PRIVACY POLICY

1. General Provisions

One Management (referred to as "Freedom", "Company", "we", "us" or "our") operates a hotel booking platform with an integrated Multi-Level Marketing (MLM) program. This Privacy Policy describes how we collect, use, store and protect personal data in accordance with the Republic of Armenia Law "On Personal Data Protection". "Grand Freedom" is the main product of One Management, offering a range of hotel services.

Personal data refers to any information relating to an identified or identifiable natural person ("Data Subject"). By using our platform, you acknowledge and agree to the collection and processing of your personal data as described in this Policy.

2. Data Subjects and Categories of Personal Data

One Management processes the following categories of personal data:

2.1. Registration and Profile Information

• Full name (first name, last name)
• Email address (unique identifier)
• Phone number
• Nickname (unique identifier for sponsor search)
• Password (encrypted)
• Date of registration
• Avatar/profile photo (optional)

2.2. Identity Verification Data

• Passport or national ID information
• Age verification data
• Residency information

2.3. Financial and Transaction Data

• Payment card details (processed through IDram payment gateway)
• Bank account information
• Transaction history
• Product purchase records (including nominal value and validity period)
• Virtual balance (product coins)
• Refund requests and their history

2.4. MLM Program Data

• Sponsor information (referral code, sponsor nickname)
• Position in binary MLM structure (left/right branch placement)
• Direct referral list
• Binary tree structure information
• Sales turnover for each branch (left and right)
• Bonus income (5% direct bonuses, 10% binary bonuses)
• Subscription status (18,000 AMD/year)
• Weekly income limit tracking (2,600,000 AMD/week)
• MLM performance metrics and statistics

2.5. Booking and Travel Data

• Hotel booking information (dates, room type, number of guests)
• Booking history
• QR codes for hotel check-in
• Special requests and preferences
• Check-in/check-out confirmations
• Guest reviews and feedback

2.6. Technical and Usage Data

• IP address
• Browser type and version
• Device information
• Cookies and similar tracking technologies
• Website usage patterns and analytics
• Login history and session data

2.7. Communication Data

• Email correspondence
• Support chat messages
• Phone call recordings (where applicable)
• Notification preferences
• Consent to marketing communications

2.8. Employment Application Data (for potential employees)

• CV/Resume
• Cover letter
• Work history
• Education
• References

3. Legal Basis for Data Processing

One Management processes personal data on the following legal grounds:

1. Performance of a contract: Processing necessary to fulfill our service obligations, including product purchases, hotel bookings, MLM bonus calculation, and payment processing.
2. Legal obligations: Compliance with Armenian tax laws, financial reporting requirements, anti-money laundering rules, and consumer protection legislation.
3. Legitimate interests: Operating and improving our platform, fraud prevention, security assurance, MLM structure management, bonus calculation and distribution, and business analytics.
4. Consent: For marketing communications, promotional activities, newsletter subscriptions, and optional data collection.

4. Methods of Personal Data Collection

Personal data is collected through:

1. Direct User Input:

• Registration forms (name, email, phone, nickname, password)
• Sponsor search and selection interface
• Product purchase process
• Hotel booking forms
• Profile management pages
• Payment forms (processed through IDram)

2. Automatic Collection:

• Cookies and tracking pixels
• Web analytics tools
• Session logging
• QR code generation and scanning systems

3. Third-Party Sources:

• IDram payment gateway (transaction confirmations)
• Partner hotels (booking confirmations, check-in status)
• Referral links (sponsor identification)

4. MLM System Interactions:

• Drag-and-drop referral placement interface
• Binary tree visualization tools
• Bonus calculation algorithms
• Subscription payment records

5. Purposes of Personal Data Processing

Freedom processes personal data for the following purposes:

5.1. Core Platform Services

• User registration and authentication
• Profile management
• Product catalog display and purchases
• Virtual balance management and expiration tracking
• Hotel booking and reservation management
• QR code generation for check-in confirmation
• Payment processing through IDram
• Transaction history tracking

5.2. MLM Program Operations

• Establishing sponsor-referral relationships
• Building and visualizing binary MLM structure
• Tracking referral placements (drag-and-drop positioning)
• Calculating direct bonuses (5% from direct sales)
• Calculating binary bonuses (10% from weaker branch)
• Applying weekly income limits (2,600,000 AMD/week)
• Managing subscription status (18,000 AMD/year)
• Distributing bonuses and commissions
• Generating MLM performance reports and statistics

5.3. Refund Processing

• Verifying refund eligibility (within 14 days, unused balance)
• Reversing direct bonuses (5%) from sponsors
• Adjusting binary structure turnover
• Reversing binary bonuses from upline users
• Processing refund payments through IDram

5.4. Hotel Management

• Providing hotel managers with guest booking lists
• Scanning and validating QR codes
• Check-in/check-out confirmation
• Managing hotel reception guests

