Privacy Policy

Controller

The controller responsible for data processing is Armenia Expeditions LLC, Movses Khorenatsi Street 37/1, Yerevan, Armenien, email: info@armeniaexpeditions.com, phone: +49 (0) 7231 6084977.

We have not appointed a data protection officer, as we do not believe there is currently a legal obligation to do so.

Purposes and legal bases of processing

Handling your trip enquiry and administering the contract: Art. 6(1)(b) GDPR (pre-contractual measures and performance of a contract).

Contacting you by email or via the contact form: Art. 6(1)(b) or (f) GDPR (handling your enquiry, or our interest in orderly communication).

Operating and securing the website (server log files): Art. 6(1)(f) GDPR (our interest in the stability and security of our operations).

Recipients and processors

We use external service providers to operate the website and to send enquiry emails, who process personal data on our behalf (including hosting and email delivery services). We have entered into the necessary data-processing agreements with these providers.

To carry out your trip, we pass on the data required for that purpose (for example, name and travel dates) to local service providers in Armenia (including accommodation, vehicle partners, and guides), to the extent necessary to deliver the booked services.

Receiving e-mail and automatic confirmation of receipt

E-mails sent to addresses on our domain (e.g. info@armeniaexpeditions.com) are received on our behalf by the Cloudflare Email Routing service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, and forwarded to our mailbox. This involves processing the sender and recipient address, the header lines and the content of the e-mail. The sender and recipient address also appear in the operating logs of the forwarding service, which we use for troubleshooting; these logs are deleted after seven days at the latest.

When you write to us for the first time, we automatically send you a confirmation of receipt via the e-mail delivery service Resend (USA). So that you receive only one such confirmation within 30 days, we store at Cloudflare, for 30 days, a check value (hash) calculated from your e-mail address, not the address itself. We do not send a confirmation for replies in an ongoing conversation, for automatically generated e-mails or for senders whose authenticity has not been confirmed.

The legal basis is Art. 6(1)(b) GDPR (handling your enquiry) and Art. 6(1)(f) GDPR (our interest in reliable delivery and in protection against misuse). Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; to that extent, the transfer to the USA is based on the adequacy decision of the European Commission (Art. 45 GDPR). For Resend, it is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Visitor statistics with Google Analytics

With your consent, we use Google Analytics 4, an analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service measures which pages are viewed, where visitors come from, and whether an enquiry is submitted. To do so, it sets cookies (including “_ga”) and processes usage data such as pages viewed, approximate location, device, and browser. According to Google, IP addresses are not stored in the process.

The legal basis is your consent under Art. 6(1)(a) GDPR and the applicable national rules on cookies. Without your consent, the service is not loaded and no cookies are set. You can withdraw your consent at any time, with effect for the future, via “Cookie settings” in the page footer.

Google also processes the data in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR). Google stores the usage data for a maximum of 14 months.

Transfer of data to Armenia (third-country transfer)

Armenia Expeditions LLC is established in Armenia. Armenia has not been recognised by the European Commission as a country with an adequate level of data protection (no adequacy decision).

Your data is therefore transferred to us in Armenia on the basis of Art. 49(1)(b) GDPR, because the transfer is necessary for the performance of the travel contract concluded, or being entered into, with you (the booked trip takes place in Armenia and is organised by us there).

For any further, regular transfer of data to Armenia within the meaning of Art. 46 GDPR (for example, by means of EU Standard Contractual Clauses), we are currently reviewing suitable safeguards; these have not yet been fully implemented.

Storage period

We store personal data only for as long as is necessary for the purposes described above, or as required by statutory retention periods (for example, under commercial and tax law). We delete enquiry data that does not lead to a booking as soon as the enquiry has been finally dealt with and no retention obligation applies.

Your rights

You have the right to access, rectify, erase, and restrict the processing of your personal data, as well as the right to data portability and to object to processing (Art. 15–21 GDPR). Any consent given can be withdrawn at any time with future effect.

Providing your data is necessary for us to handle a trip enquiry or to conclude a travel contract; without this data we cannot process an enquiry.

Automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement.