Privacy policy for personal and card data

Last updated: 12 October 2026.

This policy describes how pay.risefoundation.am (RISE EDUCATIONAL FOUNDATION, TIN 08298635, legal address: 3 Aram Khachatryan Street, Arabkir, Yerevan 0033, Armenia) collects, uses and protects visitors' and buyers' personal and payment data.

Card data

The full card number and security code are entered on Inecobank’s payment page and are not stored by the foundation. The foundation may receive the transaction reference, amount, status and limited payment data provided by the bank, such as a masked card number, to confirm, account for and refund payments.

What is collected

We collect your name and email address, a telephone number where needed, and an address when delivery is requested. Registration also collects the participant’s name, school, year group, age group and contact details. We keep the consenting person’s name, authority, notice version and time, and the separate publication choice. For donations, we also keep any note and name-publication preference you provide.

What it is used for

The data collected is used to process your order, issue the fiscal receipt, arrange delivery and contact you about the order.

With your separate agreement, it is also used to tell you what the foundation offers — new books, classes and competitions, and the chance to register for them. That agreement is given by ticking a separate box when you place an order, is optional, and can be withdrawn at any time through the link in any message or by writing to info@risefoundation.am. See also the payment terms.

We do not sell personal data. We do not send names, contact details, children's answers or private order-access links to advertising or marketing providers. When Google Ads measurement is enabled, Google receives the limited data described in the separate measurement section below.

Unfinished-order reminders

If payment for a saved order is unfinished, we may send up to three reminders: after 2 hours, on day 3 and on day 7. Each email lets you stop reminders. A further invitation after one month requires your separate consent to receive news and offers.

Competition participants' data

For participants under 16, required data-processing consent comes from their legal representative; participants aged 16 or over confirm personally. Being a teacher or another payer does not itself confer representative authority. Data-processing consent and capacity to enter a paid contract are separate questions. The results-publication choice is separate and does not cover photos or videos. Data needed for the competition is transferred to ViLLe as described below. Order messages go to the supplied contact address. Personal data is never sold. For Bebras, this permission applies to participants who achieve a high score: with permission, their name, school, year group and result may be published on bebras.am.

The participant’s name, school and year group are used to run the competition and provide results. Identifiable data is retained only as needed for the competition, results, corrections and other specific lawful purposes. Details are transferred to ViLLe; answers and results are used in BeLLE research under the conditions described in the privacy policy. We also record the age group, the person giving consent, their authority, notice version and consent time. Details:

Sharing with third parties

The minimum data needed to confirm a payment is passed to Inecobank. As the law requires, sales data is passed to the State Revenue Committee of Armenia through the electronic fiscal receipt system. The competition itself is run on the ViLLe platform, provided by the Research Institute for Learning Analytics (TRILA) at the University of Turku, Finland — a participant's name, school and year group are uploaded there so that an account can be created, and ViLLe keeps platform data for five years after the last sign-in. The challenge's answers and results are also used in the BeLLE research project, for which the University of Turku is the data controller on the basis of scientific research in the public interest; that data is kept for ten years after the project ends and may be shared in pseudonymised form with the project's researchers. The separate Google Ads measurement section below explains what Google receives when measurement is enabled. We do not sell personal data.

Microsoft Azure hosts the site and its data storage. Azure Communication Services receives the recipient’s email address and transactional message contents, including order or fiscal-receipt details and attachments, to deliver the email. Microsoft Azure also processes technical diagnostics about the site’s operation.

• ViLLe privacy notice
• BeLLE research privacy notice

Contact us about platform-data requests so we can coordinate them according to the applicable roles and agreements. The University of Turku’s data protection officer: dpo@utu.fi

Cookies

The site uses its own cookies to remember your language and analyse visits. A random identifier recognises returning visits from the same browser. Google advertising measurement cookies may also be used under the regional setting described below. Turning off ad measurement does not affect registration or payment.

When analytics is enabled, random browser and visit identifiers are retained for up to 400 days. A new visit starts after 30 minutes of inactivity. At order creation, these identifiers may be linked to the order and the page variant shown to measure registration, book sales, payment and refund outcomes. This linkage is also removed after 400 days; financial records follow their separate retention rules. Visit-history events do not contain names, entered form values or card data. Separate school-search diagnostics are described below.

The analytics history stores random browser and visit identifiers, event times, language, the referring Rise programme, and fixed page and action categories. It records whether a form or payment step was completed without storing names or field contents. This pseudonymous history connects repeat visits and is available to authorised administrators. Events are retained for 400 days, then removed during scheduled daily cleanup. The temporary link between these identifiers and orders is described above. Referring programme and campaign labels may remain with the order for its recordkeeping purposes.

When analytics is enabled, we also separately store the final school-search phrase, number of suggestions shown, language and search outcome to make schools easier to find. These records contain no parent, participant, browser, visit or order identifiers and are retained for 30 days with daily cleanup. Long inputs and obvious contact details are excluded. Turning analytics off stops future collection.

A separate first-arrival cookie stores how this browser first found us for up to 400 days from capture, without extending that expiry. It may contain the referring website’s hostname and the source, medium and campaign names from tagged links. Return visits do not replace the original source. We do not store the full referring URL or advertising click identifiers. These details also accompany the pseudonymous events described above and follow their 400-day event retention. Turning analytics off removes this cookie and stops future collection. A first source that was not recorded remains unknown.

