PRIVACY POLICY

This Privacy Policy sets out the principal terms governing the collection, processing, use, storage, transfer, and protection of personal and other data through the Tender.am electronic platform.

The operator of the Tender.am Platform is Barrus Group LLC (hereinafter, the “Operator”).

This Policy applies to the Tender.am website, its subdomains, and environments technically integrated with the Platform through which Platform Services are provided.

Capitalized terms used in this Policy and not separately defined herein have the meanings assigned to them in the Platform's Public Agreement for the Provision of Information and Other Services.

1. GENERAL PROVISIONS

1.1. The Operator processes personal data in accordance with the applicable laws of the Republic of Armenia, this Privacy Policy, and, where applicable, consents provided by the User.

1.2. This Policy applies to the data of Visitors, registered Users, and natural persons whose data is processed in connection with the use of Platform Services.

1.3. Use of the Platform may involve the processing of both data provided directly by the User and technical and operational data automatically generated during the use of the Platform.

1.4. Depending on the nature of individual services, additional data processing terms may be presented in the terms applicable to the relevant service or at the time the data is provided.

1.5. Where applicable law requires separate consent for a particular data processing activity, the Operator obtains such consent separately.

2. ENTITY RESPONSIBLE FOR DATA PROCESSING

2.1. The organization responsible for the processing of personal data within the Platform is:

Barrus Group LLC
Tax Identification Number: 01847616
Address: 2 Arshakunyats Avenue, Premises 430, Yerevan, Republic of Armenia
Platform: Tender.am

2.2. Inquiries, applications, and requests relating to the processing of personal data may be submitted through the Operator's current communication channels published on the Platform.

3. DATA WE PROCESS

Depending on the nature of the use of the Platform and the relevant service, the Operator may process the following data.

3.1. Registration and Account Data

This may include:

• first and last name;

• email address;

• telephone number;

• Account identifier;

• information concerning Registration and Account status;

• language and Account settings.

Passwords are generally stored using technical security measures and are not stored in plain text.

3.2. Organization Data

Where a User uses the Platform on behalf of an organization or creates an organization profile, the following data may be processed:

• organization name;

• registered or business address;

• tax or registration information;

• field of activity;

• organization contact details;

• the User's role in or relationship with the organization;

• other information provided in the organization profile.

3.3. Professional Profile Data

When professional services are used, the following data may be processed:

• profession and job title;

• work experience;

• education;

• professional skills;

• language proficiency;

• qualifications and certificates;

• CV or other professional documents;

• profile photograph;

• other professional information voluntarily provided by the User.

3.4. User Content

The Operator may process content created, entered, uploaded, published, or transmitted by the User through the Platform, including:

• announcements;

• publications;

• documents and files;

• search queries;

• messages and inquiries;

• prompts, requests, and materials submitted to AI Services;

• other content generated in connection with the use of Platform Services.

3.5. Payment and Wallet Data

The following data may be processed:

• payment amounts;

• payment date and status;

• transaction identifiers;

• Wallet Funding and Charges;

• Wallet Balance;

• information concerning purchased Paid Services;

• refund information.

As a general rule, the Operator does not store complete bank card details where card payments are processed through the systems of the relevant bank or payment service provider.

3.6. Technical and Usage Data

During the use of the Platform, the following data may be processed automatically:

• IP address;

• device and browser type;

• operating system;

• login date and time;

• pages viewed and functions used;

• technical activity logs;

• security-related events;

• data obtained through cookies and similar technologies.

3.7. Search, Interest and Personalization Data

Within the relevant Platform Services, the following data may be processed:

• search queries;

• selected classifiers and categories;

• applied filters;

• saved searches;

• viewed or selected announcements;

• preferences;

• notification settings;

• service usage history.

This data may be used to provide relevant results, recommendations, and personalized services.

