Privacy Policy
"Kamurj" Mobile Application
Effective Date: 18 September 2026 · Version 1.0
NOTICE: In the event of any inconsistency or discrepancy between the Armenian and English versions of this Policy, the Armenian version shall prevail and govern.
1. Who We Are
The controller of your personal data is "Kamurj" Universal Credit Organization Closed Joint-Stock Company ("Kamurj" UCO CJSC, hereinafter "Company", "we", "us"), operating under License No. 31 issued by the Central Bank of Armenia.
2. Scope of Application
This Policy describes how we collect, use, disclose, and store your personal data when you use the "Kamurj" mobile application (hereinafter "Application"). It complements the Terms and Conditions for Registration of Personal Account and Provision of Services, forming an integral part of the agreement between you and the Company.
Data processing is carried out in compliance with the Law of the Republic of Armenia "On Personal Data Protection", the Law of the Republic of Armenia "On Anti-Money Laundering and Combating the Financing of Terrorism", normative acts of the Central Bank of Armenia, and other applicable legal acts of the Republic of Armenia.
3. What Data We Collect
| Category | Data | Source |
|---|---|---|
| Identification Data | First name, last name, patronymic name, passport or ID card details (number, date of issue, validity), Public Services Number (PSN), date of birth. | From you upon registration, and from relevant state electronic registries for verification and confirmation purposes. |
| Biometric Data | Facial images and video recording (with audio) captured during the liveness check; photos of your identification document. | From you via the Application's camera and microphone, with your explicit consent. |
| Contact Data | Mobile phone number, email address, registration and actual residential address. | From you. |
| Financial Data | Linked bank card details: masked number (last 4 digits), expiration date, issuing bank, tokenized identifier (full card number is not stored by us); loan applications, loan agreements, balances, repayment schedules, payment history. | From you, payment systems, and the Company. |
| Login Data | Password and PIN code (stored in hashed form only); preferences for Face ID / Touch ID usage. | From you. Biometric authentication is performed exclusively by your device's operating system; biometric data stored on your device is never transmitted to us. |
| Technical Data | Device identifier, push notification token, IP address, Application and OS version, login and activity logs (date, time, action). | Automatically, when using the Application. |
We do not collect geolocation data, contact lists, photo library content, or other device storage data. The Application does not contain advertising, analytics, or tracking software modules.
4. Purposes and Legal Bases
| Purpose | Legal Basis |
|---|---|
| Identity verification, Know Your Customer (KYC) compliance, and Anti-Money Laundering (AML) statutory obligations | Legal obligation prescribed by law. |
| Processing biometric data for identification and liveness verification | Your explicit consent, unless another legal basis applies under applicable law. |
| Creation and maintenance of the Personal Account, providing services to you | Performance of a contract with you. |
| Loan application evaluation, loan issuance and servicing, processing repayments | Performance of a contract and compliance with legal obligations, as applicable. |
| Linking bank cards, cardholder authentication, processing payments | Performance of a contract. |
| Ensuring security, fraud prevention, binding device and session, access control | Compliance with legal obligations and, where applicable, the legitimate interests of the Company. |
| Communication with you: One-Time Passwords (OTP), service notifications, emails, SMS | Performance of a contract. |
| Compliance with legal obligations, audits, dispute resolution | Legal obligation prescribed by law. |
5. Automated Decision-Making
Loan applications are evaluated automatically using the Company's scoring model, based on data provided by you and information obtained from legally authorized sources. You have the right to request a manual review of the decision by an employee, express your point of view, and contest the decision by contacting info@kamurj.am.
If the final decision on a loan application is made by an employee, the automated score itself shall not be considered a final decision.
6. Data Recipients
We may transfer or grant access to your personal data to individuals and entities whose involvement is necessary for the provision and proper execution of our services and for the fulfillment of our legal obligations. Such recipients may include, in particular: our service providers (legal, debt collection, technological, and IT providers), payment and card system operators, identity verification and data checking service providers, communication and notification service providers, as well as "Armenian Card" CJSC (ArCa) and other relevant organizations.
Personal data may also be disclosed to state authorities, including the Central Bank of Armenia, law enforcement, and other competent authorities, if such disclosure is provided for or required by law, or is necessary for the performance of our legal obligations.
