RB
✦ Legal

User Agreement

The agreement you accept when you register in the RomBa app, as a customer or as a courier, and the consents that go with it.

The same text as in the RomBa app.

Applicable edition: v1.0 — priority of the EU legal framework

1. Definitions

Service / Application — the "RomBa" mobile application, which provides infrastructure for purchases in airport duty free zones with the physical transfer of goods through a traveller-intermediary.

Operator — the legal entity operating the Service (hereinafter referred to as the "Operator", "we", "us"). The exact particulars of the Operator are set out in the "About the app" section and in the privacy policy.

Principal / Customer — the User who places an order through the Application and pays for the acquisition by the Agent of goods in the duty free zone for subsequent transfer to the Customer.

Agent / Courier — the User who is physically present in the duty free zone of the departure airport, purchases the ordered goods and transfers them to the Customer at the arrival airport as a traveller-intermediary.

ECHO — an ultrasonic channel for transmitting cryptographic signatures between two devices in the same room (a patented proximity-attestation mechanism). Used to confirm the fact of the physical meeting of the Customer and the Agent.

Personal data — any information relating to an identified or identifiable natural person within the meaning of Article 4(1) of Regulation (EU) 2016/679 (GDPR).

2. How the service works

2.1. The Service constitutes infrastructure for the carriage of goods by travellers between airports. The Operator is not a seller of duty free goods, is not a carrier and does not provide customs clearance services.

2.2. Flow for the Customer:

  1. Registration: entry of passport data, biometric confirmation (facial recognition).
  2. Route selection: departure airport (where the courier will buy the goods) and arrival airport (to which they must be delivered).
  3. Formation of an order from the duty free catalogue of the departure airport; prices are shown in Armenian dram (AMD) with the equivalent in euros (see Section 8).
  4. Placing and paying for the order: the Customer accepts the Terms of Sale and confirms the order; the amount in AMD shown in the order summary is charged to the bank card when the order is confirmed, on the bank's secure payment page (see Section 8).
  5. Waiting: the request waits in the queue for a suitable Agent flying the selected route.
  6. Once an Agent has accepted the request, the Customer receives a push notification with the details of the Agent's flight and the expected time of arrival.
  7. Meeting at the arrival airport within 4 hours of the Agent's flight landing: both phones launch ECHO, an ultrasonic handshake is performed, and both parties sign an electronic transfer-and-acceptance act.
  8. After the contract is closed, the signed copy is stored in the "Profile → Contracts" section of both participants for the period established by Section 9.

2.3. Flow for the Agent:

  1. Registration (as for the Customer) + confirmation of boarding (boarding pass).
  2. Searching for orders: selecting the route of one's flight, viewing the queue of waiting requests.
  3. Accepting a request: lock-out for other Agents for 60 minutes; purchase of the goods in the duty free zone of the departure airport with a payment card funded by the Operator and provided in the Application for that order. Before that card is issued, an amount equal to the order amount is blocked (frozen) on the bank card the Agent has registered in the Application; the block is lifted once the handover is confirmed through ECHO (see 8.7). The Agent does not pay for the goods with their own funds.
  4. Photo-capture of the receipt and reconciliation of items via the "Ocular" module.
  5. Confirmation in the Application that the goods have been paid for with the card provided.
  6. Carriage of the goods in hand luggage to the arrival airport.
  7. Meeting with the Customer, transfer of the goods, confirmation via ECHO.
  8. Fee: the Agent's fee is credited in the Application and paid by bank transfer to the payout details the Agent has provided in the Application (see Section 8).

2.4. The Service does not guarantee the availability of Agents for a specific route, specific goods or specific dates. If no Agent is found within 72 hours, the request is automatically cancelled and the amount paid is refunded in full (section 7.2 of the Terms of Sale).

2.5. Terms of Sale. Each order is also governed by the Terms of Sale, which the Customer accepts before confirming the order and which are available in the "Profile → Legal information" section. The Terms of Sale govern sales (including prices, payment and delivery), cancellation, refunds and returns; on those points they prevail over this Agreement.

3. Right of use and age

3.1. Use of the Service is permitted to persons who have reached 18 years of age. Registration of persons under 18 is prohibited; the Operator is entitled to delete such accounts without warning.

3.2. The User confirms that they act in their own name and for their own purposes, and not for third parties without lawful grounds.

