Personal Data Protection and Privacy policy

The Personal Data Protection and Privacy Policy (hereinafter "Policy") explains what data is collected about the user, as well as for what purpose the collected/processed data is used and to whom this data is provided.

This policy provides the user's rights related to personal data and specifies who the user should contact in case of questions or to obtain additional information.

The purpose of this policy is to provide the user with information about the principles of personal data processing and mechanisms of legal protection of personal data in a simple and understandable language.

This policy applies to all persons who use Kabrita services. When using the services of Kabrita, the electronic checking of consent by the user is equivalent to written consent and is proof that the user agrees to processing of the user's personal data by Kabrita in the form and for the purposes specified in this policy.

By entering shop.Kabrita.ge, the user agrees to this personal data protection and privacy policy. This policy may be updated periodically. The updated data will be published on shop.Kabrita.ge and the user may get acquainted with it at any time.

1. What is the personal data protection and privacy policy?

This personal data protection and privacy policy (hereinafter "Privacy Policy"/"Policy") explains how "PN Gten" LLC (hereinafter "We", "Kabrita" or "Company") collects, processes, uses, stores, shares and protects personal data of the user (hereinafter "You", "User" or "Data Subject").
This policy applies to all cases where the collection and processing of the user's personal data is carried out through websites, applications, mobile applications, computer programs, technical devices, Internet products, electronic platforms or systems, direct surveys (by telephone, online and other methods) means, within the scope of receiving e-commerce and/or other electronic services that are operated, owned and/or controlled by Kabrita and that refer to this document.

Personal data - any information related to an identified or identifiable individual. Individual is identifiable when it is possible to identify such individual directly or indirectly, in particular with a personal number, an identification number or a characteristic of a person with physical, physiological, psychological, economic, cultural or social factors.

Data processing - any action performed on data using automatic, semi-automatic or non-automatic means, namely collection, recording, photographing, audio recording, video recording, organization, storage, modification, restoration, retrieval, use or disclosure by way of data transmission, distribution or making available otherwise, grouping or combining, blocking, deleting or destroying. Kabrita protects the privacy of data about the user within the limits of this Agreement and the applicable legislation of Georgia.

2. Who is processing personal data?

A personal data processor is a person who, individually or jointly with others, determines the purposes and means of personal data processing, directly or through an authorized person carries out data processing. Processing of personal data provided by the user or obtained in any way defined by this Agreement is carried out by: "PN Gten" LLC, Yumasheva 11, Tbilisi, Georgia

3. What type of personal data and obtained from which sources is processed by Kabrita?

The type and volume of user's personal data that Kabrita collects and processes depends on the service that the user wants to receive or use.

Kabrita collects and processes such personal data without which the user will not be able to use services provided by Kabrita and their provision is mandatory. Kabrita also collects and processes personal data, which the user is not obliged to provide, but provides it voluntarily when using the service. When using Kabrita web pages, applications, mobile applications, computer programs, technical devices, Internet products, electronic platforms or systems, all the data that must be provided is clearly marked appropriately.

The following personal data of the user will be processed by Kabrita:

• Data provided by the user.
• Data that is automatically generated by the user when using the Kabrita service.
• Data obtained through other lawful sources.

Personal data provided by the user is collected when:

• Creating a user profile/account;
• Search for products and/or services on shop.Kabrita.ge;
• Adding or removing a product from the cart, placing an order;
• Downloading information, transmitting, viewing or using content through the service, program or application available on the device;
• Configuring settings, providing data access permissions or interacting with any Kabrita device or service;
• Using Kabrita.ge and/or Kabrita web-chats;
• Making and sharing comments and ratings;
• Adding a "wish list" to the user's account;
• Filling in survey answers;
• Submitting an application to participate in a contest, program, study, action or other event or participating in it;
• Communicating by telephone, e-mail or other means;
• Requesting additional information or asking a question about the product or service;
• Submitting an application, claim, complaint or other document by the user for protection of his/her rights/interests;

In the above cases, the personal data provided by the user that may be collected and/or processed by Kabrita includes the following:

