Privacy and Personal Data Processing Policy
This page is a translation provided for information. The Azerbaijani text is legally binding.
Last updated: 4 November 2026
This policy explains what personal data is collected when you use the ordubadbazar.az website and the Ordubad Bazar mobile app (iOS and Android), why and how it is processed, how it is protected and what rights you have. The policy has been prepared in accordance with the Law of the Republic of Azerbaijan “On Personal Data”.
1. Data controller
«Ordubad Bazar» MMC, VÖEN (TIN) 0400720381, legal address: AZ6900, Ordubad rayonu, Ordubad şəhəri, Heydər Əliyev, ev 41, mənzil 4. Contact: info@ordubadbazar.az, +994 50 800 69 69. Company information: Company and Details.
2. What data we collect
On the website:
- in enquiry and order forms: name, phone number, e-mail (optional), delivery address, the recipient’s name and phone number (“who it is for”), in a corporate Zərnigar order the name to which the personal letter will be addressed, and your note;
- in a corporate order: the company’s name, VÖEN, address, director, bank details, the logo file you upload and the recipient list (recipient’s name, phone number, address);
- for signing in to the “My Account” (“Otağım”) section: your phone number (one-time code by SMS) and, if you wish, a password — the password is stored only as an irreversible hash (bcrypt);
- for payment by bank transfer: the payment order file you upload;
- the map point (coordinates) of the delivery address; if you press the “◎ MY LOCATION” (“◎ YERİM”) button, your current location after your browser asks for permission — solely to find the address;
- the date of your consent and the version of the policy (stored together with the order as evidence);
- data you save yourself in the “My Account” section: the address book (“Karvan dəftəri”) (label, recipient’s name and phone number, address, map point, note), the corporate “My Seal” (“Möhürüm”) (brand kit: logo file, name on the lid, lid technique), the Zərnigar waiting list (name, phone number, quantity, note) and the Calendar (“Ruznamə”) (a record of holidays and special days) (name of the day, whom it concerns, day/month and, if you wish, year, reminder days, SMS/e-mail choice, the chest you have reserved). Calendar data is used solely to send reminders through the channel you choose (SMS or e-mail) and on the days you choose; it is not used for advertising and is not sold to third parties. Deleting a day or switching off the channel stops the reminder immediately; when you delete your account, this data is deleted as well;
- technical data: the IP address of the request (in hashed form) to prevent spam and automated requests; website error reports.
In the app: e-mail address (for the sign-in code), the password you create (stored only as an encrypted hash), company information, company details and “My Seal” (logo, name on the lid), delivery addresses and the address book, recipient lists, the Zərnigar waiting list and Calendar reminders (the app notification is scheduled on your device), order history, correspondence with the manager, the contract you sign and the documents you upload.
Bank card data. The card number, expiry date and CVV/CVC code are not collected, seen or stored by Ordubad Bazar. This data is entered only on Kapital Bank’s secure payment page and is processed by the bank. We are notified only of the payment result (successful or unsuccessful, amount, transaction number). Details: Payment and Security.
3. What we use the data for
- to accept and prepare the order and deliver it to the specified addresses;
- to call you, send you SMS and e-mail regarding the order, and notify you of the order status;
- to accept payment; to draw up the contract, invoice and other accounting documents;
- to provide access to your account;
- to protect the security of the website and the app and to fix errors.
We do not sell your data and do not provide it to third parties for advertising purposes.
4. Consent
Before submitting an order or enquiry on the website, you separately tick your consent to the processing of your personal data in accordance with this policy — the form cannot be submitted without consent. You may withdraw your consent at any time by writing to info@ordubadbazar.az. In that case, the processing of your data is stopped; the only exceptions are data necessary for an order still being fulfilled and data that must be retained by law.
5. To whom the data is transferred
Data is transferred only to the following services and only to the extent necessary for their work:
- Supabase — database, file storage and authentication service; servers are located in the European Union (Frankfurt, Germany);
- Vercel — the hosting service where the website is hosted;
- Poçt Göyərçini — SMS delivery (sign-in codes and order notifications);
- Resend — sending of service e-mails;
- Sentry — website and app error reporting (no personal data is sent, the IP address is masked);
- Kapital Bank ASC — processing of bank card payments;
- Google Analytics 4 (Google LLC) — website usage statistics;
- Meta Pixel and Conversions API (Meta Platforms) — measuring advertising results (name, phone number and address are not transferred);
- OpenStreetMap / Nominatim — the map in the order form: the coordinates of the point you tap on the map, or the address text you search for with “Find on map” (“Xəritədə tap”), are sent to find the address (name and phone number are not sent);
- Google Fonts, unpkg and cdn.sheetjs.com — loading of fonts, PDF preview and the library that reads Excel lists in the browser (your browser sends standard technical requests to these services; the Excel file is not sent to the server, it is read in the browser);
- the person carrying out the delivery — only the recipient’s name, phone number and address;
- government authorities — only when required by law.
6. Confidentiality and protection
- The website and the app transmit data only over an encrypted connection (HTTPS/TLS).
- Access rules in the database are set at row level: each user sees only their own (or their own company’s) data.
- Contract and payment order files are kept in private storage and can be opened only through a temporary signed link.
- Our staff access data only to the extent necessary for their job duties and are obliged to protect its confidentiality.
7. Browser storage and tracking
The website uses Google Analytics 4 and Meta Pixel cookies for analytics and advertising measurement (see below). Your browser’s local storage (localStorage) holds only your account and order fields (name, phone number, address, company details, recent orders), so that the information you have entered is not lost when you refresh the page. You can delete it at any time in your browser settings. The app contains no tracking or advertising SDK.
Analytics and advertising measurement. We use Google Analytics 4 (Google LLC) and Meta Pixel (Meta Platforms) to measure how the website is used. These services place cookies on your device and collect page view, chest view, add-to-cart, order and payment events, your IP address and browser information. Order and payment events are also sent to Meta from our server. Your name, phone number and address are not transferred to these services. You can stop this measurement by disabling cookies in your browser or with an ad blocker.
8. Retention period and deletion
Data is retained for as long as your account is active or your order is being fulfilled. Accounting documents that must be retained under the legislation (contract, invoice) are retained for the period required by law. To delete your account and data: Account Deletion.
9. Your rights
To access your data, correct it, request its deletion or restriction of its processing, or withdraw your consent, write to info@ordubadbazar.az.
10. Children
The website and the app are intended for corporate and personal buyers and are not directed at children. We do not knowingly collect data from children.
11. Changes
This policy may be updated. The new version is published on this page with a “Last updated” date.