3.3. The Service must not be used for the commercial resale of the acquired goods — even if such resale would be lawful in the User's country. The Service is intended exclusively for the personal consumption of the Customer.

4. Obligations of the Customer

4.1. To provide accurate passport data. The Customer warrants that the person in the passport photograph matches the person undergoing biometric verification.

4.2. To comply with the customs limits of the country of arrival. The Service displays reference information about limits, but responsibility for the correctness of declaring goods when crossing the border rests with the Customer (as the person actually importing the goods into their own territory).

4.3. To pay for the order when placing it on the bank's secure payment page: the order amount is charged to the Customer's card when the order is confirmed (see clause 8.4).

4.4. To appear at the arrival airport at the agreed time for the physical transfer of the goods (the transfer takes place within 4 hours of the Agent's flight landing). If the Customer fails to appear without good reason, the order is deemed delivered and the amount paid is not refunded (section 5.4 of the Terms of Sale).

4.5. Not to use the Service to order goods prohibited from import into the country of arrival (narcotic substances, weapons, counterfeit goods, cultural property without permission, biological samples, etc.). The list of specific categories is available on the official customs resources (see appendix).

5. Obligations of the Agent

5.1. To comply with anti-terrorism rules and carriage-safety rules. The Agent undertakes:

  • Not to open factory packaging, seals or duty free boxes outside permitted areas and without the permission of authorised personnel.
  • Not to accept from third parties items not arranged through the Service for carriage as accompanying baggage.
  • Not to allow third parties to use their account or physical phone with an open Service session in the screening area.

5.2. The Agent is notified that a breach of the integrity of duty free packaging in a high-security zone, or concealment of the actual contents, may entail criminal liability under UK criminal law — in particular under the Terrorism Act 2000, the Misuse of Drugs Act 1971 (unlawful dealing in controlled substances), and the Customs and Excise Management Act 1979 (breach of customs rules).

5.3. To purchase exactly the items listed in the accepted order. Replacement of an unavailable item with an analogue is possible only with the express written consent of the Customer, expressed in the chat within the Service.

5.4. To transfer the goods personally to the Customer at the arrival airport within 4 hours of the flight landing. Transfer to third parties, other than the specified Customer, is prohibited.

5.5. To confirm the integrity of the packaging at the moment of transfer — the Customer has the right to open the packaging in the presence of the Agent in order to check serial numbers, expiry dates and the condition of the goods.

6. Passport, biometrics, identity verification

6.1. Purpose of collecting passport data: identification of the User to prevent fraud, to fulfil AML/KYC requirements, and for the correct issuance of documents on the transfer of goods.

6.2. What is collected:

  • The machine-readable zone (MRZ) of the passport (first name, surname, date of birth, document number, country of issue, expiry date).
  • A photograph of the photo page (on the device, not transmitted in clear form).
  • A biometric facial photograph for matching against the passport photograph.
  • Data from the NFC chip of the biometric passport (where applicable).

6.3. Where it is stored:

  • On the User's device: an encrypted representation of the passport data (for re-presentation during Agent onboarding).
  • On the Operator's servers (located in the Republic of Armenia): a cryptographic hash of the passport identity (SHA-256), with no possibility of reverse recovery of the source data. The photographs and MRZ themselves are not stored on the server for longer than the time required for a one-off verification.
  • On the device — the public part of the P-256 key of the Secure Enclave / StrongBox (registered on the server, linked to the device_id).

6.4. Biometrics — a special category of data within the meaning of Article 9 GDPR. Processing of biometrics takes place only locally on the device; only the result (match / no match) is transmitted to the server. Consent to the processing of biometric data is given via a separate button in the registration flow.

6.5. Retention period of the passport hash: until the moment the User deletes their account + 90 days (in order to resolve deferred financial disputes). Full deletion on request — via the "Delete account" button in the Profile or by letter to the DPO address (see clause 7.7).

7. Protection of personal data (GDPR-compliant)

7.1. Data controller: the Operator of the Service. Particulars — in the "About the app" section.

7.2. Legal basis for processing (Article 6 GDPR):

  • Performance of a contract (Article 6(1)(b)): processing to provide the service (placing an order, accompanying the flight, transfer of the goods).
  • Consent (Article 6(1)(a)): biometrics, marketing notifications.
  • Compliance with a legal obligation (Article 6(1)(c)): AML/KYC, tax reporting, responding to requests from competent authorities.
  • Legitimate interest (Article 6(1)(f)): fraud prevention, protection of the Service against abuse.

