Company: PROMFREE LLC, identification number in the Entrepreneurial Register of Georgia: 445849486, Georgia (hereinafter — the Company / the Operator).
This Policy is developed in accordance with the Law of Georgia “On Personal Data Protection” of June 14, 2023 (as amended and supplemented) and is an integral part of the Agreement for Specialists and Organizations (public offer).
1. General provisions
The Company processes the personal data of Service users in accordance with the principles of lawfulness, fairness, transparency, data minimization, storage limitation, integrity, and confidentiality.
The Policy applies to all users of the Service (Specialists, Clients, visitors of the website and the mobile application).
2. Categories of processed data
- Website visitors’ data: IP address, browser data, cookies, website usage data.
- Registered users’ data: full name, date of birth, contact details (phone, email), profile data, photos, videos, data on education, experience, specialization, bank details (for payouts), data on orders and deals.
- Specialists’ data: passport data (for verification), data on the taxpayer ID / tax status, team data (if applicable), data on reviews and rating.
- Clients’ data: order data, payment data, data on correspondence with Specialists, data on reviews.
3. Purposes of personal data processing
- Providing access to the Service and its functionality.
- Concluding and performing contracts between Specialists and Clients.
- Processing payments and settlements (via banking partners).
- Verifying users and preventing fraud.
- Improving the quality of the Service, analytics, and feature development.
- Sending notifications about the status of orders, promotions, and changes to the Service.
- Complying with the requirements of the legislation of Georgia (tax, anti-money-laundering, etc.).
- Protecting the rights and legitimate interests of the Company, users, and third parties.
4. Legal grounds for processing
Processing is carried out on the following grounds (in accordance with the Law of Georgia “On Personal Data Protection”):
- Consent of the data subject (upon registration, posting a profile, responding to an order).
- The need to perform a contract to which the data subject is a party.
- The legitimate interests of the Company (improving the Service, preventing fraud, protecting rights).
- Fulfilment of the Company’s legal obligations (tax legislation, requirements of the National Bank of Georgia, etc.).
5. Consent to processing and its withdrawal
Upon registration and use of the Service, the user gives informed, specific, freely expressed, and unambiguous consent to the processing of their personal data.
The user has the right to withdraw consent at any time by sending a notice through the personal account, by email, or by other means. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
6. Transfer of personal data to third parties
The Company may transfer personal data to:
- Banking and payment partners of Georgia — for processing payments and the «Secure Deal».
- Partners for verification and fraud prevention.
- Providers of hosting, cloud services, and technical support.
- State authorities — in cases provided for by the legislation of Georgia.
- Other users of the Service — to the extent necessary to fulfil orders (full name, contact details, profile data).
7. Cross-border data transfer
The Company carries out cross-border transfer of personal data only where necessary to provide the Service (for example, when using cloud services), subject to appropriate data protection safeguards in accordance with the Law of Georgia “On Personal Data Protection”.
8. Profiling and recommendation technologies
The Company may carry out profiling of users to match relevant orders, recommendations, and improve the Service. Profiling is carried out on the basis of the user’s consent or the Company’s legitimate interests, subject to a balancing test.
The user has the right to object to profiling and to receive information about the logic of automated decision-making. See the Rules on the Use of Recommendation Technologies for details.
9. Cookies and similar technologies
The Company uses cookies and similar technologies to ensure the operation of the Service, for analytics, and for personalization. The user can manage cookie settings in their browser. Mandatory cookies (necessary for the operation of the Service) do not require consent.
10. Retention period of personal data
Personal data is stored for the period necessary to achieve the purposes of processing, as well as in accordance with the requirements of the legislation of Georgia (including for accounting and tax records — no less than 6 years).
11. Measures to protect personal data
The Company takes technical and organizational measures to protect personal data from unauthorized access, alteration, disclosure, destruction, and other unlawful actions, including encryption, access control, regular audits, and staff training.
12. Breach notification (Data Breach)
In the event of a personal data security breach that may result in a high risk to the rights and freedoms of individuals, the Company notifies the data subjects and the supervisory authority (the Personal Data Protection Service of Georgia) within the timeframes established by the legislation of Georgia.
13. Data Protection Impact Assessment (DPIA)
The Company carries out a data protection impact assessment (DPIA) in cases where processing may pose a high risk to the rights and freedoms of individuals (in particular, in the case of large-scale profiling, processing of special categories of data, or systematic monitoring).
14. Data Protection Officer (DPO)
The Company has appointed a person responsible for personal data processing (Data Protection Officer). The DPO’s contact details are provided in the “Contacts” section on the Service and in this Policy.
15. Rights of personal data subjects
Personal data subjects have the right to:
- Obtain information on whether their personal data is being processed and access such data.
- Request the rectification of inaccurate data.
- Request the erasure of data (the “right to be forgotten”).
- Restrict the processing of data.
- Object to processing (including profiling).
- Receive data in a structured, machine-readable format (data portability).
- Withdraw consent to processing.
- Lodge a complaint with the supervisory authority (the Personal Data Protection Service of Georgia).
16. Final provisions
The Company reserves the right to make changes to this Policy. The new version takes effect from the moment it is published on the Service.
The user is obliged to regularly review the current version of the Policy.
This document is public information of PROMFREE LLC (identification number 445849486, Georgia). The Company may make changes; the current version is posted on the Service.
To all documents