Privacy Policy

1. Who we are and who this policy applies to

The data controller is Individual Entrepreneur [Name Surname], identification number: [identification number], legal address: [Registered address], Tbilisi, Georgia.

We do not have an appointed personal data protection officer. If you have any questions, you can contact us by email at info@brandsite.ge or by phone at [+995 ტელეფონი].

This policy applies to visitors of the brandsite.ge website, potential and existing clients, as well as third-party data provided by the client. Regarding the data of the users of the client's websites, we are an authorized person, which is regulated by a separate document called Data Processing Terms.

2. What we collect, for what purpose, and on what legal basis

We process your data on the grounds provided by Article 5 of the Law of Georgia on Personal Data Protection. Communication mainly takes place via the WhatsApp application. Correspondence and shared files are stored in the WhatsApp system, on our device, and, if necessary, in our email or file storage.

If the client transfers to us the data of other persons, for example, employees, admin panel users, or people depicted in photos, the client is responsible for having the appropriate legal basis or consent. We provide information to these persons in accordance with Article 25 of the law, by publicly posting this policy and through the client.

• The client's name, phone number, email, messenger account, business name, and details are processed for the purpose of communication, order placement, and execution, based on the performance of a contract or pre-contractual steps. Providing this data is mandatory, otherwise we cannot conclude a contract;
• Material provided for the site, such as texts, photos, logos, prices, and menus, is processed for the purpose of website design and development, based on the performance of a contract. Providing data is mandatory, without which we cannot create the website for you;
• Payment confirmation information is processed for settlement and accounting purposes, based on legal obligation and the performance of a contract. Provision is mandatory, and in case of refusal, we cannot provide you with the service. We do not store bank card data;
• The admin panel account, including email, encrypted password, and login log, is processed for site management and security purposes, based on the performance of a contract and legitimate interest. Provision is mandatory, otherwise you will not get access to the admin panel.

Our legitimate interest involves protecting system security and managing potential disputes. We may also use your website in our portfolio, on social networks, and on the brandsite.ge website based on legitimate interest. You have the right to opt out of portfolio placement at any time, after which we will remove it within 7 days.

3. What happens on the brandsite.ge website

Our website does not set cookies, nor does it use browser local storage, analytics, advertising, or tracking systems. Fonts are hosted directly on our server. There are no forms on the website, and contact is made via a WhatsApp link that opens a pre-filled message. Your choices remain only in the browser memory until the page is closed and are not sent to us until you send the message yourself. The WhatsApp application is managed by Meta with its own policy.

Only server technical logs, such as IP address, browser type, and time, are collected about visitors. This is necessary for security and troubleshooting.

Real websites of our clients are embedded on the main page for demonstration. Changes made by the visitor in the demo panel happen only in their browser and are not stored anywhere. Embedded sites may store their own technical data or load third-party services, for example Google Maps, with their own policies. When navigating to the games page, the policy of the myboba.ge website applies.

4. Who we share data with and cross-border transfer

We do not sell your personal data. Data may be transferred to our partners: Vercel for hosting, Cloudflare for domain and network, email provider, domain registrar, bank, and accountant, or to the tax authority as prescribed by law.

Vercel and Cloudflare servers may be located in the European Union, the United States of America, and other countries. Cross-border transfer takes place with the grounds and guarantees established by Article 37 and Article 38 of the Law of Georgia on Personal Data Protection, and providers protect data through contractual obligations.

5. Data retention periods

We retain data only for the period necessary to achieve the purpose.

• Correspondence without an order is retained for 12 months from the last contact;
• Contract and payment documents are retained for the period established by tax and accounting legislation;
• Site material is retained during the validity period of the contract and Site care, plus 30 days for transferring a copy, after which it is deleted, except for backup copies, which are deleted in a maximum of 90 days;
• The admin panel account is retained until the end of the service;
• Server technical logs are retained for a short period determined by the provider;
• Marketing consent records are retained during the marketing period and for an additional 1 year.

6. Security and incident response

We use modern security measures, including HTTPS connection, encrypted passwords, access restriction, and backup copies. In the event of an incident, we will notify the State Audit Office of Georgia no later than 72 hours. If the incident creates a high risk to your rights, we will notify you immediately as well.

7. Your rights and appeal

According to the Law of Georgia on Personal Data Protection, you have the rights listed below. To exercise these rights, you can contact us in writing, at our email, or WhatsApp number.

• To receive information about data processing in accordance with Article 13;
• To access data and receive a copy under Article 14;
• To request correction, update, or completion of data under Article 15;
• To request termination of processing, deletion, or destruction under Article 16;
• To request data blocking under Article 17, on which we will make a decision within 3 working days;
• To request data portability under Article 18;
• To opt out of decision-making by automated means in accordance with Article 19;
• To withdraw consent under Article 20, after which processing will stop within 10 working days;
• To appeal data processing in accordance with Article 22.

Exercising your rights is free of charge. We will respond to your request within 10 working days, which in special cases may be extended by an additional 10 working days, with justification and your immediate notification. Identity verification is required upon request. In case of violation of your rights, you can apply to the State Audit Office of Georgia or the court.

8. Direct marketing and minors

We send you marketing messages only with your prior consent. You can request the termination of marketing at any time through the same channel, which we will fulfill within 7 working days of the request in accordance with Article 12 of the law.

Our services are intended for businesses and adults. We do not knowingly collect data of persons under 16 years of age. If we discover that such data has been collected, we will delete it immediately.

9. Changes

In case of changes to this policy, the updated version will be published on this same website. We will notify active clients in advance in writing about material changes.