7.3. Categories of recipients:

  • The acquiring bank (Fast Bank) and the ArCa payment system (Republic of Armenia) — card payment processing and 3-D Secure authentication; the Customer enters card details directly on the bank's payment page, and they are not passed to the Operator.
  • Hosting and infrastructure providers — the Service's servers are located in the Republic of Armenia.
  • Certain service providers outside Armenia (for example, content delivery, AI-assisted features such as the boarding-pass check and support chat, and payment processing when the bank's payment page is unavailable) — may receive limited data, as described in the privacy policy.
  • The counterparty of the Customer / Agent within a specific transaction — receives only the public pseudonym, flight details and, from when the courier takes the order until the handover, the verified selfie that is that party's profile picture; the passport data of the other party is not disclosed.
  • Competent authorities — where there is a lawful request.

7.4. Location of servers and data transfers: the Service's servers are located in the Republic of Armenia. Card payment data is processed by the acquiring bank (Fast Bank) and the ArCa payment system in the Republic of Armenia (clause 7.3). Certain service providers outside Armenia (for example, content delivery, AI-assisted features such as the boarding-pass check and support chat, and payment processing when the bank's payment page is unavailable) may receive limited data, as described in the privacy policy.

7.5. Rights of the User: access to data (Article 15), rectification (16), erasure / "right to be forgotten" (17), restriction of processing (18), portability (20), objection (21), withdrawal of consent at any time (Article 7(3)). Requests — via the DPO.

7.6. Right to lodge a complaint with the supervisory authority of the country of residence — in the United Kingdom, the Information Commissioner's Office (ICO); in the EU, for example, the CNIL in France, the BfDI in Germany, the Garante in Italy, and so on.

7.7. DPO (Data Protection Officer) contact: [email protected] (address in the privacy policy).

7.8. Cookies / trackers: The Application does not use third-party analytics trackers. Only technical data necessary for operation is used (device_id, session tokens, connection status).

8. Payments

8.1. Payment method: the Customer pays by bank card (Visa, Mastercard, ArCa) in Armenian dram (AMD) on the secure payment page of the acquiring bank (Fast Bank), within the ArCa payment system.

8.2. The Operator does not see or store the full card number or the CVV code. Card details are entered directly on the bank's payment page; the Operator receives from the bank only the payment result and masked card details (for example, the masked card number).

8.3. 3-D Secure: every payment is authenticated with 3-D Secure, which may require confirmation via SMS, a bank push notification or device biometrics.

8.4. Moment of charge: the amount shown in the order summary is charged to the Customer's card in a single step when the order is confirmed. The payment page session lasts 20 minutes; if payment is not completed within that time, no charge is made.

8.5. Prices and currency: prices are shown in AMD with the equivalent in euros (EUR). Duty free prices set in euros or in the shop's local currency are converted into AMD at Fast Bank's non-cash euro selling rate. The amount charged is the amount in AMD shown in the order summary before confirmation. If the card's currency is not AMD, the conversion is made by the issuer of the Customer's card.

8.6. Service commission (the "service fee" in the Terms of Sale): 14% of the goods price, or a fixed fee of €50 (shown in AMD) when the goods total is below €500. The commission is included in the amount shown in the order summary and is recorded in the receipt.

8.7. Settlements with Agents: the Agent pays for the goods at the duty free counter with a payment card funded by the Operator and provided in the Application for the specific order; the Agent's own funds are not used, and the cost of the goods is not reimbursed to the Agent. As a guarantee, before the card for an order is issued, an amount equal to the order amount is blocked on the bank card the Agent has registered in the Application. The block is lifted once both parties have signed the electronic transfer-and-acceptance act via ECHO. If the Agent does not hand the goods over to the Customer, the blocked amount is debited and used to refund the Customer, except where the goods were seized or withheld by customs authorities (clause 9.5). The Agent is entitled only to their fee, which is part of the Service commission: 5% of the goods price (out of the 14%), or the corresponding share (5/14) of the fixed fee. The fee is credited to the Agent's balance in the Application and paid by bank transfer to the payout details the Agent provides in the Application ("Profile → Bank"); to receive payment, the Agent completes those details and confirms their contact information.