• first name, last name;
• personal number;
• e-mail address;
• telephone number;
• age;
• gender;
• date of birth;
• residential address (country, city and other address details);
• participation in the loyalty program - loyalty card data;
• a copy of a person's identification document or its data;
• the first 6 and/or the last 4 digits of the bank card, the first name and last name of the card holder and the unique transaction code;

Data made known to Kabrita by the user through submission of ratings, remarks, comments or questions or communicating with us by means of any channel, medium, form or method;

The data that is automatically generated by the user when using the services of shop.Kabrita.ge and may be collected and processed by Kabrita include the following:

• detailed information about the products and services provided by Kabrita to the user;
• detailed information on payment transactions related to the purchase of Kabrita.ge services;
• information about the technical devices used by the user while using Kabrita.ge services;
• IP address and location data of the user's technical device, which may be obtained by the company through your mobile phone, computer browser and IP address or location of the object of the relevant operation;
• data used for authorization, e-mail address and encrypted version of the password;
• information about content interactions (e.g. information about content loading, streaming, viewing, etc.);
• information about the performance of the technical device (for example, information about the time of use of the device or application, connections, errors or faults);
• service indicators. e.g. data on the occurrence of technical errors or the user's interaction with Kabrita.ge service functions or content;
• user's time zone/zone settings data;
• device identifiers, cookies and other technical means on devices, applications and Kabrita websites, which are used to view, use and receive other technical information on websites; "Uniform Resource Locator" "URL" (addresses) of the website the user visited before entering the Kabrita website, "URL" of the website the user went to from the Kabrita website or application via a link or button, the type of browser, which the user uses and the user's Internet Protocol "IP" address. By granting appropriate access from Kabrita (e.g. advertising, marketing or other service providers and others), they have the ability to receive the data listed above through device identification technologies/trackers ("Cookies", "Web Beacons", "Pixel Tags" and other so-called "trackers").

Data that Kabrita may collect and process from other third parties/other sources includes the following:

• based on the user's consent, data received from other third parties;
• updated data on delivery and delivery addresses provided by the carrier/courier and which may be used to simplify the process of receiving the service or communicating with the user;
• Internet search results and links;
• data from publicly available sources;
• data received from third parties regarding the user's card included in their loyalty program and the points/benefits accrued on the card, only on the basis of the user's consent;
• data used to verify the identity of users (for example, in the presence of relevant legal grounds and purposes, request your personal data from LEPL Agency for the Development of State Services);
• data received from marketing or advertising service providers, under the conditions and within the limits permitted by law.

4. Purpose of data use and processing

Kabrita collects, processes and uses the user's personal data for the following purposes:

• Purchase and delivery of products and services - we use your personal data to receive orders, process and deliver products and services, to process and manage your payments, to check balance of points on the loyalty card and use the same in order to purchase shop.Kabrita.ge services through the points on such card associated with your account, as well as to resolve technical issues related to product/service delivery.
• Supporting the service system, correcting and improving service deficiencies - Kabrita uses the user's personal data to ensure the functioning of the system necessary for providing the service, to analyze the company's work process, to identify and correct errors and mistakes made in the work process, as well as to simplify the use of Kabrita's services and improve its efficiency, to produce Kabrita service usage statistics, to optimize service delivery processes, fields and design of shop.Kabrita.ge, to control the flow of users on the shop.Kabrita.ge website and to evaluate the effectiveness of marketing campaigns/promotions, to adapt shop.Kabrita.ge website and its components to the user's needs, as well as to determine (through the use of cookies and Google Analytics and other analytics tools) how users find shop.Kabrita.ge.
• Implementation of recommendations and offers - the company uses the user's personal data for the purpose of offering interesting and new products and services to the user, identifying personalized services/products relevant to the interests, and also for the purpose of creating and offering relevant promotions;
• Fulfillment of legal and contractual obligations - Kabrita uses and processes the user's personal data to fulfill the obligations imposed by law. e.g. in certain cases, in the presence of relevant legal grounds, provides such data to law enforcement and investigative agencies, administrative agencies, courts. Also, to those persons who are in a contractual relationship with Kabrita (e.g. persons providing payment services or courier services).
• Protection of rights and interests - to protect the rights and legal interests of Kabrita (for example, for the purpose of considering or resolving complaints, claims, statements of the user or a third party).
• Communication - in order to communicate with the customer on issues related to the services of shop.Kabrita.ge. e.g. e-mail, phone, web chat or other communication channel.
• Advertising and marketing - the user's personal data is used to display advertisements based on the user's interests and to offer products and services of interest to the user. Kabrita uses the user's personal data for direct marketing, including providing non-advertising messages, defining customer focus groups for new product or service offers, conducting research, marketing and statistical analysis based on the use of Kabrita products and services.
• Protection and prevention of data security - Kabrita uses the user's personal data for the purpose of detecting and preventing financial and other crimes or violations, in order to protect the safety, personal data and property rights of both the company and the user and third parties.

