PRIVACY AND PERSONAL DATA PROTECTION POLICY
Last updated: 01.09.2026
1.1. This Policy sets out the procedure by which Pathrest LLC (hereinafter, the “Company” or “Pathrest”) processes personal data when the www.pathrest.am website, its subdomains, the Personal Account, forms, communication channels, booking functionality and other services of the Company are used.
1.2. This Policy applies to Users, Customers, trip participants, representatives of Partners and Suppliers, and other natural persons whose data is processed for the operation of the Digital Platform.
1.3. Processing is carried out in accordance with the applicable legislation of the Republic of Armenia, including the Law of the Republic of Armenia on Personal Data Protection.
1.4. This Policy does not replace third-party policies. After a User proceeds to an external website of a seller, airline, bank or other platform, the processing carried out by that third party is also governed by its own terms.
1.2. This Policy applies to Users, Customers, trip participants, representatives of Partners and Suppliers, and other natural persons whose data is processed for the operation of the Digital Platform.
1.3. Processing is carried out in accordance with the applicable legislation of the Republic of Armenia, including the Law of the Republic of Armenia on Personal Data Protection.
1.4. This Policy does not replace third-party policies. After a User proceeds to an external website of a seller, airline, bank or other platform, the processing carried out by that third party is also governed by its own terms.
2.1. The entity organising data processing for the Company’s own purposes is Pathrest LLC.
2.2. For matters concerning personal data: trip@pathrest.am.
2.3. In certain processing chains, a Partner or external Supplier may independently determine the purposes and means of processing the data it receives and bear independent obligations under applicable law.
2.2. For matters concerning personal data: trip@pathrest.am.
2.3. In certain processing chains, a Partner or external Supplier may independently determine the purposes and means of processing the data it receives and bear independent obligations under applicable law.
3.1. Identification data: first name, last name, patronymic, date of birth, sex, citizenship and information required for a specific Service.
3.2. Identity document data: passport/ID, validity period, country of issue, copies and other information where required for booking, transportation, accommodation, visa or other Services.
3.3. Contact data: telephone number, email address, postal address and preferred means of communication.
3.4. Order data: destinations, dates, itinerary, Accommodation Property, flight, participants, Services, special requests, and the history of bookings, cancellations and refunds.
3.5. Payment information: amount, currency, status, transaction/Order identifier, payment method and limited information received from the bank/Supplier. The Company does not intend to store complete bank card details where they are processed through payment infrastructure.
3.6. Account data, settings, activity history and documents/forms in the Personal Account.
3.7. Technical data: IP address, device, browser, language, time, URL/referrer, cookies and technical events.
3.8. Correspondence, enquiries and attached documents.
3.9. By providing the data of another trip participant, the Customer confirms that a lawful basis exists for transferring such data.
3.2. Identity document data: passport/ID, validity period, country of issue, copies and other information where required for booking, transportation, accommodation, visa or other Services.
3.3. Contact data: telephone number, email address, postal address and preferred means of communication.
3.4. Order data: destinations, dates, itinerary, Accommodation Property, flight, participants, Services, special requests, and the history of bookings, cancellations and refunds.
3.5. Payment information: amount, currency, status, transaction/Order identifier, payment method and limited information received from the bank/Supplier. The Company does not intend to store complete bank card details where they are processed through payment infrastructure.
3.6. Account data, settings, activity history and documents/forms in the Personal Account.
3.7. Technical data: IP address, device, browser, language, time, URL/referrer, cookies and technical events.
3.8. Correspondence, enquiries and attached documents.
3.9. By providing the data of another trip participant, the Customer confirms that a lawful basis exists for transferring such data.
4.1. Registration and operation of the Personal Account.
4.2. Search, creation, confirmation, amendment, administration, cancellation and refund of Bookings/Orders.
4.3. Transfer of the necessary data to a Marketplace Partner, tour operator, Accommodation Property, carrier, airline, GDS/aggregator, transfer company and other persons involved in performance.
4.4. Receipt and identification of payments, fraud prevention, and accounting, tax and financial record-keeping.
4.5. Support, claims and disputes.
4.6. Information security and prevention of misuse.
4.7. Compliance with the requirements of legislation and competent authorities.
4.8. Analysis and improvement of the Digital Platform, as well as marketing and personalisation where there is a proper legal basis and, where required, consent.