We disclose data only to the extent necessary to achieve the specific purpose and ensure that recipients process the data solely for defined purposes and under confidentiality and security measures required by applicable law. Where necessary, appropriate contracts or other legal instruments are executed with recipients, establishing their obligations regarding personal data protection, confidentiality, and security.
We do not sell your personal data, do not transfer it for advertising purposes, and do not engage in cross-app tracking.
7. International Data Transfer
Personal data may be transferred to and processed outside the territory of the Republic of Armenia if necessary for service provision, operation of technical and IT systems, data storage, identification, communication, or other relevant processes.
Such transfers may be made to our service providers, technology partners, and other partners only in accordance with applicable legal requirements and subject to necessary data protection safeguards.
Specifically:
- For automated identification and liveness check purposes, your biometric data and ID document images may be processed on OZ Forensics servers located in the European Union (Spain).
- For push notification delivery, relevant technical data may be transmitted to Expo, Apple, and Google infrastructure located in the United States (Push notifications do not contain identification, financial, or other sensitive personal data).
We take steps to ensure that personal data transferred outside the Republic of Armenia maintains a level of protection compliant with applicable legal requirements.
8. Retention Periods
| Data | Retention Period |
|---|---|
| Identification, biometric, and KYC data; loan agreements, applications, and payment history | For the mandatory retention period established by applicable law, including at least 5 years following the termination of the business relationship, where applicable. Upon expiry of the mandatory retention period, data is deleted or irrevocably anonymized, unless further retention or processing is required by law. |
| Security logs (IP address, device info, login events) | For the mandatory retention period established by applicable law, including up to 5 years for security and fraud prevention purposes. |
| One-Time Passwords (OTP) | Automatically deleted immediately after use or expiration (within minutes). |
| Login and device sessions | Short-term; terminated automatically. |
| Push notification token | Until you log out, log in from another device, or delete your account, unless earlier retention is required for security or other legal reasons. |
9. Security
- Passport details and PSN are stored in encrypted form; biometric and document images are stored with AES-256 encryption in a storage isolated from public access.
- All transmissions between the Application and our servers, as well as with partners, are protected via TLS encryption.
- Passwords and PIN codes are stored in hashed form only and cannot be recovered.
- One active session per account; logging in from a new device requires SMS verification; suspicious activities lead to access suspension.
- Face ID / Touch ID data is processed exclusively by your device and is never transmitted to us.
- Access to personal data is restricted solely to authorized employees who require it for official duties; all access events are logged.
10. Your Rights
Pursuant to the Law of the Republic of Armenia "On Personal Data Protection", you have the right to:
- Be informed about what personal data we process and obtain a copy thereof;
- Request correction of inaccurate or incomplete data (phone number and email can be updated within the Application; for other data, please contact us);
- Request erasure of data or restriction of processing, provided further processing or retention is not mandatory by law or based on another lawful ground;
- Withdraw your consent (including consent for biometric data processing); please note that without identity verification and necessary data, we may be unable to provide or continue providing our services;
- Object to automated decisions and request a manual review by an employee;
- File a complaint with the supervisory authority.
To exercise your rights, please contact info@kamurj.am. We will respond within the statutory timeframe; proof of identity may be requested if necessary.
11. Account Deletion
You can delete your account at any time directly within the Application: Account → Security → Delete Account. For security reasons, your password is required. Upon account deletion:
- Your account is immediately closed; access is disabled, all active sessions are terminated, and the push notification token is removed;
- Your phone number and email address are removed from active usage, allowing you to re-register in the future;
- Identification, KYC, and transactional data are retained for the mandatory period specified in Section 8 and subsequently deleted;
- A confirmation email is sent to you.
Account deletion is irreversible. If you have outstanding financial obligations, your contractual obligations remain in effect, and you must perform them within the specified timeframes and manner. Future use of the Application will require a new registration and identification process.
12. Children
Services are available only to individuals aged 18 and older. We do not knowingly collect personal data from minors.
13. Advertising and Tracking
The Application contains no advertising, does not use advertising identifiers, and does not perform cross-app or cross-website tracking.
14. Amendments
This Policy may be updated. We will notify you of material changes via the Application or email before they take effect. The current version is always available in the Application and at www.kamurj.am/en/privacy.
15. Contact and Supervisory Authority
For complaints regarding personal data processing, you may contact the Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia.
