Privacy Policy

VELU.ge — Privacy Policy

Data Controller: LLC Digimart
Identification Number: 406551574
Website: https://velu.ge
Contact Email: info@velu.ge
Effective Date: Date of publication

1. General Information and Data Controller

1.1. This Privacy Policy (“Policy”) explains how LLC Digimart (the “Company”) collects, uses, stores, protects, and, where necessary, discloses personal data in connection with VELU.ge.

1.2. The Company acts as the data controller where it determines the purposes and means of processing personal data.

1.3. Personal data is processed in accordance with the Law of Georgia on Personal Data Protection and other applicable legislation.

1.4. This Policy applies to website visitors, registered users, paid members, and recipients of deliveries to the extent that their personal data is processed.

1.5. Questions about personal data processing may be sent to info@velu.ge.

1.6. This Policy shall be made accessible before or at the time personal data is collected.

2. Personal Data We Collect

2.1. Registration and authentication data:

• Mobile phone number;
• Registration and authentication timestamps;
• OTP verification results and necessary security records;
• Unique account identifier.

2.2. Profile and delivery data:

• Name and surname where required for an order;
• Delivery address;
• Contact telephone number;
• Other information necessary to complete delivery.

2.3. Membership and order data:

• Membership plan, price, and validity period;
• Renewal and cancellation history;
• Automatic renewal preferences;
• Purchased products, quantities, and prices;
• Order, delivery, return, and refund statuses;
• Promotion participation and reservation records;
• Promotional code and referral benefit records.

2.4. Payment information:

• Payment amounts and statuses;
• Transaction identifiers;
• Payment timestamps and payment channels;
• Refund and cancellation transaction information.

2.5. Full payment card numbers and card security codes (CVV/CVC) shall not be stored in VELU.ge's own database. Card payment details are handled within the relevant payment provider's secure environment.

2.6. Technical and security information:

• IP addresses;
• Necessary browser and device information;
• Authentication session information;
• Request and error logs;
• Records relating to security incidents.

2.7. Communications data: Customer inquiries, complaints, requests, consent records, and records of necessary service messages.

2.8. The Company does not require dates of birth for standard registration. Information relating to age or parental consent may be processed only when needed and supported by an appropriate legal basis.

2.9. The Company does not ordinarily require special categories of personal data for registration. If such processing becomes necessary, additional statutory safeguards shall apply.

3. Purposes of Data Processing

3.1. Personal data is processed for the following purposes:

a) User registration and SMS authentication;
b) Account and membership administration;
c) Payment processing and verification;
d) Order placement, fulfillment, and delivery;
e) Managing reservations and special promotions;
f) Enforcing purchase limits and promotion rules;
g) Customer support and complaint handling;
h) Meeting warranty, refund, accounting, and tax obligations;
i) Account and Platform security;
j) Preventing fraud and unauthorized access;
k) Direct marketing where the user has provided appropriate consent.

3.2. A user profile may display membership validity, order history, saved addresses, reservations, and other service-related information.

3.3. At launch, the Company does not use browsing history to build personalized advertising profiles.

3.4. Personal data shall be used for new purposes only where a valid legal basis exists and, where required, the user has been informed or has provided consent.

4. Legal Bases for Processing

4.1. The Company processes personal data on one or more appropriate legal grounds, including:

• Necessity for entering into or performing a contract;
• Compliance with a legal obligation;
• An important legitimate interest of the Company or a third party, subject to the applicable balancing and other legal requirements;
• The user's freely given and clearly expressed consent;
• Another lawful ground expressly provided under Georgian legislation.

4.2. If the user does not provide information required for registration, membership, payment, or order fulfillment, the relevant service may not be available.

4.3. Consent to advertising is not a condition of registration or access to ordinary services.

4.4. Where processing relies on consent, users may withdraw that consent as provided by law.

4.5. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

5. Personal Data of Minors

5.1. Minors may use the Platform with the necessary consent of a parent or legal representative and in accordance with Georgian law.

