Personal data processing policy

Page updated: 28.07.2026

Subject matter

This policy sets out the rules for processing personal data at NEO CREDIT UCO CJSC — for clients, prospective clients, partners, employees and website visitors. It applies together with the RA Law on Protection of Personal Data (HO-49-N), the regulations of the Central Bank of Armenia and the company's internal rules.

Principles

• Lawfulness: processing takes place only on a legal basis and for a clear purpose
• Proportionality: only what is necessary for the purpose is collected, and no more
• Accuracy: data is kept up to date and errors are corrected
• Storage limitation: data is kept only as long as the purpose or the law requires
• Transparency: a person knows what data they provide and why

Grounds for processing

• The conclusion and performance of a contract
• Compliance with statutory obligations, including supervisory and reporting requirements
• The legitimate interest of the company, such as risk management and fraud prevention
• The consent of the data subject, where the other grounds do not apply

Categories of data

• Identification: first name, last name, patronymic, date of birth, passport or ID card details, social security number where required by law
• Contact: address, phone number, email
• Financial and credit: income information, bank account details, credit history within the limits allowed by law
• Collateral: details of pledged property, its valuation and insurance
• Technical: server log data

Of these categories, only the name, phone number, email and the content of the request are collected through the website. The rest is provided at the office when a contract is concluded.

Transfer to third parties

Data is transferred only where the law requires or permits it: to the Central Bank of Armenia under supervisory requirements, to the credit bureau in the manner established by law, to banks and payment systems in order to execute transactions, and to law enforcement authorities in the cases required by law. Confidentiality agreements are concluded with service providers, and they may process data only on our instructions.

Personal data is neither sold nor transferred for advertising purposes.

Retention periods

Data is kept for as long as the purpose of processing requires, and no less than the period established by RA legislation and the contract. Once the period expires, the data is deleted or anonymised.

Security measures

• An encrypted connection and a database accessible only from the server side
• Access on a need-to-know basis, according to the employee's role
• Confidentiality obligations of employees, fixed in the employment contract
• Action logging: who accessed what data and when
• Regular backups and restore testing

In the event of a breach

On discovering a security breach the company assesses the risk, stops the breach, notifies the competent authority within the period established by law, and, where the risk is high, also notifies the individuals whose data is affected.

Rights and complaints

A data subject has the right to receive information about the processing, to require correction, erasure or restriction of processing, to object to processing and to withdraw consent. The request is submitted to the company. If the reply does not satisfy you, you may apply to the Personal Data Protection Agency of the RA Ministry of Justice or to a court.

Review

The policy is reviewed at least once a year, and also whenever legislation or the company's processes change materially. The current version is published on this page.