8.8. Cancellation, refunds and returns are governed by the Terms of Sale, which prevail on those points (clause 2.5). In particular:

  • once an order has been placed, the amount paid is not refunded, except in the cases listed in the Terms of Sale: a product is unavailable at the duty free shop (the price of that product is refunded); no Agent accepts the order within 72 hours (the whole order is refunded); the Agent does not hand the goods over (the whole order is refunded), except where the goods were seized or withheld by the customs authorities (clause 9.5); the product itself, not its packaging, is defective and this is reported to the call centre, with photographs of the product, before the handover is confirmed in the Application (the price of that product is refunded; once the handover is confirmed, no refund is possible);
  • an order cannot be cancelled in the Application; a cancellation request can only be made by phone to the call centre, and cancellation does not by itself give rise to a refund;
  • the goods cannot be returned or exchanged, and refusing the goods at the handover does not give rise to a refund;
  • refunds are made to the card used for payment, in AMD, and are initiated within 3 business days of the event that gives rise to them.

8.9. Chargeback: the Customer may dispute a payment through the issuer of their card within the time limits set by the card scheme rules. The Operator will provide the bank with all evidence of the transfer of the goods (the ultrasonic xlink_binding_hash, the signatures of both parties, the passport verifications).

9. Customs regime, limits and declaration

9.1. Duty free and duty-free import are governed by the law of the country of arrival (as a rule, the country of the Customer's permanent residence). The Service does not replace customs declaration and does not act as a customs representative.

9.2. The Customer confirms that they have familiarised themselves with the limits on the import of goods (alcohol, tobacco, perfumery, products of animal and plant origin, total value) into the country of arrival — for EU citizens see Directive 2007/74/EC + national acts.

9.3. Exceeding limits: where the established limits are exceeded, the Customer is obliged to declare the goods themselves at the red channel and pay duties / VAT. The Agent physically carries the goods as a traveller's accompanying baggage, but responsibility for declaration rests with the recipient.

9.4. Prohibited goods: see clause 4.5. If an attempt is made to order goods expressly prohibited from import into the country of arrival, the Service will block the operation automatically. However, the Customer bears responsibility for the correctness of their own request.

9.5. Confiscation of goods at the border: refunds in this case are governed by the Terms of Sale. If the goods are seized or withheld by the customs authorities, whether before or after the transfer, the amount paid (the cost of the goods and the Service commission) is not refunded (section 7.3 and section 9 of the Terms of Sale): that risk is borne by the Customer, who is responsible for complying with the customs limits (clause 4.2).

10. Anti-terrorism requirements and integrity of packaging

10.1. All Users of the Service are in a zone of heightened security control (airport, air carriage) and are obliged to comply with anti-terrorism security requirements — Regulation (EU) 300/2008 on civil aviation security, ICAO Annex 17, and the national acts of the country of departure / arrival.

10.2. The integrity of duty free packaging (factory film, seals, security tapes) must not be breached until the moment of transfer to the Customer. Any unauthorised opening qualifies as:

  • A breach of contract with a Party (the Agent — towards the Customer; the Customer — towards the Service);
  • A potential ground for the Operator to terminate the relationship;
  • Where the elements of an offence are present — a ground for criminal prosecution (in the United Kingdom, for example, terrorist-financing offences under the Terrorism Act 2000, ss. 15-18, and offences endangering the safety of aircraft or aerodromes under the Aviation Security Act 1982).

10.3. Prohibition on concealing items: The Agent undertakes NOT to carry in accompanying baggage items not specified in the order. The Service bears no responsibility for the Agent's independent actions not provided for by the arranged mandate.

10.4. Discovery of prohibited items: if items not specified in the order are discovered during screening, such a circumstance is not covered by this Agreement, and the Operator bears no responsibility towards the authorised bodies.

11. Bailee status (Bailment) and transfer of ownership

11.1. From the moment the Agent physically purchases the goods on the Customer's mandate and until the moment of transfer at the arrival airport, the Agent acts as a bailee of the goods (under the English common law of bailment, the Agent holds the goods as bailee for reward; by way of an EU cross-reference, the continental-law analogue of safekeeping — Articles 1915-1919 of the French Civil Code (Code civil)).

11.2. Ownership of the goods passes to the Customer from the moment both parties sign the electronic transfer-and-acceptance act via ECHO (the xlink_binding_hash is registered on the server and both signatures have been received).

