PRIVACY POLICY

01WHO IS RESPONSIBLE

The operator responsible for personal-data processing will be identified in the company details below. Those details are being finalized. The website stores the personal information that visitors submit; these records are not automatically removed when the site is updated.

02INFORMATION WE PROCESS

Required order fields are marked in checkout; without the necessary contact and fulfillment details we cannot process an order. You can create an account with email and password, or use optional Google sign-in when available. Registration is optional for guest checkout. Order notes and location permission are optional.

• Account details: name, email, a password hash for email/password sign-in, account identifiers and sign-in/session information. Optional Google sign-in also uses a stable Google account identifier.
• Order and profile details: phone and verification status, address, apartment details, notes, products, quantities, prices, selected branch, fulfillment and order history. Past orders retain the contact details used for that order.
• Loyalty and activity information: coin earnings/reversals, timestamps and basic website events such as page views, cart additions and order submission. Security controls use pseudonymous identifiers derived from IP addresses and other account-related values.

03PURPOSES AND LEGAL GROUNDS

Data needed to take steps at your request, manage an account and fulfill a real order is processed for those contractual purposes. Applicable legal obligations may require transaction records. Proportionate security and service measurement require an appropriate legal basis and safeguards; consent is used where the law requires it. Before launch, the operator must confirm the legal basis for each processing activity.

Accepting ordering terms is not blanket consent to advertising. The website sends no marketing messages. Any future direct marketing must have the consent and easy opt-out required by law. Do not place health or other sensitive information in order notes unless a necessary and lawful process has been agreed.

04COOKIES, PREFERENCES AND LOCATION

The site uses a security/session cookie for anonymous and signed-in sessions. Anonymous sessions last up to two hours; the signed-in cookie lasts up to seven days, with session expiry after 24 hours of inactivity. Browser storage remembers the bag, language and sound preference; bundle guest counts use session storage. You can clear these through your browser, which may sign you out or reset your bag.

Nearest-branch suggestions use browser location permission. Coordinates are used only in your browser to suggest a branch; this feature does not send them to our server or save them in persistent storage. Only the selected branch is stored with the order. You can select a branch manually or revoke location permission.

05ACCESS AND SERVICE PROVIDERS

The website uses hosting in Georgia. Authorized website administrators can access stored data for support and operation. Hosting and technical service providers may process information as necessary for their service; their roles, access and any international transfers must be documented before online ordering launches.

The order dashboard and analytics require administrator sign-in. Access should be limited to staff who need the information for order handling, support and operation.

No payment provider or SMS service is connected yet. External map and social-media links open another provider’s service, whose privacy terms apply there. New couriers, payment or SMS providers must be identified and covered by appropriate arrangements before they receive data.

If you choose Google sign-in, Google sends us your name, email address and a stable Google account identifier to create or access your account. We do not receive your Google password or access your Gmail messages. When Google sign-in is available, displaying the account or sign-in area loads Google’s sign-in script and connects your browser to Google, before you click the button. Google handles its sign-in service under the Google Privacy Policy linked below.

06RETENTION AND SECURITY

Passwords are stored as hashes and sessions use protected cookies. These measures reduce risk but do not guarantee absolute security. Accounts, orders and loyalty records currently have no automatic deletion schedule. Retention periods for these records, analytics, hosting logs and backups must be finalized before launch according to their purpose and legal requirements.

07YOUR CHOICES AND RIGHTS

Subject to applicable law, you may request information and access, correction, deletion, restriction or cessation of processing, and a portable copy where that right applies. You may withdraw consent for consent-based processing without affecting the lawfulness of earlier processing. Some records may need to be retained to meet legal obligations or defend claims.

Contact the operator through the completed company details, or use the branch contact while this draft is being finalized. We may need proportionate identity verification before releasing or changing data. Complaints about personal-data processing may be submitted to the State Audit Office of Georgia or a competent court.

08UPDATES TO THIS NOTICE

The date at the top identifies this draft. Before real orders, payments, SMS or new data uses are enabled, this notice must be updated with accurate operator details, recipients, purposes and retention arrangements. Significant changes will be communicated appropriately.