4. SOURCES OF DATA

4.1. The Operator may obtain data:

• directly from the User;

• during the User's use of the Platform;

• from actions performed by the User on the Platform;

• from documents and materials uploaded by the User;

• from the Platform's technical systems;

• from payment service providers, to the limited extent necessary to process the relevant transaction;

• from public and official sources;

• from third-party services lawfully integrated with the Platform.

4.2. Where the User provides the personal data of another natural person through the Platform, the User is responsible for having the necessary legal basis for providing such data.

5. PURPOSES OF DATA PROCESSING

The Operator may process data for the following purposes:

• registering and identifying the User;

• managing the Account and Personal Area;

• providing Platform Services;

• conducting searches and displaying relevant information;

• providing personalized recommendations and results;

• operating saved searches and notifications;

• providing professional profiles and related services;

• processing content submitted by the User for publication;

• accounting for payments, the Wallet, Charges, and refunds;

• responding to User inquiries and providing support;

• ensuring Platform security and preventing fraud;

• identifying and resolving technical issues;

• improving the quality of the Platform and its services;

• statistical and analytical purposes;

• complying with obligations imposed by applicable law.

6. LEGAL BASES FOR DATA PROCESSING

6.1. Depending on the type of data and the purpose of processing, personal data may be processed:

• for the establishment and performance of contractual relations with the User;

• to take necessary steps at the User's request before entering into contractual relations;

• to comply with legal obligations applicable to the Operator;

• on the basis of the User's consent where such consent is required;

• for the purposes of the legitimate interests of the Operator or a third party, to the extent permitted by applicable law and provided that such interests do not override the rights of the data subject.

6.2. Where data processing is based on the User's consent, the User may withdraw that consent in accordance with applicable law. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

7. AI AND AUTOMATED DATA PROCESSING

7.1. The Platform may use artificial intelligence and other automated technologies for the provision and improvement of services.

7.2. AI systems may process User queries, documents, search data, preferences, and other data necessary for the use of the relevant service.

7.3. AI and automated systems may be used for:

• generating search results;

• classifying and matching information;

• analyzing documents;

• generating summaries and responses;

• providing recommendations and personalization;

• identifying relevant content;

• providing other digital Platform Services.

7.4. Data necessary for the provision of AI Services may be technically processed through technology service providers engaged by the Operator, subject to applicable data protection requirements and conditions.

7.5. The User should not submit confidential or personal data of third parties to AI Services unless the User has an appropriate legal basis for such processing.

7.6. Where the Platform uses solely automated decision-making that produces significant legal or similarly significant effects for the User, such processing is carried out only where permitted under applicable law.

8. DISCLOSURE AND TRANSFER OF DATA TO THIRD PARTIES

8.1. The Operator may transfer or make necessary data available to third parties only to the extent required to achieve the relevant purpose.

8.2. Such third parties may include:

• hosting and cloud infrastructure providers;

• technical and software service providers;

• email and messaging service providers;

• payment service providers and banks;

• AI and data-processing technology providers;

• analytics and security service providers;

• professional advisers;

• public authorities where required by law.

8.3. Data is provided to third-party service providers only to the extent necessary for the provision of the relevant service and subject to applicable legal and contractual requirements.

8.4. The Operator does not sell Users' personal data as a separate commercial product.

9. INTERNATIONAL DATA TRANSFERS

9.1. Certain technical services of the Platform may be provided through infrastructure or service providers located outside the Republic of Armenia.

9.2. In such cases, personal data may be processed or stored in other countries in accordance with applicable legal requirements.

9.3. Where applicable, the Operator implements the necessary legal, contractual, or organizational measures for international transfers of personal data.

10. DATA RETENTION PERIODS

10.1. Personal data is retained for as long as necessary to achieve the purposes for which it was collected or for the period required by applicable law.

10.2. Account data may be retained throughout the lifetime of the Account and, following Account closure, for as long as necessary to comply with legal obligations, resolve disputes, maintain security, and establish, exercise, or defend legal claims.