5.5. Administrative Functions

• Monitoring overall platform statistics
• Managing products, hotels, and users
• Viewing MLM structure analytics
• Creating financial reports
• Detecting and preventing fraud

5.6. Communications and Support

• Sending transactional notifications: purchase confirmations, booking confirmations with QR codes, registration confirmations, product expiration warnings (7 days), new referral notifications, bonus crediting notifications, bonus reversal notifications (refunds), subscription expiration reminders (7 days)
• Customer support responses and request handling
• Platform updates and announcements

5.7. Marketing (with consent)

• Promotional offers and campaigns
• Newsletter distribution
• Special hotel offers and discounts
• MLM incentive programs

5.8. Legal Compliance

• Tax reporting and documentation
• Financial audits
• Regulatory requirement compliance
• Dispute resolution
• Cooperation with law enforcement agencies

5.9. Platform Improvement

• User experience analysis
• Feature development and testing
• Security enhancements
• Performance optimization

6. Access to Personal Data

The following may have access to personal data:

6.1. Internal Access

• Administrators: Full access to all platform data for system management and oversight
• Hotel Managers: Access to booking information for their specific hotels, including guest data and QR code verification
• Customer Support: Limited access to user profiles and transaction history for support purposes
• Finance Team: Access to payment and bonus transaction records for accounting and compliance
• MLM Management Team: Access to network structure, turnover data, and bonus calculations

6.2. Third-Party Service Providers

• IDram payment gateway: Processes payment transactions and receives necessary payment information
• Partner hotels: Receive booking data, guest information, and registration confirmations
• IT service providers: Maintain servers, databases, and technical infrastructure
• Cloud hosting services: Store platform data and backups
• Analytics providers: Process anonymized usage data to improve the platform
• Email service providers: Deliver transactional and marketing communications

6.3. Legal and Regulatory Authorities

• Tax authorities (for financial reporting)
• Law enforcement agencies (upon valid legal request)
• Courts and arbitration bodies (in case of disputes)
• Financial sector regulatory bodies (for MLM compliance oversight)

6.4. Other Users (limited)

• Sponsors: Can view their direct referrals' purchase amounts (for bonus calculation) and their placement in the binary structure
• Referrals: Can see their sponsor's name, nickname, and avatar during sponsor search

All third parties with access to personal data are contractually obligated to maintain confidentiality and comply with applicable data protection laws.

7. Data Retention Periods

Freedom retains personal data only for the period necessary:

After the retention period expires, data is securely destroyed as described in Section 8.

8. Personal Data Destruction

When personal data is no longer needed, Freedom ensures its secure destruction:

8.1. Electronic Data

• Permanent deletion from production databases
• Deletion from backup systems
• Secure media wiping
• Deactivation of linked authentication accounts
• Anonymization of data used for analytics

8.2. Physical Documents

• Shredding of paper documents
• Secure disposal of storage media
• Certificate of destruction (for confidential records)

8.3. Third-Party Data

• Verification that service providers have also destroyed data
• Deletion confirmation from payment processors
• Removal from email marketing platforms

9. Rights of Data Subjects

Under Armenian and international data protection law, you have the following rights:

9.1. Right of Access

• Profile information
• Transaction history
• Position in MLM structure
• Bonus income records
• Booking history

9.2. Right to Rectification

• Contact information
• Profile details
• Payment information

9.3. Right to Erasure ("Right to be Forgotten")

Request deletion of your personal data when:

• Data is no longer needed for the original purpose
• You withdraw consent
• Data was processed unlawfully
• Legal obligation requires deletion

Note: This right may be limited by legal retention requirements (taxes, accounting, dispute resolution) and MLM network integrity needs.

9.4. Right to Restriction

Request restriction of data processing during dispute resolution or accuracy verification.

9.5. Right to Data Portability

Receive your personal data in a structured, commonly used format (e.g., CSV, JSON) and transfer it to another controller.

9.6. Right to Object

• Direct marketing communications
• Automated decision-making
• Profiling

9.7. Right to Withdraw Consent

• Marketing communications
• Optional data collection
• Cookie tracking (via browser settings)

Note: Withdrawal does not affect the lawfulness of processing before withdrawal and may limit access to certain platform features.

9.8. Right to Lodge a Complaint

Lodge a complaint with the Personal Data Protection Agency of the Republic of Armenia if you believe your rights have been violated.

We will respond within 30 days of receiving your request.

