← Back to home

Data Processing Terms

Updated:

This document constitutes an agreement between the data controller and the data processor. It clearly defines the rules for processing the personal data of your website users when using our services.

1. Parties and document status

These terms constitute an integral part of the terms of service and enter into force immediately upon order confirmation.

  • You, as the client, are the data controller;
  • We, Individual Entrepreneur [Name Surname] ([identification number], address: [Registered address], Tbilisi, Georgia, email: info@brandsite.ge, phone: [+995 ტელეფონი]), are the processor who processes data solely on your instructions;
  • In matters of personal data, this document prevails over the terms of service.

2. Subject, purpose and nature of processing

We process data solely for the purpose of providing you with the agreed services.

  • The purpose of processing is hosting your website, providing the admin panel, operating forms, bookings, orders and the game leaderboard, creating backups and technical support;
  • The nature of processing includes data storage, hosting, transfer to you and deletion;
  • The duration of processing covers the validity period of the contract and Site care, as well as the 30 days following its termination.

3. Categories of data and subjects

Only the data collected by your website is stored on our servers.

  • The categories of data subjects are the visitors and users of your website, as well as your employees and other persons added to the admin panel;
  • The categories of data include contact information, booking or order details, messages, game nickname and scores, as well as technical logs;
  • Processing of special category data is permitted only with prior written agreement and upon your provision of an appropriate legal basis.

4. Your obligations as a controller

According to the Law of Georgia on Personal Data Protection, you are responsible for the lawfulness of data processing.

  • You are obliged to ensure a lawful basis for data processing;
  • You must have your own privacy policy on your website and ensure subjects are informed;
  • You are responsible for the lawfulness of processing the data of persons added to the admin panel, including your employees, informing them and obtaining an appropriate basis;
  • The instructions given by you must comply with the legislation.

5. Our obligations as a processor

We comply with the requirements established by law and act only on your instructions.

  • We process data only on your documented instructions, which are considered to be the contract and your written instructions;
  • We will notify you immediately if we consider that your instruction contradicts the law;
  • We and our subcontractors assume a strict obligation of confidentiality and take the security measures provided for in Article 27 of the law;
  • We maintain records of processing and will provide you with relevant information to confirm our compliance;
  • We will assist you in carrying out a data protection impact assessment, in accordance with Article 31 of the Law of Georgia on Personal Data Protection.

6. Subprocessors and cross-border transfer

To provide the services, we use reliable technology partners.

  • By accepting these terms, you give prior written consent to the following providers: Vercel for hosting, Cloudflare for the domain name system and protection, as well as their subproviders;
  • We will send you a notification 14 days before adding a new provider, to which you have the right to object, which is a ground for termination of the contract;
  • Subprocessors are subject to the same obligations as us;
  • Cross-border data transfer is carried out in accordance with the law, with appropriate safeguards, to countries such as the Member States of the European Union, the United States of America and others, depending on the provider's infrastructure.

7. Incidents and subject requests

In the event of a data security breach or a user request, we act quickly and in a coordinated manner.

  • Upon discovering an incident, we will notify you immediately and no later than 24 hours, so that you can inform the State Audit Office of Georgia within 72 hours;
  • The incident notification will contain information about what happened, which data the breach concerns, what the likely consequence is, what measures we took and who the contact person is;
  • If a data subject contacts us directly, we will forward their request to you within 3 working days;
  • We will assist you in ensuring a response to the subject within the 10 working days established by law.

8. Termination of service and inspection

After the termination of cooperation, the data is securely destroyed or returned to you.

  • Upon termination of Site care, at your request, we will provide you with a copy of the site and data within 30 days, after which the data will be deleted, unless the law requires its retention;
  • Upon request, we will provide you with confirmation of deletion;
  • You have the right, with reasonable prior notice, to inspect our compliance once a year through the provision of documents.

9. Limitation of liability

Our liability is determined by legislation and this agreement.

  • The limitations of liability provided for in the main terms of service apply to matters related to data processing;
  • These limitations apply to the extent that they do not contradict the mandatory norms of the law, which prevail over any contractual provision.