Privacy Policy

1. Who is responsible for your data

The Aerial Yerevan studio, at Buzand 7 in Yerevan, decides what happens to the personal data collected through this website and is responsible for it — the data controller, in the words of the Law on Protection of Personal Data (HO-49-N, 18 May 2015). Our contact details are at the end of this page.

2. What we collect

When you use this site to book, we hold:

Your account

Phone number, name, and the language and messaging channel you prefer. An email address only if you give us one — it is optional. Whether you are 18 or over — we do not ask for a date of birth. If you are under 18, the name and phone number of a parent or guardian.

An emergency contact

If you give us one — a name, how they relate to you, and a phone number — so there is someone to call if something happens in class.

Health declaration

Your answers to the short health questions asked before your first class, and the resulting flags an instructor needs to see (for example a pregnancy, or raised eye pressure). This is data about your health and we treat it accordingly — see section 5.

Bookings and credits

Which classes you booked, attended, cancelled or missed, and the packs and credits on your account.

Payments

Order number, amount, currency, date, status, and any refunds. No card data — see section 4.

Waiver and consents

Which version of the liability waiver you accepted and when, and every marketing-consent decision you have made — each with the date and the IP address it came from, because a consent nobody can prove is not a consent.

Messages

The confirmations, reminders and other messages we sent you, with their delivery status, so we can tell whether a reminder actually reached you.

Login security

One-time codes are stored hashed, never in readable form, together with the IP address a code was requested from and the number of attempts — this is what stops someone else's login attempts against your phone number.

How you found us

If you arrive through a campaign link, a short token such as instagram/story/spring, so we know which posts bring people to the studio. It says nothing about you personally.

3. Why we hold it, and on what basis

• To give you what you booked — a place in a class, credits on your account, a confirmation and a reminder. This is the performance of our agreement with you, and without it we cannot run a booking system at all.
• To keep classes safe: the health declaration and the emergency contact, on the basis of your consent, given when you complete them.
• To meet obligations the law and our bank place on us — accounting records, and transaction records our card acquirer requires us to keep.
• To protect the studio and you from abuse: rate-limiting login codes, spotting duplicate or fraudulent payments. This is our legitimate interest in a system that works.
• To tell you about classes, courses and offers — only if you asked us to. That consent is separate from everything else, and you can take it back at any time.

4. Card data: we never have it

Card payments happen on the secure ipay.Arca payment page, which Armenian Card CJSC (ArCa) runs for our bank, ACBA Bank. You are handed to that page, you enter your card details there, and the bank tells us only whether the payment succeeded. Your card number, its expiry date and its security code never reach this website, and the studio has no way to see or store them. The same is true of Apple Pay: the payment is completed on that page, and we receive only the result.

What we keep is our own record of the transaction — order number, amount, status, date — for at least 3 years, because the bank's internet acquiring terms require it and because a refund or a dispute months later has to be answerable.

5. Your health declaration

Aerial training happens at height and under load, and a few conditions genuinely change what an instructor should let you do. That is the only reason we ask. You give the answers yourself and you can change or withdraw them at any time by telling us.

• Your instructor sees the flags relevant to teaching you safely — not your answers in full.
• The full answers are visible only to the studio's own staff accounts that need them, and access is limited by role.
• We do not share health information with anyone outside the studio, and we never use it for marketing.
• Your answers are stored encrypted, with a key kept apart from the database, so a copy of the database or of its backups does not reveal them.

6. Messages, and how to stop them

Two different kinds of message come from us. Confirmations, reminders, changes and cancellations are part of the service you booked, and they continue for as long as you have bookings — you can choose the channel they arrive on, WhatsApp or email. Anything promotional is separate and requires your consent.

You can withdraw marketing consent whenever you like, in one tap on your bookings page, or by telling us. We record the withdrawal the same way we recorded the consent.

7. Who else sees your data

We do not sell personal data, we do not rent it, and there are no advertising or analytics trackers on this site. Your data reaches other hands only where the service needs it:

ACBA Bank OJSC

Our card acquirer, which processes the payment itself.