5.2. Date of birth is not requested as a mandatory part of standard registration.

5.3. Where parental or legal representative consent is required by law, the Company takes reasonable and appropriate measures to verify that such consent exists.

5.4. The Company may request additional information to verify consent or legal representation where justified and legally permissible.

5.5. Where the necessary consent is absent or cannot be adequately verified, the Company may suspend the relevant processing or restrict services on lawful grounds.

5.6. Processing involving minors shall take account of their best interests and the additional protections applicable under Georgian law.

6. Advertising SMS and Possible Future Marketing Emails

6.1. The Company may send necessary service-related SMS messages, including:

• One-time authentication passwords;
• Payment and membership status notifications;
• Order, reservation, and delivery updates;
• Security notifications;
• Reminders concerning membership renewal.

6.2. Operational messages required to provide services are distinguished from direct marketing messages.

6.3. Advertising SMS messages are sent only on the basis of valid consent obtained in accordance with applicable law.

6.4. Accepting the Terms and Conditions or this Privacy Policy does not, by itself, constitute separate consent to direct marketing.

6.5. Marketing consent may be obtained through a dedicated option during registration or in the user's profile, requiring a clear affirmative choice.

6.6. Users may withdraw marketing consent through their profiles or another available channel.

6.7. Withdrawing consent shall be free, straightforward, and accessible. Direct marketing shall cease within a reasonable time and no later than seven business days, as required by Georgian law.

6.8. The Company records the fact and timing of granting and withdrawing consent and retains the relevant evidence for the legally prescribed period.

6.9. At the Platform's launch, marketing emails are not used.

6.10. Should marketing emails be introduced, they shall be sent only to users whose valid consent expressly covers that communication channel.

6.11. Opting out of advertising does not prevent the Company from sending necessary operational messages where there is a lawful basis to do so.

7. Cookies and Technical Data

7.1. VELU.ge uses cookies and similar technologies necessary for its core operation.

7.2. Essential cookies may support:

• Authentication sessions;
• Account security;
• Shopping cart and checkout functions;
• Protection against unauthorized or malicious requests;
• Storage of essential technical preferences.

7.3. At launch, the Company does not plan to use Google Analytics, Meta Pixel, or similar advertising tracking systems.

7.4. If analytics or advertising technologies are introduced in the future, the Company shall assess the applicable legal requirements, obtain consent where necessary, and update its disclosures before the relevant processing begins.

7.5. Users may manage cookies through their browser settings; however, blocking essential cookies may affect Platform functionality.

7.6. Technical data is processed only to the extent necessary for legitimate service, security, and compliance purposes.

8. Recipients of Personal Data

8.1. The Company shares personal data with third parties only where necessary and legally permitted.

8.2. Recipients may include:

Bank of Georgia and relevant payment providers: For processing and verifying payments.

SMSOffice (smsoffice.ge): For sending authentication codes and other authorized SMS notifications.

Courier companies and delivery partners: For receiving the recipient's name, telephone number, address, and other strictly necessary delivery information.

Hosting and technical service providers: For necessary hosting, storage, maintenance, and security services.

Competent public authorities: Where disclosure is required under applicable law or a valid legal order.

8.3. Only information necessary for the relevant purpose shall be shared.

8.4. The Company does not sell users' personal data to third parties.

8.5. Where a third party processes personal data on the Company's behalf, appropriate contractual, confidentiality, and security safeguards shall be maintained.

8.6. Where third parties act as independent controllers, their own privacy notices may also apply.

9. International Data Transfers

9.1. The main VELU.ge VPS infrastructure is hosted in Georgia.

9.2. Hosting data in Georgia does not necessarily exclude cross-border access or transfers arising from the use of third-party services.

9.3. Personal data shall not be transferred to another country or an international organization without a valid legal basis and the safeguards required under Georgian law.

9.4. Where a service involves an international transfer, the Company shall assess the applicable requirements and provide information to users where required.

9.5. Applicable safeguards may include legally recognized transfer mechanisms, necessary authorizations, or other lawful grounds depending on the circumstances.