5. On what legal basis is personal data processed?

Processing of personal data by Kabrita is carried out on the following legal grounds:

• Data processing is necessary to receive Kabrita.ge services;
• Data processing is necessary to protect the legal interests of the company, the user or a third party;
• Data processing is necessary for the company to fulfill its obligations under the law;
• Based on the user's consent;

6. In what form and means is personal data processed?

Data processing means any action performed on data using automatic, semi-automatic or non-automatic means, in particular, collecting, recording, photographing, audio recording, video recording, organizing, storing, changing, restoring, retrieving, using or disclosing through transmission, distribution or otherwise making available of data, grouping or combining, blocking, erasing or destroying. We process your personal data using both automatic (using information technology) and semi-automatic (using information technology using non-automatic means) means.

7. How long is personal data kept?

The user's personal data is stored on the company's website from the moment of registration of the user's profile/account until the deletion of the user's personal data, which is carried out based on the user's request.

Taking into account the contractual and tax limitation periods related to property rights, after receiving the application for data deletion by the user, the deletion will be carried out only after the relevant tax, contractual limitation period has expired.

8. Personal data protection, data security?

The company takes all necessary organizational and technical security measures to avoid accidental or illegal destruction, alteration, disclosure, acquisition or any other form of illegal use and accidental or illegal loss of personal data.

The user's personal data is available on the website only if the user's password, e-mail address or phone number is specified.

Personal data is stored on a secure server, to which only the relevant company personnel and contractors responsible for technical support have access.

When purchasing products by the user, personal credit/bank card data is indicated. Information related to the user's bank card is not available to Kabrita, and the company does not store said data.

Kabrita is not responsible for the damage that may occur to the user due to lost or stolen data as a result of unauthorized access to the electronic device through which Kabrita services are received/accessed.

Any transmission of data over the Internet or wireless network is not absolutely or guaranteed to be secure. The Company takes commercially reasonable security measures to protect Customer Data.

The company is not responsible for the actions of third parties who may receive the user's personal or banking data without permission.

Information about the number, model, brand, name, version of the operating system and the version of the company's application of the technical device used by the user when using Kabrita products may be transferred for marketing purposes to other applications such as Google Analytics, Facebook Pixel and other applications in compliance with the requirements of the European General Data Protection

Regulation GDPR - (General Data Protection Guide).

9. Use of personal data for marketing purposes

The company processes personal data to determine the needs and interests of users, what services and offers are interesting to the customer.

Direct marketing involves offering a product or service to a customer through mail, telephone calls, e-mail, or other means of telecommunication. User name, address, telephone number, e-mail address may be collected for direct marketing purposes.

Data obtained from publicly available sources may also be processed for direct marketing purposes.

The user has the right at any time to request the company to stop using his personal data for direct marketing purposes, and Kabrita will ensure the termination of the processing of such user's personal data for direct marketing purposes, no later than 15 days after receiving the request. The user has the right to request the termination of the processing for direct marketing purposes in the same form in which direct marketing is carried out and/or to send a message to the following e-mail address: kabrita@kabrita.ge

10. Share personal data with third parties?

The company may share the user's personal data with another person in the following cases:

