Privacy policy

This is a translation for convenience. The Armenian version is the legally binding one.

Effective from 21 October 2026.

This policy explains how ABAPharm processes your personal data when you use www.abapharm.am, place an order, write to us or call us. We process data in accordance with the RA Law on Protection of Personal Data, following the principles of lawfulness, proportionality and data minimisation.

1. Who processes your data

The controller is the ABAPharm pharmacy chain, 59/5 Karapet Ulnetsi St, Yerevan. For questions about personal data, write to info@abapharm.am (subject “Personal data”) or call +374 10 202032.

2. What we collect and why

Orders (with an account or as a guest)

• Data: first and last name, phone number, delivery address, email address (optional for guests), products ordered and prices, delivery and payment method, payment status, and any notes you add to the order.
• Purpose: to conclude and perform the contract, have a pharmacist check the order, deliver it, contact you (for example, about a reduced order or a prescription check), issue refunds and meet tax, accounting and pharmacy-regulation requirements.
• Basis: performance of the contract, legal obligations, and the consent you give when you place an order.
• The contents of an order (medicines) and electronic prescription details may reveal information about your health. We use them only to fulfil the order and comply with the law, and only the staff who need them can see them.

Account

• Name, email address, phone number, password (stored only as a one-way hash), saved addresses, cart, favourites, order history, the loyalty card number if you add one, and email verification status.
• Session data (sign-in time, browser type, IP address) to keep your account secure.

Payments

For online payments, the bank or Idram sends us only the payment result, transaction identifiers, the amount and possibly a masked card number. We never receive or store your full card number, expiry date or CVV.

Contacting us

• Contact form: name, email address, phone number, message.
• Website chat: the name you enter, your messages, an anonymous visitor ID stored on your device, and your IP address (to protect against abuse).
• Phone calls and emails.

We use this data only to answer you.

Newsletter

Your email address, language and subscription status. Your subscription starts only after you confirm it through the link in our email, and every newsletter contains an unsubscribe link. The basis is your consent, which you can withdraw at any time.

Technical data and statistics

• Server logs record IP addresses, browser and device details and requested pages, to keep the website secure and fix faults.
• For visitor statistics we use Cloudflare Web Analytics, which uses no cookies and builds no individual profiles; it shows only aggregated data (pages, referring sites, country, device type, speed).
• We do not use advertising or tracking cookies and do not profile you for advertising.

3. Cookies and data stored on your device

The website uses only the cookies and browser local storage it needs to work:

• customer-token keeps you signed in to your account; kept for 7 days.
• abapharm_pay remembers your order while you are on the bank’s payment page (online payments only); kept for 2 hours.
• A cookie that remembers your language.
• Cloudflare, which protects the website, may set cookies needed for security.
• Local storage: the guest cart, favourites, sign-in state, the chat’s anonymous ID and name, and which notices you have closed.

Because these are needed for the website to work, we do not show a consent banner. You can delete them in your browser settings, but some features (sign-in, cart) will then stop working.

4. Who receives your data

We do not sell your data. Only the following receive it, and only as far as necessary:

• Our staff: pharmacists, operators and couriers. To check orders quickly, a notification about each new order (name, phone, address, products) is sent to a closed staff group in the Telegram messenger. Website chat messages are also relayed to staff through Telegram.
• Hosting providers we have contracts with: their servers run the website and database, and the data is stored securely.
• Cloudflare, Inc. (USA): network protection, website acceleration and cookieless statistics. All website traffic passes through Cloudflare.
• Microsoft (Microsoft 365): sending and receiving email (order notifications, email verification, newsletter, replies to your questions).
• Payment providers (for online payments): the ArCa payment system and the card-acquiring bank, and Idram. They receive the order number and amount, and process your card or wallet data as independent controllers under their own policies.
• Public authorities, only where and as the law requires.

5. Transfers outside Armenia

Cloudflare, Microsoft and Telegram may process data on servers outside Armenia. We transfer only the minimum data needed, choose providers that apply recognised security standards, and make transfers in line with the RA Law on Protection of Personal Data, including on the basis of the consent you give when using the website and placing an order.

6. How long we keep data

• Orders and payments: for the period required by tax and accounting law (usually 5 years).
• Account: while the account exists. At your request we delete the account or anonymise the data, keeping only the order records the law requires.
• Contact form and chat messages: up to 12 months after the last message.
• Newsletter: until you unsubscribe.
• Server logs: up to 30 days.
• Sign-in sessions: 7 days.

7. Security

The website works only over a secure (HTTPS) connection, passwords are stored only as hashes, staff access is limited to what each role needs, and card details never reach our servers. If a data breach occurs, we will inform the authority and you as the law requires.

8. Your rights

You have the right to:

• be informed about the processing of your data and access it;
• have inaccurate or incomplete data corrected;
• have data blocked or destroyed when its processing is no longer necessary or is unlawful;
• withdraw your consent at any time (for example, unsubscribe from the newsletter);
• complain to the Personal Data Protection Agency of the RA Ministry of Justice or to a court.

To exercise your rights, write to info@abapharm.am from the email address linked to your account, or call us. We may ask you to confirm your identity and will reply within the time limits set by law.

9. Children

The website is intended for people aged 18 or over. We do not knowingly collect children’s data; orders for children are placed by their parents or other legal representatives.

10. Changes to this policy

We may update this policy by publishing a new version with its effective date on the website. We will also notify account holders of significant changes by email.