10. Data Retention

10.1. Personal data is retained only for as long as necessary to fulfill its processing purpose or comply with a legal obligation.

10.2. Retention periods or the criteria used to determine them depend on the data category and processing purpose.

10.3. Account and profile data is retained while the account remains active and thereafter only while an appropriate legal basis continues to apply.

10.4. Order, payment, and refund records are retained for periods necessary to meet tax, accounting, contractual, and other statutory obligations.

10.5. Warranty and complaint records are retained for the handling of relevant claims, performance of obligations, and legally justified defense of rights.

10.6. Security and technical logs are retained for periods reasonably necessary to detect, prevent, and investigate security incidents.

10.7. Direct marketing consent and withdrawal records are retained during direct marketing activities and for one year after they cease, in accordance with the applicable legal requirements.

10.8. When the retention period ends or the legal basis no longer applies, data is deleted, destroyed, or anonymized as appropriate, unless another lawful ground requires retention.

10.9. The Company periodically reviews whether continued retention remains necessary.

11. Data Security

11.1. The Company applies appropriate technical and organizational measures to protect personal data.

11.2. Measures may include:

• Secure communication channels;
• Restricted access permissions;
• Logging of administrative actions;
• Secure authentication mechanisms;
• Software and infrastructure updates;
• Protection of backup copies;
• Incident detection and response procedures.

11.3. Access is restricted to employees and service providers who require the data to perform their duties.

11.4. The Company takes reasonable measures to prevent unauthorized access, alteration, loss, destruction, and unlawful disclosure.

11.5. Where a personal data breach occurs, the Company shall comply with applicable incident response and notification obligations.

11.6. No technical system can guarantee absolute security, but the Company remains responsible for applying safeguards appropriate to the risks.

12. Rights of Data Subjects

12.1. Subject to applicable legal conditions, users have the right to:

• Receive information about the processing of their personal data;
• Access their personal data and obtain copies;
• Request correction or updating of inaccurate or incomplete information;
• Request cessation of processing, deletion, or destruction of data where legally applicable;
• Request blocking of data where statutory conditions are met;
• Withdraw consent;
• Exercise data portability rights where applicable;
• Challenge processing before a competent authority or court;
• Exercise any other rights provided by Georgian law.

12.2. Requests may be submitted to info@velu.ge.

12.3. The Company shall respond in accordance with statutory deadlines and procedures.

12.4. The Company may reasonably verify the requester's identity before fulfilling a request to prevent unauthorized disclosure.

12.5. Where a request is refused in whole or in part, the Company shall provide the information and reasons required by law.

13. Account Closure and Data Deletion

13.1. Users may request closure of their accounts and deletion of relevant personal data.

13.2. Following a request, the Company may promptly block account access where this is consistent with the request and applicable law.

13.3. Account blocking does not necessarily require immediate deletion of all records.

13.4. Data may be retained where necessary for:

• Pending orders;
• Refunds and warranty obligations;
• Tax and accounting compliance;
• Handling legally justified claims;
• Other mandatory legal obligations.

13.5. Data without a remaining lawful basis shall be deleted or destroyed in accordance with the law.

13.6. Data shall not be retained solely because it might prove useful at an unspecified point in the future.

13.7. Users may request information concerning the handling of their closure or deletion request.

14. Policy Changes and Contact Information

14.1. The Company may update this Policy to reflect changes in law, technology, processing activities, or services.

14.2. Updated versions shall be published on VELU.ge with the effective date.

14.3. Material changes affecting processing purposes, legal bases, recipients, or other significant circumstances shall be communicated as required by law, and new consent shall be obtained where necessary.

14.4. Publication of an updated Policy or continued website use does not itself constitute valid consent to additional processing where separate consent is legally required.

14.5. For privacy-related inquiries, please contact:

LLC Digimart
Identification Number: 406551574
Email: info@velu.ge
Website: https://velu.ge

14.6. Users may seek protection of their rights through the competent Georgian authority or the courts.

End of Document