4.2. Search, creation, confirmation, amendment, administration, cancellation and refund of Bookings/Orders.
4.3. Transfer of the necessary data to a Marketplace Partner, tour operator, Accommodation Property, carrier, airline, GDS/aggregator, transfer company and other persons involved in performance.
4.4. Receipt and identification of payments, fraud prevention, and accounting, tax and financial record-keeping.
4.5. Support, claims and disputes.
4.6. Information security and prevention of misuse.
4.7. Compliance with the requirements of legislation and competent authorities.
4.8. Analysis and improvement of the Digital Platform, as well as marketing and personalisation where there is a proper legal basis and, where required, consent.
5.1. Data is processed where a basis provided by law exists, including consent, the necessity to enter into or perform a contract or Order, compliance with a legal obligation, or another lawful basis.
5.2. Refusal to provide data objectively necessary for a Service may make it impossible to arrange that Service.
5.3. Where the law requires separate consent, the Company obtains it by a method that enables the fact of its provision to be demonstrated.
5.2. Refusal to provide data objectively necessary for a Service may make it impossible to arrange that Service.
5.3. Where the law requires separate consent, the Company obtains it by a method that enables the fact of its provision to be demonstrated.
6.1. Marketplace. Pathrest receives Order data and transfers to the Partner the information necessary for actual performance. The Partner must not use such data for incompatible purposes without an independent legal basis.
6.2. Intermediary/API model. Data may be transferred automatically or manually by a Pathrest employee to an upstream tour operator, accommodation service provider, aggregator, GDS, carrier or other participant.
6.3. Affiliate/redirect. When a User proceeds to an external website, Pathrest may transmit technical attribution identifiers. Data entered by the User on the external website is received by the relevant external operator.
6.4. Proprietary Services. Pathrest processes data as a party to the relevant Service and transfers it to engaged service providers to the extent necessary.
6.2. Intermediary/API model. Data may be transferred automatically or manually by a Pathrest employee to an upstream tour operator, accommodation service provider, aggregator, GDS, carrier or other participant.
6.3. Affiliate/redirect. When a User proceeds to an external website, Pathrest may transmit technical attribution identifiers. Data entered by the User on the external website is received by the relevant external operator.
6.4. Proprietary Services. Pathrest processes data as a party to the relevant Service and transfers it to engaged service providers to the extent necessary.
7.1. Depending on the Order, recipients may include Marketplace Partners, tour operators/travel agents, Accommodation Properties, airlines and carriers, GDSs/aggregators, transfer/transport companies, cruise and excursion service providers, guides and other service providers.
7.2. To the extent necessary, data may be received by banks, acquirers, and payment, accounting, hosting, cloud, communications and technical service providers.
7.3. Data is provided to public authorities in the cases and according to the procedure established by law.
7.4. The Company does not sell personal data as information. Commission or agency remuneration received in connection with an Order does not constitute the sale of personal data.
7.2. To the extent necessary, data may be received by banks, acquirers, and payment, accounting, hosting, cloud, communications and technical service providers.
7.3. Data is provided to public authorities in the cases and according to the procedure established by law.
7.4. The Company does not sell personal data as information. Commission or agency remuneration received in connection with an Order does not constitute the sale of personal data.
8.1. For international travel Services, data may be transferred to recipients outside the Republic of Armenia, including in the country of destination or transit, or in the country where the Supplier is located.
8.2. Such transfers are carried out where the conditions and legal basis provided by law exist, taking into account mandatory requirements concerning the level of protection, authorisations, consent and other safeguards.
8.3. If the data subject’s consent is required for a specific transfer, it is requested before the transfer unless another procedure lawfully applies.
8.4. Where the necessary data cannot lawfully be transferred to a foreign Supplier, it may be impossible to make an international Booking.
8.2. Such transfers are carried out where the conditions and legal basis provided by law exist, taking into account mandatory requirements concerning the level of protection, authorisations, consent and other safeguards.
8.3. If the data subject’s consent is required for a specific transfer, it is requested before the transfer unless another procedure lawfully applies.
8.4. Where the necessary data cannot lawfully be transferred to a foreign Supplier, it may be impossible to make an international Booking.
9.1. Online payments may be processed by an acquiring bank/payment service provider; card data entry fields may be located in its secure environment even where they are visually embedded in the Website.
9.2. Pathrest receives the information necessary to identify the transaction, confirm payment, process a refund, maintain records and resolve disputes.