Armenian Card CJSC (ArCa)

Runs the ipay.Arca payment page for the bank: it is where you enter your card details, and it holds the card data we never see.

Our messaging provider

The service that delivers our WhatsApp messages receives your phone number and the message text, so that the message can be sent.

Our hosting provider

This website and its database run on rented servers in Frankfurt, Germany. That means your data is stored outside Armenia, in a country whose data-protection regime is at least as strict as ours.

Instructors

Your name on their class roster, and the safety flags from your health declaration.

Authorities and advisers

Where the law requires it, or where we need our accountant or lawyer to see a record.

8. Cookies

This site sets a small number of its own cookies and no one else's. There is no advertising cookie here, no tracking pixel and no third-party analytics script, which is why you are not being asked to click through a consent banner.

ay_session

Keeps you signed in to your bookings. Up to 90 days.

ay_lang

Remembers whether you read the site in Armenian, English or Russian. One year.

ay_ref

Remembers which campaign link brought you, so we can count it once you book. 90 days.

ay_staff, ay_instructor

Sign-in cookies for the studio's own staff and instructors. Never set on a student's device.

You can clear or block cookies in your browser at any time. The site will still show you the schedule and the prices; it will not be able to keep you signed in.

9. How long we keep things

• Your account and its booking history: while you are a student of the studio, and afterwards until you ask us to delete it.
• Payment and refund records: at least 3 years, as our bank and the tax rules require. These we cannot delete on request.
• The waiver you accepted and your consent decisions: kept as proof for as long as they could matter, because their entire purpose is to be evidence of what was agreed.
• One-time login codes: minutes. They expire, are used once, and are stored hashed in the meantime.
• Health declarations: while you train with us, and deleted when you ask.

10. How we protect it

• Everything travels over an encrypted connection (HTTPS/TLS).
• Health declarations are encrypted in the database and in its backups.
• Signing in needs a code sent to your phone; there is no password to be guessed or reused, and codes are stored hashed with a limited number of attempts.
• Staff accounts see only what their role requires: an instructor sees a roster and safety flags, not payments.
• Every change staff make to a student's record is logged with who made it.
• The database is backed up daily, and the backups are held with the same care as the data.

No system is perfect. If a breach ever put your data at risk, we would tell you and the Personal Data Protection Agency rather than hope you did not notice.

11. Your rights

Under the Law on Protection of Personal Data you can ask us to show you the data we hold about you, correct it if it is wrong, delete it, stop processing it, or withdraw a consent you gave. Just ask — by phone, WhatsApp or email — and we will answer within the time the law allows. We may need to check you are who you say you are before we hand over personal data.

Some data we must keep even if you ask us to delete it: the payment records above are the main example. We will tell you plainly when that is the case, and delete everything else.

If you think we have handled your data badly, please tell us first. You also have the right to complain to the Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia (pdpa.am).

12. Children

Children's classes are booked by a parent or guardian, who gives the child's details, accepts the waiver and answers the health questions on the child's behalf. We hold no more about a child than teaching them safely requires, and a parent or guardian can see, correct or delete any of it by asking us.

13. Changes to this policy

If what we do with personal data changes, this page changes with it, and the version and date at the top will tell you. Where a change matters to you, we will say so rather than quietly republish the page.

14. How to reach us

For any question about your personal data, or to exercise any of the rights above:

Legal entity

ՕԴԱՅԻՆ ԵՎՆ ՍՊԸ

Taxpayer number (TIN)

01077445

Studio address

Buzand 7, Yerevan, Armenia

Registered address

Ք. Երեւան 0060, Ավան, Թումանյան թաղ, շ.6/3 բն 12

Phone

+37444711123

Email

aerial.yerevan@gmail.com

Instagram

@aerialyerevan

15. Language

This policy is published in Armenian, English and Russian. The Armenian text is the authoritative one: if a translation and the Armenian text differ, the Armenian text prevails.