When visit analytics is enabled, the server temporarily uses the request IP address to look up an approximate country, region and city in a local DB-IP IP to City Lite database. The IP address is not sent to an external location service and is not stored in analytics records. Only the resulting approximate location names accompany the pseudonymous events described above, with the same 400-day retention. We do not collect GPS coordinates or precise addresses. VPNs, proxies, mobile networks and database inaccuracies can produce an incorrect or unknown location. Turning analytics off also stops future location collection.

When measurement is enabled, shared source, medium, campaign and optional post (utm_content) labels from a post link are kept separately in the browser for up to 400 days. They are eligible for order credit for 30 days after the latest tagged arrival. Direct returns do not extend this period. At order creation we save the applicable labels and arrival time, with random browser and visit identifiers when available, to compare confirmed payments and refunds by post. Later arrivals do not change an existing order’s attribution or its original first source. These measurement records are retained for up to 400 days and removed on opt-out while financial records are preserved. Labels must describe shared posts, not people; we do not store individual advertising click IDs or complete URLs.

When you follow an invitation link we retain its protected code for up to 30 days within the challenge deadline to credit the inviter. Referral and reward records are kept separately from optional analytics and are not deleted when analytics is disabled. Optional measurements of link opens respect your analytics choice.

Approximate location data source: DB-IP IP to City Lite · CC BY 4.0.

Optional Google Ads measurement

When measurement is enabled, we use Google Ads to associate ad clicks with completed registrations, accepted inquiries and paid orders. Google receives advertising identifiers and technical browser information, including the IP address used to connect to its service. We send only an event category and a non-secret reference for avoiding duplicate counts; we do not send names, email addresses, phone numbers, children's answers or private order-access links. Personalised advertising and enhanced conversions are disabled. Google may process information outside Armenia under its privacy policy.

For visits identified as being from Armenia, Google Ads measurement is enabled automatically unless you have turned it off. Elsewhere, or if the location cannot be determined, it stays off until an adult visitor allows it. A saved refusal always keeps measurement off. Your choice is separate from accepting purchase terms and does not affect registration or payment. Change it below on this privacy page. Your explicit choice is remembered for up to 180 days and shared between risefoundation.am and pay.risefoundation.am. Other programme websites store their choices separately.

Meta ad measurement

The Meta Pixel helps associate Facebook and Instagram ads with completed purchases. When enabled, Meta receives ad-click and browser identifiers, technical information including IP address, the purchase event, amount paid, currency and a non-secret reference to prevent duplicate counts. The Pixel runs on an isolated page and cannot access the checkout form. We do not send names, contact details, children’s answers or private order links. Automatic event collection and advanced matching using contact details are disabled. Meta may process information outside Armenia under its privacy policy.

Meta follows the regional setting above. You can turn both providers off below. Outside Armenia, or when the location cannot be determined, Meta stays off until you allow it here; an earlier Google-only permission does not enable Meta. A saved refusal always takes precedence. Non-secret purchase references are stored in the browser to prevent duplicate counts. Entries older than seven days are removed when the next purchase is measured.

Meta Privacy Policy

Google Privacy Policy

How long it is kept

Contact and order data are kept to the extent and for the period necessary to fulfil the order, resolve claims and meet statutory recordkeeping duties. Identifiable participant data is used to run the competition, provide results and resolve corrections. Afterwards, only data needed for a specific lawful purpose is retained. Competition history alone does not justify indefinite retention. Use of contact details for optional news stops after that consent is withdrawn.

You may request erasure of data held by the foundation at any time by writing to info@risefoundation.am. We verify your identity where needed and handle requests within the deadlines required by Armenian law. Where withdrawal of consent requires erasure and no other lawful basis applies, we stop processing and destroy the data within ten working days following receipt of the withdrawal, and notify you within three working days after destruction. Shorter statutory deadlines apply where required. Data already uploaded to ViLLe or used in BeLLE research is also covered by those services' own notices, and scientific-research rules may limit erasure; we coordinate requests with those services according to the applicable roles and agreements.

Records required by accounting and tax law — fiscal receipts and sales data — are kept for the period the law sets and cannot be erased before it expires. After an erasure request they are no longer used for any other purpose, including sending information messages.

If you have asked to be told about next year's competition, your email address and, if you gave one, your phone number are kept only in order to send that one notification, for at most 18 months, after which they are deleted automatically. You can be removed from the list at any time, using the link in our message or by writing to info@risefoundation.am. This list is not used for anything else and is not shared with anyone.

Access through order links

An order link is private: anyone holding it can view the order details. New and reissued links normally allow access for 365 days. A link may be revoked sooner for security. Expiry does not delete the order or change payment status or your rights. Contact info@risefoundation.am for a new link; we will first verify the original buyer's identity and ownership of the order.

Your rights

You may ask what personal data we hold about you, why and how we use it, where it came from, who receives it and how long we keep it. You may request access and correction, and blocking or erasure under applicable law where data is inaccurate, outdated, unlawfully obtained or no longer needed for its stated purpose.

Where processing relies on your consent, you may withdraw it. We may need to verify your identity or the authority of a representative acting for you. To make a data-rights request, write to: info@risefoundation.am

If you believe the processing of your personal data infringes your rights, you may complain to Armenia's Personal Data Protection Agency or seek protection through the courts.

Contact

For questions about personal data, write to us at: info@risefoundation.am