9.3. The User must not send a complete card number, CVV/CVC or other confidential payment data by ordinary email or through free-form fields.
9.2. Pathrest receives the information necessary to identify the transaction, confirm payment, process a refund, maintain records and resolve disputes.
9.3. The User must not send a complete card number, CVV/CVC or other confidential payment data by ordinary email or through free-form fields.
10.1. Data is retained no longer than necessary for the purposes of processing, contract performance, accounting, tax, claims-related and other lawful obligations, unless another period is prescribed by law.
10.2. Once the purpose of processing ceases to exist and the mandatory retention period expires, data is deleted, destroyed or anonymised unless another legal basis exists.
10.3. Backup copies may be retained for a limited additional period within the backup cycle.
10.2. Once the purpose of processing ceases to exist and the mandatory retention period expires, data is deleted, destroyed or anonymised unless another legal basis exists.
10.3. Backup copies may be retained for a limited additional period within the backup cycle.
11.1. The Company applies organisational and technical measures appropriate to the nature of the data and the risks of processing.
11.2. Access by employees and Third Parties is limited to what is necessary, and they are subject to confidentiality obligations.
11.3. In the event of an incident, the Company takes measures to contain and assess it and to restore affected systems, and follows the mandatory notification procedures prescribed by law.
11.2. Access by employees and Third Parties is limited to what is necessary, and they are subject to confidentiality obligations.
11.3. In the event of an incident, the Company takes measures to contain and assess it and to restore affected systems, and follows the mandatory notification procedures prescribed by law.
12.1. A data subject may exercise the rights provided by the legislation of the Republic of Armenia, including the right to obtain information about processing and to rectify inaccurate data.
12.2. In the cases provided by law, a data subject may request the blocking of data, cessation of processing or destruction of data.
12.3. Consent may be withdrawn in accordance with the established procedure; withdrawal does not affect the lawfulness of prior processing or other independent legal bases.
12.4. The Company may take reasonable steps to verify the applicant’s identity.
12.5. A data subject has the right to apply to the competent authority and/or a court.
12.2. In the cases provided by law, a data subject may request the blocking of data, cessation of processing or destruction of data.
12.3. Consent may be withdrawn in accordance with the established procedure; withdrawal does not affect the lawfulness of prior processing or other independent legal bases.
12.4. The Company may take reasonable steps to verify the applicant’s identity.
12.5. A data subject has the right to apply to the competent authority and/or a court.
13.1. The data of minors may be processed for family/group Bookings subject to compliance with legal requirements.
13.2. A person placing an Order in the interests of a minor confirms that the necessary authority and legal grounds exist.
13.2. A person placing an Order in the interests of a minor confirms that the necessary authority and legal grounds exist.
14.1. The Digital Platform may use necessary cookies for identification, security, settings and operation.
14.2. Analytics, marketing and affiliate technologies may be used for statistics, measuring referrals, attributing Bookings and calculating partner remuneration.
14.3. Cookie categories and their management are governed by the Cookie Policy; where consent is required, non-essential technologies are activated in accordance with the applicable consent mechanism.
14.2. Analytics, marketing and affiliate technologies may be used for statistics, measuring referrals, attributing Bookings and calculating partner remuneration.
14.3. Cookie categories and their management are governed by the Cookie Policy; where consent is required, non-essential technologies are activated in accordance with the applicable consent mechanism.
15.1. When a Partner registers, the Company may process data concerning representatives, managers and contact persons, as well as documents necessary to verify status, authority, bank details and the right to conduct business.
15.2. The set of documents depends on the legal form and type of activity and may include an ID, registration/tax documents, bank details, licences, notifications, permits and other mandatory documents.
15.3. Non-public commercial appendices, calculations and tariffs may be stored and made available through the Personal Account or secure means of communication.
15.2. The set of documents depends on the legal form and type of activity and may include an ID, registration/tax documents, bank details, licences, notifications, permits and other mandatory documents.
15.3. Non-public commercial appendices, calculations and tariffs may be stored and made available through the Personal Account or secure means of communication.
16.1. The Company may update this Policy if legislation, the business model, the Digital Platform, Suppliers or technologies change.
16.2. The current version is published together with its update date; where separate consent is required, it is obtained in the prescribed manner.
16.3. An amendment to this Policy does not in itself create a new legal basis for processing.
16.2. The current version is published together with its update date; where separate consent is required, it is obtained in the prescribed manner.