• The service/part of it is provided by third parties - the transfer of user's personal data to third parties is carried out if they cooperate with Kabrita and provide shipping, postal, courier, technical, advertising and marketing services. Also, to ensure the necessary payments for Kabrita service is made. Also to those persons with whom joint advertising campaigns, , contests or other events are carried out, on condition that data security and privacy protection guarantees will be fully protected/shared by such persons.
• The transfer of the user's personal data to third parties will be carried out only for the relevant purpose and only to the extent necessary for the fulfillment of their contractual obligations. Third parties cannot use the data provided by Kabrita for purposes other than those permitted for them, for which they are solely responsible.
• Reorganization of the enterprise and transfer of services - we may sell or transfer our enterprise or our rights and obligations in whole or in part to other persons, as well as carry out reorganization of the company, including transformation, division (separation and division) and/or merger. In these cases, we will share and transfer your personal data processed by the company to the company's legal successor or assignee.
• Fulfillment of legal and contractual obligations - Kabrita shares the user's personal data when it is necessary to fulfill the obligation imposed by law.
• Protection of rights and interests - the company may share the user's personal data with other third parties to protect the rights and legitimate interests of the company, the user or any third party.

11. What are cookies and for what purpose are cookies used?

“Cookies" are small text files that are placed and stored on browsers or devices through the use of websites, applications, online media and advertisements, and are used to collect information about the user and user conduct.

Kabrita uses cookies and identification technologies for the following purposes:

• Authorization of users on the website/application;
• Remembering user profile settings;
• Determination of content awareness;
• Conducting advertising promotions and evaluating their effectiveness;
• Website traffic evaluation;
• Evaluating the conduct of website users, analyzing and identifying their interests.

In this case, cookies do not directly identify the user, since they are aggregated, combined and anonymized data.

The company uses the following types of cookies:

• Authentication/authorization cookies;
• Priority/functional cookies;
• Analytical/statistical cookies;
• Commercial cookies;

These records help us to determine your online activity in order to provide you with an offer more relevant to you or to limit the number of times you see advertisements. The information obtained from this type of cookies may be transferred to any partner company, in order to display advertisements of interest to the user on other websites. The Company may process the "Uniform Resource Locator" "URL" (address) of the website to which the user entered before entering the Kabrita website, as well as the "URL" of the website that the user will visit after leaving the Kabrita website, the type of browser that the user uses and his Internet Protocol "IP" address.

Kabrita or a third party authorized by it, a person providing advertising, marketing or other technical services, can automatically receive the mentioned information when the user uses the Kabrita website, and this is done through such electronic mechanisms as cookies and other identification technologies.

By agreeing to this privacy policy, the user automatically agrees to the rules and policies for the use and processing of cookies, otherwise you will not be able to use Kabrita's services.

12. User Rights related to Personal Data Processing

The user has the following rights regarding the processing of his personal data:

• The right to receive information about processing of personal data, which includes the following information:
  -Whether your personal data is being processed;
  -Identity of the personal data processor or authorized person (if any);
  -Purpose of personal data processing;
  -Legal basis of personal data processing;
  -In what way personal data was collected;
  -To whom the personal data was transferred;
  -The basis and purpose of providing personal data.
• The right to review and receive copies of personal data (the data processor is entitled to set and demand the payment of appropriate fees for the transfer of copies);
• Right to correct, update and complete personal data;
• Right to terminate personal data processing;
• Right to delete personal data;
• Right to block personal data;
• Right to port (transfer) personal data;
• Right to refuse personal data profiling;
• Right to withdraw consent to personal data processing;
• Right to appeal/present a claim against the decisions made regarding personal data processing;
• Right to refuse personal data processing for direct marketing;

In the event that the company has reasonable suspicion that the information provided by the user is untrue, inaccurate, outdated or incomplete, the company has the right to contact the user in order to correct the data, and if this is impossible or delayed, to terminate/suspend the provision of Kabrita services.

Kabrita is authorized to depersonalize and store the user's personal data for analytical/statistical purposes.

13. Changes to this policy.

Kabrita is entitled to make changes to this privacy policy at any time, which will be notified to the user.

The user will be able to use Kabrita services only if agrees to the changes. The change will be posted on the main page of Kabrita website/app. When the Privacy Policy changes, its latest version will be immediately posted on Kabrita website.

14. Contact Information

If the user has any questions, requests or complaints regarding the privacy policy or the collection of personal data, the user can contact the company through the following communication channels: "PN Gten" LLC, Yumasheva 11, Tbilisi, Georgia, kabrita@Kabrita.ge.