1. General Provisions

This Privacy Policy (the “Policy”) sets out how AMARANTA LLC (the “Company”, “we”) collects, uses, stores, transfers and protects personal data obtained through the website, online shop and personal account of the Amaranta Bread Club brand, and in connection with one-time bread orders and subscriptions (the “Website”, the “Services”).

Data is processed in accordance with the Law of the Republic of Armenia “On Protection of Personal Data”, other applicable legal acts and the principle of data minimisation. This Policy applies to buyers, subscribers, website visitors and persons who contact us.

Using the Website does not in itself constitute consent to the processing of data for which the law requires separate consent. Such consent is requested in a clear and separate form.

2. Data Controller and Contact Details

Data controller: AMARANTA Limited Liability Company (AMARANTA LLC).

Taxpayer identification number (TIN): 01377894. State registration number: 999.110.1573476.

Registered address: Apt. 11, Building 16, 2nd Lane, Margaryan St., Ajapnyak District, Yerevan 0078, Republic of Armenia.

Email for data protection, orders and other enquiries: info@amarantabreadcub.com. Customer service phone: +374 77 180232.

If your request concerns personal data, please put “Personal Data / Personal Data Request” in the email subject line.

3. What Data We Process

Identification and contact data: first name, last name (if provided), phone number, email address, delivery address, entrance/building and floor details, and delivery instructions.

Order and subscription data: selected types of bread, quantity, price, delivery days and frequency, payment and order status, purchase history, subscription changes, cancellations and service correspondence.

Limited payment-related information: transaction number, amount, payment date, the payment service’s approval or decline status, and, where this feature is used, a limited card identifier or payment token provided by the payment processor. We never ask you to send your card CVV/CVC or full card details by email or message.

Technical data: IP address, device and browser type, website operation and security logs, session identifiers, and strictly necessary cookies. Analytics or advertising identifiers are processed only where such tools are actually enabled and an appropriate legal basis exists.

Voluntary communications: enquiries, feedback and special delivery instructions. We do not require sensitive health data, including medical diagnoses. If a customer voluntarily provides information about an allergy, it is processed solely to respond to the specific enquiry or to assess a food safety issue, subject to any applicable additional requirements.

4. Purposes and Legal Bases of Processing

Placing, confirming, preparing, delivering and returning orders, and customer service: we process the data necessary to conclude and perform the contract, or data provided by the customer for that very purpose.

Subscription management: managing frequency, delivery schedule, authorisation of automatic payments, charges, cancellations and notifications, within the scope of the subscription contract and the customer’s corresponding expression of will.

Fulfilling accounting, tax and legal obligations, handling disputes, preventing fraud and ensuring website security, on bases permitted or required by law.

Sending news, offers and marketing communications: only on the basis of separate voluntary consent, where required. The customer may opt out at any time by using the relevant link in the message or by writing to us.

Optional website analytics and advertising cookies: only where such a tool is used and appropriate consent has been given. Declining marketing consent does not prevent you from placing a regular order.

5. Mandatory and Optional Data

To place and deliver an order, we need at least the customer’s contact details, address (for delivery), order contents and payment confirmation. If these are not provided, we may be unable to fulfil the order.

Marketing consent, optional cookies and voluntary feedback are not required to buy bread or subscribe.

6. Subscription and Recurring Payment Data

When a subscription is selected, we store the chosen plan, list of products, quantity, frequency, address, record of payment consent, activation or cancellation date, and transaction history.

If the Website offers automatic card charges, this feature must be activated by the customer’s separate and explicit confirmation. A secure payment card identifier may be processed by the relevant payment service provider rather than stored on the Website in plain text.

Cancelling a subscription stops future charges in accordance with the Terms and Conditions and the status of orders already confirmed. After cancellation, data required for mandatory record-keeping or dispute resolution may be retained for the periods prescribed by law.

7. Who We May Share Data With

Data may be shared, to the limited extent necessary, with: (a) payment processors and banks, to process payments; (b) delivery services or couriers, to deliver orders; (c) hosting, technical support, accounting or customer support providers, under appropriate instructions and confidentiality terms.

Data may be transferred to public authorities only in cases prescribed by applicable law. We do not sell customers’ personal data to third parties.

For processing by third parties, the necessary security and confidentiality obligations are established by contract or other appropriate means.

8. International Data Transfers

If a technical, hosting or payment provider operates outside the Republic of Armenia, international data transfers are carried out only in compliance with Article 27 of the RA Law “On Protection of Personal Data” and other applicable requirements, including, as the case may be, the necessary consent, an adequate level of protection, or authorisation from the competent authority.

You may request information about the third-party services used on the Website and the actual geographic location of data storage using our contact details.

9. Cookies and Similar Technologies

Strictly necessary technical cookies are used to load the Website, maintain the shopping cart and login session, secure payments, and save the user’s preferred settings.

Analytics, personalisation or advertising cookies may be used only if the corresponding tools are enabled. Where their use requires consent, the Website must allow you to accept or reject them in advance and to change your choice later.

Cookies can also be managed through your browser settings; however, blocking technically necessary cookies may prevent you from placing an order.

10. Retention Periods

Order, delivery, transaction and accounting document data are retained for the duration of contract performance and for the accounting, tax or other mandatory periods prescribed by law.

Data relating to an active subscription is processed for its entire duration and, after cancellation, only to the extent and for the period necessary for record-keeping, legal requirements or dispute resolution.

Marketing data is processed until the relevant consent is withdrawn or the purpose of processing ends, unless another basis for retention exists. Technical logs are kept only for as long as reasonably necessary for security and operation of the Website.

11. Security

The Company applies proportionate organisational and technical measures, including restricting access to data, managing access by authorised staff, keeping systems updated, protecting data in transit and responding to incidents.

No method of transmission over the internet is completely secure. In the event of an incident, we will act in accordance with the obligations established by applicable law.

12. Your Rights

In accordance with the procedure established by law, you have the right to be informed of the fact, purposes and bases of the processing of your data, the categories of data and the recipients to whom it is transferred; to access your data; to request the correction of inaccurate or outdated data; and, on grounds provided by law, to request that processing be stopped or that your data be blocked or destroyed.

Where data is processed on the basis of your consent, you may withdraw it without affecting the lawfulness of processing already carried out. Contractual, accounting or other statutory obligations may require limited retention of certain data even after consent is withdrawn.

To exercise your rights, send a request to info@amarantabreadcub.com. To verify your identity, we may request only such information as is proportionate and necessary. Requests will be considered in accordance with the procedure and time limits established by law.

If you believe your data is being processed unlawfully, you may apply to the authorised body for personal data protection of the Republic of Armenia or to a court.

13. Data of Minors

The Website is intended primarily for adults. Where consent is required to process the personal data of a person under 16, the consent of their legal representative is required in accordance with the procedure established by the legislation of the Republic of Armenia.

If we learn that we have received a minor’s data without the required legal basis, we will take action in accordance with the law.

14. Changes to this Policy

This Policy may be updated to reflect changes in legal requirements or in the Services. The new version is published on the Website with a “Last updated” date. Where required, we will provide additional notice of material changes or obtain new consent.

This version was last updated on 15.10.2026.

15. Contact Us

For privacy questions, to withdraw consent or to exercise your data rights, write to info@amarantabreadcub.com or contact the Company at its registered address.