10. Data Security Measures

Freedom implements robust security measures to protect personal data:

10.1. Technical Measures

• Encryption: SSL/TLS encryption for data in transit, AES-256 encryption for confidential data at rest
• Access Control: Role-Based Access Control (RBAC) for administrators, hotel managers, and support staff
• Authentication: Strong password requirements, session management, two-factor authentication (optional)
• QR Code Security: Encrypted QR codes containing booking ID, user ID, hotel ID, check-in date, and checksum
• Firewall Protection: Network firewalls and intrusion detection systems
• Regular Backups: Automated daily backups with secure off-site storage

10.2. Organizational Measures

• Staff Training: Regular data protection and security awareness training
• Confidentiality Agreements: All employees and contractors sign NDAs
• Access Audit: Regular review of user access privileges
• Incident Response Plan: Procedures for detecting, reporting, and responding to data breaches
• Vendor Management: Due diligence and contractual obligations for third-party processors

10.3. Payment Security

• IDram Gateway: PCI DSS compliant payment processing
• No Card Storage: Card data is processed by IDram and not stored on our servers
• Secure Transactions: End-to-end encryption for all payment communications

10.4. Breach Notification

• Notify you within 72 hours of discovery
• Inform the Personal Data Protection Agency of the Republic of Armenia
• Provide details of the breach and remediation measures
• Offer support and guidance to affected users

11. Special Considerations for the MLM Program

11.1. Transparency

The MLM structure is visualized transparently, showing your position, sponsor, referrals, and branch turnover (anonymized for privacy).

11.2. Bonus Calculation Data

We process sales data and automatically calculate bonuses based on:

• Direct sales by your referrals (5% bonus)
• Minimum branch turnover in binary structure (10% bonus)
• Active subscription status
• Weekly income limits

11.3. Refund Impact

When a user requests a refund, we reverse bonuses to maintain fairness:

• Direct bonuses are deducted from sponsors
• Binary bonuses are adjusted in the network
• Turnover is recalculated
• Affected users receive notifications

11.4. Network Integrity

MLM structure data is retained permanently to ensure accurate historical bonus tracking, dispute resolution, MLM regulatory compliance, and network stability.

12. Cookies and Tracking Technologies

Freedom uses cookies and similar technologies for:

• Maintaining user sessions and authentication
• Remembering user preferences
• Analyzing website traffic and usage patterns
• Delivering personalized content
• Supporting marketing and advertising

Cookie Types:

• Essential cookies: Required for platform functionality (cannot be disabled)
• Performance cookies: Collect anonymous usage data
• Functional cookies: Remember preferences and settings
• Marketing cookies: Track user behavior for advertising (consent required)

Cookie Management: You can control cookies through your browser settings. Disabling certain cookies may limit platform functionality.

For more information, please refer to our separate Cookie Policy.

13. International Data Transfers

If personal data is transferred outside the Republic of Armenia, we ensure:

• Adequate level of protection in the recipient country
• Standard contractual clauses approved by authorities
• Explicit consent where required
• Compliance with cross-border data transfer rules

14. Children's Privacy

Our platform is not intended for users under 18 years of age. We do not knowingly collect personal data from minors. If we discover such collection, we will immediately delete the data. Parents or guardians should contact us if they believe a minor has provided personal data.

15. Automated Decision-Making and Profiling

15.1. Automated Processes

We use automated systems for:

• Calculating bonuses (5% direct, 10% binary)
• Applying weekly income limits (2,600,000 AMD/week)
• Tracking product expiration dates
• Verifying refund eligibility
• Validating QR codes

15.2. Human Oversight

Significant decisions (account suspension, refund disputes, MLM violations) involve human review. You have the right to:

• Request human intervention
• Express your point of view
• Challenge automated decisions

16. Links to Third-Party Websites

Our platform may contain links to third-party websites (hotel websites, partner platforms). We are not responsible for the privacy policies of these sites. Please review their privacy policies before providing personal data.

17. Changes to this Privacy Policy

One Management reserves the right to update this Privacy Policy to reflect:

• Changes in legal requirements
• New platform features (including MLM program updates)
• Improved security measures
• User feedback

Notification of Changes:

• Updated policy will be posted on the website
• Effective date will be clearly indicated
• Email notification for significant changes
• Continued use constitutes acceptance

Version History:

• Version 1.0: January 1, 2024 (Initial Policy)
• Version 2.0: January 29, 2026 (MLM Integration and updated data categories)

18. Consent and Acceptance

By using the Freedom platform, you:

• Confirm that you have read and understood this Privacy Policy
• Agree to the collection, processing, and use of your personal data as described
• Agree to the data processing terms of our MLM program
• Accept the use of cookies and tracking technologies
• Confirm that you are at least 18 years old

Optional consents (may be withdrawn at any time):

• Marketing communications by email
• Marketing communications by SMS
• Data sharing with third-party marketing partners
• Personalized advertising

19. Contact Information and Data Protection Officer

For questions, concerns, or requests regarding this Privacy Policy or your personal data:

20. Effective Date

This Privacy Policy comes into force on January 29, 2026 and applies to all personal data collected and processed from that date.

21. Income Tax on Broker Earnings

The Company undertakes to pay the income tax on the amounts earned by brokers, in the amount of 20%.

Example: for an income of 5,000 AMD, the broker receives 4,000 AMD by bank transfer; the difference, 20%, is paid as income tax.