SMS), store name. - Identity verification: national ID (FIN) and an identity document image submitted for verification. - Subscription and billing information processed via our local payment provider (we do not store full card numbers). - Store content and usage data.

**From Buyers (via a Seller's store):** - Name, phone number, and delivery preference entered at checkout. - Marketing consent status (SMS opt-in) and opt-out (STOP) status. - Order details.

**Automatically:** basic technical and usage data (for example, device and browser information, cookies and local storage — see our Cookie Policy) and analytics data.

## 3. Identity documents — verify then delete When a Seller submits an identity document, it is used only to verify identity. Once a moderator completes verification, the document image is deleted. We retain only the verification status, the date, and the FIN identification reference needed to identify the account holder. We do not keep the document image after verification.

## 4. How we use data - To operate stores, process order enquiries, and hand off orders to WhatsApp. - To verify Seller identity and prevent fraud and abuse. - To send one-time SMS codes (authentication) and, where consent is given, marketing SMS. - To manage subscriptions and billing. - To measure and improve the service through analytics. - To provide support, maintain security, and comply with legal obligations.

We rely on performance of our contract with Sellers, consent (for marketing and non-essential analytics), our legitimate interests (fraud prevention and service improvement), and legal obligations, as applicable under Azerbaijani law.

## 5. SMS consent Buyers may opt in to marketing SMS via an explicit checkbox at checkout; this is optional and does not affect their order. Buyers can opt out at any time by replying STOP (DAYAN). We record consent status and the time it was given.

## 6. Analytics We use analytics services, including Vercel Analytics and Google Analytics 4 (GA4), to understand how the service is used and to improve it. Non-essential analytics that rely on cookies or similar technologies are loaded only after you accept them via our cookie notice. Analytics data is processed in aggregate and used to measure traffic and performance.

## 7. Sharing We share data only with our service providers (hosting, database, analytics, SMS gateway, payment gateway) acting on our instructions; the Seller whose store a Buyer orders from; and authorities where required by law. We do not sell personal data.

## 8. International transfer Our infrastructure and analytics providers may store and process data on servers located outside Azerbaijan, including in the European Union and the United States. This constitutes a cross-border transfer of personal data. We take reasonable steps to ensure such data remains protected to a comparable standard.

## 9. Retention - Seller account data: for the life of the account and as required by law afterwards. - Identity document images: deleted immediately after verification (Section 3). - Buyer data: retained on behalf of the Seller for as long as the store is active or as needed for the order log; Buyers may request deletion. - Marketing consent and opt-out records: retained to honour preferences.

## 10. Your rights Subject to Azerbaijani law, individuals may request access, correction, deletion, or restriction of their personal data, and may withdraw consent. To make a request, contact support@arpadan.com.

## 11. Security We use reasonable technical and organisational measures, including access controls, encryption in transit, and restricted access to sensitive data. No system is perfectly secure; we act on and, where required, report incidents in accordance with law.

## 12. Children The service is not directed to children under 18.

## 13. Changes & contact We may update this policy; material changes will be notified via the platform. Contact: support@arpadan.com.