Privacy Standards

9.1 The data subject has all rights defined by the Law of Georgia on Personal Data Protection. The Company ensures the implementation of these rights in accordance with the procedures and timeframes established by law.
9.2 The data subject has the right to request information from the Company regarding the processing of their personal data. In such cases, the institution shall provide the following information no later than 10 (ten) calendar days from receipt of the request:
9.2.1 Which categories of data are being processed about them;
9.2.2 for what purpose the data is being processed;
9.2.3 on what legal basis the data is being processed;
9.2.4 how the personal data was collected;
9.2.5 whether the data has been transferred to a third party, to whom it was transferred, and the legal basis and purpose of such transfer.
9.3 The data subject has the right to access the personal data held about them by the data controller and to receive copies of such data free of charge, except in cases where access to the data or issuance of copies:
a) requires payment as provided by the legislation of Georgia;
b) requires a reasonable fee determined by the data controller due to the resources spent for issuing data in a form different from the form of storage and/or due to the frequency of requests.
The data subject has the right to access the data specified in this Article and/or obtain copies thereof no later than 10 working days after submitting the request, unless another timeframe is established by the legislation of Georgia.
In exceptional cases and with proper justification, the period may be extended by no more than 10 working days, of which the data subject must be notified immediately.
The data subject has the right to receive the data in the form in which it is stored by the data controller or the authorized processor. The data subject may also request that copies be provided in another format for a reasonable fee established by the data controller, if technically feasible.
9.4 The data subject has the right to request the data controller to correct, update, and/or complete inaccurate, incorrect, or incomplete data concerning them.
Within 10 working days (unless another period is established by the legislation of Georgia), the institution must correct, update, and/or complete the data or notify the data subject of the grounds for refusal and explain the procedure for appealing the refusal.
If the data controller independently discovers that the data held is incorrect, inaccurate, or incomplete, it must correct, update, or complete such data within a reasonable period and notify the data subject within 10 working days after the correction.
The obligation to notify the data subject does not arise if the correction relates only to the elimination of a technical error.
9.5 The data subject has the right to request the data controller to cease the processing of their data (including profiling), and to delete or destroy such data.
Within 10 working days from the request (unless otherwise established by the legislation of Georgia), the processing must be terminated and/or the data must be deleted or destroyed, or the data subject must be informed of the grounds for refusal and the procedure for appealing such refusal.
The data subject has the right to receive information regarding the termination, deletion, or destruction of data immediately after such action is taken, but no later than 10 working days.
If the data is processed in a publicly accessible form, the data subject may additionally request the restriction of accessibility and/or deletion of copies of the data or any internet links associated with such data.
9.6 The data subject has the right to request the blocking of data if one of the following circumstances exists:
a) the data subject disputes the authenticity or accuracy of the data;
b) the processing of data is unlawful, but the data subject opposes deletion and requests blocking instead;
c) the data is no longer necessary for processing purposes, but the data subject requires it for filing a complaint or claim;
d) the data subject has requested cessation, deletion, or destruction of the data and the request is under review;
e) there is a necessity to retain the data as evidence.
The data controller is obliged to block the data upon request of the data subject if any of the above circumstances exist, except where such blocking may endanger:
a) the performance of duties imposed on the data controller by law or subordinate normative acts;
b) the performance of tasks related to the public interest or powers granted by legislation;
c) the legitimate interests of the data controller or a third party, unless there is an overriding interest in protecting the rights of the data subject, particularly a minor.
The Personal Data Protection Service may decide to block the data until the review of the data subject’s application is completed.
Despite blocking, processing may continue if necessary to protect the vital interests of the data subject or a third party, or for state security and defence purposes.
The data must remain blocked for the duration of the reason for blocking, and where technically possible, the blocking decision must accompany the relevant data.
The data subject must be informed about the decision regarding blocking or refusal to block no later than 3 working days from the request.
9.7 In the case of automated processing, if technically possible, the data subject has the right to receive the data provided by them in a structured, commonly used, and machine-readable format or request the transfer of such data to another data controller.
9.8 Except for the processing of a data subject’s name, surname, address, telephone number, and email address, the processing of other data for direct marketing purposes requires the written consent of the data subject.
The data subject has the right to withdraw consent for processing for direct marketing purposes, in which case the processing must cease within a reasonable time, but no later than 7 working days from receipt of the request.
9.9 The data subject has the right to withdraw their consent at any time without providing justification. In such a case, the processing must be terminated and/or the processed data must be deleted or destroyed within 10 working days, unless another legal basis for processing exists.
Consent must be withdrawn in the same form in which it was given.
Before withdrawing consent, the data subject has the right to request and receive information regarding the possible consequences of withdrawal.
9.10 In the event of violation of rights provided by this law, the data subject has the right to apply to the Personal Data Protection Service, a court, or a superior administrative body in accordance with the procedure established by law.
The data subject may also request the Personal Data Protection Service to decide on data blocking until the application review process is completed.
Decisions of the Personal Data Protection Service may be appealed before a court in accordance with the conditions and timeframes established by Georgian legislation.