Personal Data Processing Policy

1. General provisions

1.1. This Personal Data Processing Policy (the “Policy”) explains how Individual Entrepreneur Evgeniia Girinskaia, identification code 345871069, address: 23 Iusuf Paghava St, Batumi, Georgia (the “Controller”), processes and protects the personal data of clients and visitors of the website https://brightkind.ge (the “Website”).

1.2. The Policy has been prepared in accordance with the Law of Georgia “On Personal Data Protection” of 14 June 2023 (the “Law”) and fulfils the Controller’s duty to inform data subjects about the processing of their data.

1.3. The Policy applies to personal data the Controller receives through the Website, by phone, by email and via WhatsApp and Telegram, whether processed by automated means or not.

1.4. The terms on which a user gives consent when submitting the form on the Website are set out in a separate document, the Consent to Personal Data Processing (https://brightkind.ge/en/consent/).

2. Definitions

Terms are used as defined in Article 3 of the Law, in particular:

• personal data — any information relating to an identified or identifiable natural person;
• processing — any operation performed on personal data, such as collection, recording, storage, alteration, use, disclosure, blocking, erasure or destruction;
• Controller — the person who determines the purposes and means of processing; for this Policy, the Controller named in clause 1.1;
• processor (authorised person) — a person who processes data for and on behalf of the Controller;
• data subject — the natural person whose data are processed;
• consent — a freely given and unambiguous indication of the data subject’s agreement, expressed by an active action, to the processing of their data for specific purposes after receiving information about that processing.

3. Principles and legal grounds

3.1. The Controller processes personal data in line with the principles of Article 4 of the Law: lawfully, fairly and transparently; only for specified purposes; to the minimum extent necessary; keeping data accurate; no longer than necessary; and securely.

3.2. The legal grounds for processing (Article 5 of the Law) are:

• the data subject’s consent;
• the need to enter into a contract at the data subject’s request or to perform a concluded contract;
• the Controller’s obligations under the legislation of Georgia, including tax legislation;
• the Controller’s legitimate interest in protecting its rights, where this does not override the data subject’s rights and interests.

4. Purposes of processing

4.1. Handling requests and calculating prices: receiving requests through the “Request a proposal” form, by phone, by email and via messengers; clarifying the task; preparing and sending a commercial proposal; arranging a free on-site assessment.

4.2. Entering into and performing contracts: preparing the contract, agreeing on the cleaning time and access to the premises, providing services, signing the acceptance report, receiving payment, handling guarantee requests.

4.3. Complying with the legislation of Georgia, including accounting and tax requirements.

4.4. Protecting the Controller’s rights in the event of a dispute.

4.5. The Controller does not send advertising or newsletters. Such mailings are possible only with the data subject’s separate consent under Article 12 of the Law.

4.6. The Website does not use cookies or web analytics services. If they are introduced, the Controller will update this Policy in advance and will run analytics only after the visitor consents in a dedicated notice on the Website.

5. Data subjects and data processed

5.1. The Controller processes data of: contact persons of organisations who submit the form on the Website; private clients and their representatives who contact the Controller by phone, email or messenger; clients who have concluded a contract. The Controller accepts requests and concludes contracts only with persons aged 18 or over.

5.2. The “Request a proposal” form: company name; name; phone number; email address (optional); type of premises; area; desired cleaning frequency; comment; page language; date and time of submission. Information about the company and premises is not personal data in itself but is processed together with the user’s contact details.

5.3. Requests by phone, email and messenger: name; phone number or account name; email address; content of the correspondence; photos and videos of the premises; address of the premises.

5.4. Contracts: first name and surname; personal number or identity document details, if required to draw up the contract; address of the premises; contact details; payment information received from the bank (payer’s name, amount, date).

5.5. The Controller does not request or process special categories of data (health, religious or political beliefs, etc.). Please do not include such information in comments, and do not film people or documents in photos and videos of the premises.

5.6. When the Website is visited, the hosting provider automatically records the IP address, browser type and request time in server logs. These data are needed to operate and protect the Website; the Controller does not use them to identify anyone. The Website’s fonts are loaded from Google servers, so the visitor’s browser sends its IP address to Google. Only the selected Website language is saved in the browser.