16.3. An amendment to this Policy does not in itself create a new legal basis for processing.
17.1. This Policy may be made available in Armenian, Russian and English.
17.2. In the event of any inconsistency between language versions, the Armenian version prevails unless otherwise required by mandatory provisions of applicable law.
17.2. In the event of any inconsistency between language versions, the Armenian version prevails unless otherwise required by mandatory provisions of applicable law.
18.1. Where a Booking is made without redirection, the data of the Customer and trip participants may be transferred directly from the Pathrest interface to the API/GDS of an airline, booking system, Accommodation Property, transport, cruise, excursion or other Supplier to the extent necessary to create, confirm, amend, cancel and administer the Order.
18.2. If a payment is processed by an integrated third party, payment data may be entered into a secure component provided by that party or transmitted to it through a secure channel provided by the integration. Pathrest must not store complete bank card data unless such storage is required by the applicable model and is secured in accordance with mandatory security requirements.
18.3. Depending on the specific integration, an external person may independently determine certain purposes and means of data processing within its own Service. The terms and privacy policy of the relevant Supplier, where presented to the User in applicable cases, may additionally apply to such processing.
18.4. Cross-border transfer of data is permitted to the extent necessary for an international Booking, transportation, accommodation, payment or another Service requested by the Customer, subject to compliance with the applicable requirements of the legislation of the Republic of Armenia.
18.2. If a payment is processed by an integrated third party, payment data may be entered into a secure component provided by that party or transmitted to it through a secure channel provided by the integration. Pathrest must not store complete bank card data unless such storage is required by the applicable model and is secured in accordance with mandatory security requirements.
18.3. Depending on the specific integration, an external person may independently determine certain purposes and means of data processing within its own Service. The terms and privacy policy of the relevant Supplier, where presented to the User in applicable cases, may additionally apply to such processing.
18.4. Cross-border transfer of data is permitted to the extent necessary for an international Booking, transportation, accommodation, payment or another Service requested by the Customer, subject to compliance with the applicable requirements of the legislation of the Republic of Armenia.
19.1. For a Booking made through the Marketplace, Pathrest may transfer to the Partner the data objectively necessary to confirm and provide the Service. The Partner must use such data on a lawful basis and only within the relevant Booking.
19.2. For intermediary/API Services, data may be transferred to a tour operator, booking system, Accommodation Property, carrier, airline, GDS/aggregator, or payment or technology Supplier to the extent necessary for search, Booking, payment, performance, amendment or refund.
19.3. Where accommodation Services are booked manually, an authorised Pathrest employee may enter the data provided by the Customer into the secure account of an upstream tour operator. Where the process is automated, the same purposes may be achieved through an API.
19.4. Cross-border transfers are carried out in compliance with the legislation of the Republic of Armenia and on an applicable legal basis.
19.5. Pathrest must not store complete bank card details where they are entered directly in the secure interface of a bank/payment service provider; the transaction identifier, status, amount and necessary settlement information may be processed.
19.2. For intermediary/API Services, data may be transferred to a tour operator, booking system, Accommodation Property, carrier, airline, GDS/aggregator, or payment or technology Supplier to the extent necessary for search, Booking, payment, performance, amendment or refund.
19.3. Where accommodation Services are booked manually, an authorised Pathrest employee may enter the data provided by the Customer into the secure account of an upstream tour operator. Where the process is automated, the same purposes may be achieved through an API.
19.4. Cross-border transfers are carried out in compliance with the legislation of the Republic of Armenia and on an applicable legal basis.
19.5. Pathrest must not store complete bank card details where they are entered directly in the secure interface of a bank/payment service provider; the transaction identifier, status, amount and necessary settlement information may be processed.
20.1. For the purpose of entering into, performing and evidencing electronic contracts, the Company may process the date and time of actions, account, Order and document identifiers, versions of accepted documents, IP address, user-agent, session identifiers, information on sending and verifying one-time codes, event logs, information on sending electronic communications, and file checksums.
20.2. Such data is processed to the extent necessary for the performance of contracts, security, consideration of claims, compliance with mandatory record-keeping requirements and protection of legitimate interests.
20.2. Such data is processed to the extent necessary for the performance of contracts, security, consideration of claims, compliance with mandatory record-keeping requirements and protection of legitimate interests.
SERVICES
PROGRAMS
Terms
Corporate program
Subscribe
Payment method:
© 2023-2026 Pathrest LLC
