Privacy Policy for Hooly Service

1. Data We Collect

We collect personal and non-personal data required to operate, improve, and secure the service.

Personal Data We Collect

• Identification data: email address (registration, login, communication).
• Interaction data: IP address, device and browser info, timestamps, usage patterns.
• Transaction data: payment information processed through third-party payment providers.

Non-Personal Data

• Aggregated and anonymized statistics (page views, clicks, service usage).

Collected When

• You register or log in.
• Cookies and similar technologies operate (see Section 6).
• You contact support or submit feedback.

We do not knowingly collect sensitive data (health, political opinions, biometric data) without explicit consent.

2. How We Use (Process) Your Data

We process personal data for lawful purposes under GDPR Article 6:

• Consent: for optional marketing communication.
• Contract performance: providing the service, user support.
• Legitimate interests: analytics, security, service improvement.
• Legal obligations: compliance with applicable laws.

Purposes of Processing

• Providing, maintaining, and personalizing the service.
• Processing payments.
• Analytics and service improvement.
• Communication and support.
• Fraud prevention, security, and compliance.

We do not perform automated decision-making that has legal or significant effects on users.

3. Data Storage and Retention

We store data only as long as required for its processing purposes or by law.

Retention Examples

• Account & email data: until deletion or 5 years of inactivity.
• Usage logs: 12 months, then anonymized.
• Payment records: 7 years (Armenian tax & financial law).

Storage Location & Security

Data is stored on secure GDPR-compliant servers in the EU (e.g., AWS Frankfurt) and/or in Armenia.
Encryption: AES-256 at rest, TLS 1.3 in transit. Strict access controls are applied.

4. Data Disclosure and International Transfers

We do not sell, rent, or trade personal data for marketing.

Data may be shared only with:

• Trusted service providers (analytics, payment processors) under GDPR-compliant agreements.
• Authorities when required by law or court order.
• International partners using Standard Contractual Clauses (SCCs) or adequacy decisions.

All transfers are encrypted and safeguarded.

5. Data Security

We implement strong technical and organizational security measures:

• Data encryption in transit and at rest.
• Regular penetration tests and audits.
• Strict access controls.
• Continuous monitoring.

In case of a breach, users and authorities will be notified within 72 hours if required by GDPR.

6. Cookies and Tracking Technologies

We use cookies for essential functions, analytics, and (when applicable) advertising. Users can control cookies via browser settings or the cookie banner.

7. Your Rights

Under GDPR and Armenian law, users have the right to:

• Access their data.
• Correct inaccurate information.
• Request deletion ("right to be forgotten").
• Restrict processing.
• Data portability.
• Object to processing.
• Withdraw consent at any time.

To exercise rights, email: support.api@hooly.info. Response time: within 30 days.

8. Children’s Privacy

Hooly is not intended for individuals under age 16. If we unknowingly collected such data, contact us for removal.

9. Changes to This Privacy Policy

We may update this policy. Significant updates will be announced via email or website at least 15 days in advance.

10. Contact Information

Email: support.api@hooly.info
Postal address: Agasi Khanjyan Street 1/1, Yerevan, Armenia

This Privacy Policy is governed by Armenian law.

Thank you for trusting Hooly with your data.

GDPR Compliance Checklist

• Lawful basis for all processing (GDPR Art. 6).
• Data minimization principles respected.
• Transparency ensured via this policy.
• Consent management implemented.
• Data subject rights handled within 30 days.
• GDPR-compliant DPAs with all processors.
• Encryption, audits, and monitoring.
• 72-hour breach notification procedures.
• DPIAs for high-risk processing.
• Proper safeguards for international transfers.
• Vendor vetting processes.
• Staff GDPR training.
• Accountability documentation maintained.