6. How data are processed

6.1. Personal data are collected when a user fills in the form on the Website or contacts the Controller by phone, email or messenger.

6.2. Data are processed both by automated means and without them.

6.3. The Controller does not take decisions producing legal effects for the data subject based solely on automated processing.

6.4. The Controller does not sell personal data or share them for third-party advertising.

7. Disclosure and processors

7.1. Personal data may be processed by:

• Netlify, Inc. (USA) — Website hosting, receiving and storing requests submitted through the form;
• Google LLC (USA) — the Controller’s email (Gmail), which receives copies of form requests and is used for correspondence; loading the Website’s fonts;
• WhatsApp (Meta Platforms) and Telegram — if the user chooses this channel; such correspondence is also governed by the rules of those services;
• the Controller’s staff carrying out the order — to the extent needed for the cleaning (address, time, contact); they are bound by confidentiality;
• the Controller’s bank — when receiving payment.

7.2. Data are disclosed to other persons, including public authorities, only where expressly required by the legislation of Georgia.

7.3. Cross-border transfer. Netlify and Google servers are located in the USA and other countries whose legislation may not ensure a level of personal data protection equivalent to that of Georgia. Such transfer is based on the user’s written (electronic) consent given after being informed of the lack of equivalent data protection safeguards in these countries and of the possible risks (Article 37(2)(d) of the Law).

8. Retention periods

8.1. Data from requests and correspondence that did not lead to a contract are kept for no more than 1 (one) year from the last contact.

8.2. Data of clients who concluded a contract are kept for the term of the contract and 3 (three) years after its full performance. Accounting documents are kept for the period required by the tax legislation of Georgia.

8.3. Once the purpose is achieved, the retention period expires or consent is withdrawn, the Controller stops processing and erases or destroys the data within 10 (ten) working days, unless the law requires or permits otherwise.

9. Data protection

9.1. The Controller takes organisational and technical measures to protect data against accidental or unlawful access, alteration, disclosure, loss and destruction (Article 27 of the Law), including:

• only the Controller and staff have access to data, to the extent needed for their tasks;
• accounts where data are stored are protected by strong passwords and two-factor authentication;
• the Website uses the secure HTTPS protocol;
• the Controller’s staff undertake to keep data confidential;
• data are erased when the periods in section 8 expire.

9.2. In the event of an incident likely to cause significant harm, the Controller notifies the supervisory authority within 72 hours of detecting it, and notifies data subjects without undue delay.

10. Data subject rights

10.1. The data subject has the right to:

• receive information about the processing of their data and a copy of those data;
• request correction, updating or completion of inaccurate or incomplete data;
• request that processing stop and that the data be erased or destroyed;
• request blocking of the data;
• receive their data in a structured, machine-readable format or have them transmitted to another controller, where technically feasible;
• withdraw consent at any time without giving reasons, in the same way it was given or in any other convenient way;
• not be subject to decisions based solely on automated processing;
• lodge a complaint about the Controller’s actions with the supervisory authority of Georgia for personal data protection or with a court (Article 22 of the Law).

11. Requests

11.1. Requests concerning personal data processing are accepted by email at alina.filatova1982@gmail.com, by phone at +995 571 07 92 19 and via WhatsApp or Telegram on the same number. The person responsible for personal data processing is the Controller.

11.2. The Controller responds within 10 (ten) working days. If necessary, this period may be extended by no more than 10 working days, with the requester informed of the reasons. Requests are handled free of charge. A decision to block data, or a refusal to do so, is communicated within 3 working days.

11.3. To protect the data, the Controller may ask for confirmation that the request is made by the data subject or their representative.

12. Final provisions

12.1. The Controller may amend this Policy. The current version, with its date, is published at https://brightkind.ge/en/privacy/.

12.2. The Policy is published in Georgian, English, Russian and Turkish. In case of discrepancy, the Georgian version prevails.

12.3. The Policy and related relations are governed by the legislation of Georgia.