11.3. The risk of accidental loss of the goods during carriage rests with the Agent as bailee — save where the loss is caused by:

  • Actions of authorised bodies (confiscation);
  • Force majeure circumstances;
  • Gross breach by the Customer of the acceptance terms (a delay of more than 4 hours in appearing at the arrival airport).

11.4. Compensation for damage in the event of loss through the fault of the Agent — in the amount of the actual cost of the goods, confirmed by the receipt from the duty free zone.

12. ECHO — ultrasonic proximity attestation

12.1. ECHO — a patented mechanism for confirming the fact of the physical meeting of two Users in the same room. Technically implemented as an ultrasonic FSK handshake at frequencies of 16-20 kHz, with cryptographic binding of the nonces of both parties.

12.2. Legal significance: the xlink_binding_hash obtained as a result of a successful ECHO is recorded as evidence that both parties (the Customer and the Agent) were in the same room at the moment of signing the contract. This evidence is accepted by the Operator for the resolution of disputes and is provided to the acquiring bank in the event of a chargeback procedure.

12.3. Without a successful ECHO the contract is not deemed closed — even if both parties have pressed the "Sign" button. This is protection against remote fraud: an Agent who has not appeared before the Customer cannot sign the contract unilaterally.

12.4. Confidentiality: the ultrasonic ECHO channel transmits only cryptographic nonces (32 bytes of random data + a 4-byte preamble). The content does not identify the User and does not disclose passport data.

13. Limitation of liability

13.1. The Operator provides the Service "as is" (as-is) to the extent permitted by Articles 5 and 7 of Directive 2019/770/EU. Warranties of conformity with the description, safety and functionality apply only to the extent expressly stated in the Agreement.

13.2. The Operator bears no responsibility for:

  • The quality of goods purchased in duty free shops (this is the seller's responsibility);
  • The acts / omissions of the Agent not covered by the arranged mandate;
  • Changes in customs rules between the moment of the order and the moment of transfer;
  • Flight delays, flight cancellations, or other circumstances connected with the carrier;
  • Actions of the customs authorities, including the seizure of goods.

13.3. The aggregate liability of the Operator to a single User in respect of a single operation — no more than the amount of the Service commission for that operation. This limitation does not apply to cases of intent, gross negligence, or where such limitation is prohibited by applicable law (for example, breach of GDPR requirements). Clauses 13.2 and 13.3 do not limit the refunds due to the Customer under the Terms of Sale.

14. Changes, termination, dispute resolution

14.1. Changes to terms: The Operator is entitled to update the Agreement. The User is notified of material changes by push notification and through the Application interface; continued use after notification = acceptance of the new terms.

14.2. Termination: The User is entitled to terminate the Agreement at any time by deleting their account. This automatically ends all active sessions; obligations under orders already accepted remain in force until they are closed.

14.3. Applicable law: the law of the country of the Customer's permanent residence, within the consumer rights guaranteed by Directive 2011/83/EU.

14.4. Jurisdiction: disputes with consumer Users are heard in the court of the Customer's place of residence (for the EU — Article 18 of Regulation (EU) 1215/2012, Brussels Ibis). Disputes between the Agent and the Operator — in the court of the Operator's place of registration, unless otherwise provided by mandatory rules.

14.5. Alternative dispute resolution: consumer Users from the EU are entitled to apply through the European Commission's ODR (Online Dispute Resolution) platform — https://ec.europa.eu/consumers/odr/.

15. Final provisions

15.1. Language: The Agreement is provided in Armenian and in the other languages of the Application: Russian, English, French, German, Italian, Spanish and Portuguese. In the event of a discrepancy, the Armenian version prevails, unless the law of the User's country of residence requires otherwise.

15.2. Severability: the invalidity of an individual provision does not entail the invalidity of the Agreement as a whole.

15.3. Contact information: [email protected] (general support), [email protected] (personal-data questions).

15.4. Signature / acceptance: pressing the "I accept the terms" button in the registration flow is equated to confirmation of familiarisation with the full text of the Agreement in the scope of Sections 1-15 of this document.

Appendix. Official links for self-study

Below are official international and pan-European online resources with up-to-date legal texts and explanations. In the app, the same addresses open in an external browser when tapped. To check national rules, follow the EUR-Lex / EDPB / WCO links to the relevant country.

This document was generated automatically by the "RomBa" application. The text does not constitute individual legal advice. In disputes over interpretation, the law of the country of permanent residence of the Customer-consumer applies, within the limits guaranteed by Directive 2011/83/EU.