10.3. Payment and accounting data may be retained for the periods prescribed by applicable law.

10.4. Retention periods for technical logs, security data, and backup copies may vary depending on their purpose and technical necessity.

10.5. Once there is no longer a need to retain data, it is deleted, anonymized, or otherwise ceases to be processed in an identifiable form unless continued retention is required by law.

11. DATA SECURITY

11.1. The Operator applies organizational and technical measures appropriate to the nature of its activities and the risks associated with the data processed in order to protect personal data.

11.2. Such measures may include:

• restriction of access rights;

• identity and access management measures;

• data transmission protection measures;

• activity logging and security monitoring;

• backup procedures;

• protection of technical infrastructure.

11.3. Despite the security measures applied, no electronic system can provide an absolute guarantee of security.

11.4. The User is also responsible for maintaining the confidentiality and security of their Account access credentials.

12. RIGHTS OF USERS AND DATA SUBJECTS

12.1. In the cases and to the extent provided by applicable law, a data subject may have the right to:

• obtain information regarding the processing of their personal data;

• obtain access to their personal data;

• request correction of inaccurate or incomplete data;

• request deletion of data where there is no legal basis for its continued retention;

• request restriction of data processing where applicable;

• object to certain processing activities in cases provided by law;

• withdraw consent where processing is based on consent;

• exercise other rights provided by applicable law.

12.2. To exercise their rights, a data subject may contact the Operator through the communication channels published on the Platform.

12.3. The Operator may request additional information to verify the identity of the applicant and prevent unauthorized disclosure of personal data.

12.4. A request for deletion does not apply to data that the Operator is required by law to retain or that is necessary for the establishment, exercise, or defense of legal claims.

13. PUBLIC PROFILES AND PUBLISHED DATA

13.1. Certain Platform Services may allow or require the User to publish specific information.

13.2. Data made public by the User may be accessible to other Users, Visitors, or the general public depending on the settings applicable to the relevant service.

13.3. The User should be aware that information made publicly available may be viewed, stored, or distributed by third parties outside the Operator's control.

13.4. Where the relevant service provides such functionality, the User may manage the visibility of certain data through the corresponding Platform settings.

14. COOKIES AND SIMILAR TECHNOLOGIES

14.1. The Platform may use cookies and similar technologies for the purposes of:

• maintaining the User's login and session;

• ensuring security;

• remembering User preferences;

• analyzing Platform performance and usage;

• improving and personalizing services.

14.2. Cookies necessary for the proper functioning of the Platform may be used to the extent permitted by applicable law.

14.3. Where User consent is required for the use of particular cookies or similar technologies, the relevant consent is obtained through the Platform.

14.4. Additional details concerning the use of cookies may be set out in a separate Cookie Policy.

15. DATA OF MINORS

15.1. Platform Services are primarily intended for persons who are legally entitled to independently enter into the relevant legal relationships or who act with the consent of their legal representative in accordance with applicable law.

15.2. If the Operator becomes aware that personal data has been provided by a person who, under applicable law, was not legally entitled to provide such data independently, the Operator may take appropriate measures to restrict the processing of or delete such data.

16. CHANGES TO THIS POLICY

16.1. The Operator may amend this Privacy Policy by publishing a new version on the Platform.

16.2. In the event of material changes, Users may be notified through the Platform.

16.3. The new version applies from the date it enters into force and does not extinguish rights of data subjects arising before that date under applicable law.

16.4. The current version of this Privacy Policy is permanently available on the Platform.

17. LANGUAGE VERSIONS

17.1. This Privacy Policy may be published in Armenian, Russian, and English.

17.2. In the event of any conflict, inconsistency, or difference in interpretation between the language versions, the Armenian version shall prevail.

ORGANIZATION RESPONSIBLE FOR DATA PROCESSING

Barrus Group LLC
Tax Identification Number: 01847616
Address: 2 Arshakunyats Avenue, Premises 430, Yerevan, Republic of Armenia
Platform: Tender.am