Since Georgia has implemented personal data protection legislation (the Law of Georgia on Personal Data Protection, dated July 3, 2023), to ensure the protection of human rights and freedoms, including privacy, during the processing of personal data, Nutrimax LTD (ID: 206330709, hereinafter referred to as the “Company”), has introduced a Personal Data Protection and Cookie Policy to safeguard the rights of users (hereinafter referred to as the “Data Subjects”) of its website, nutrimax.ge, which was created for the purpose of advertising and selling its products.
The Data Subject is required to review this policy and, if desired, confirm it by providing consent for the processing of their personal data by selecting the consent checkbox below. In accordance with Georgian legislation, this policy defines the procedures for processing and storing the personal data of Data Subjects.
This policy includes information that the Company obtains during the provision of services to the Data Subject, which may later be used for direct marketing purposes under Georgian legislation. The purpose of this notice is to inform Data Subjects about the principles of our work and the mechanisms for using personal information during processing.
The Company guarantees that it will:
- Ensure the confidentiality of the Data Subject’s personal data;
- Ensure the security and protection of the Data Subject’s personal data;
- Not use the Data Subject’s personal data unlawfully;
- Provide the Data Subject with full and comprehensive information regarding the processing of their personal data at any time.
1. Definitions
1.1. Personal Data – Any information related to an identified or identifiable individual. An individual is identifiable when it is possible to identify them directly or indirectly, particularly through an identification number or characteristics such as physical, physiological, psychological, economic, cultural, or social attributes.
1.2. Data Subject – Any natural person whose data is being processed.
1.3. Processing of Personal Data – Any action performed on data, including collection, retrieval, access, organization, categorization, correlation, storage, modification, restoration, extraction, use, blocking, deletion, or destruction, as well as disclosure of data through transmission, publication, dissemination, or other means.
1.4. Direct Marketing – The direct and immediate provision of information to the Data Subject via phone, mail, email, or other electronic means for the promotion of an individual or legal entity, goods, services, work, or initiatives, including the development, maintenance, realization, or support of brand image and social topics. Direct marketing does not include information provided by a state institution if such information delivery is compatible with the grounds for data processing outlined in Articles 5 and 6 of the Georgian Personal Data Protection Law.
1.5. Written Consent of the Data Subject – The voluntary consent expressed by the Data Subject for the processing of their data for a specified purpose after receiving the relevant information, provided through a signature or other equivalent written means (in this case, by selecting the consent checkbox below).
1.6. Data Controller – A natural or legal person, or a public institution, that individually or jointly determines the purposes and means of data processing and carries out data processing either directly or through an authorized person. For the purposes of this policy, the Company’s Marketing Department is the Data Controller.
2. Personal Data Processed via the Website
Under this policy and in relation to the operation of the website, the Company processes the following personal data of Data Subjects:
- Name and surname of the Data Subject
- Email address of the Data Subject
The Company collects this data directly from the Data Subjects.
3. Purpose and Legal Basis for Personal Data Processing
The personal data of Data Subjects is processed for the purpose of carrying out the Company’s marketing activities and ensuring the normal functioning of the website.
The basis for personal data processing is the consent of the Data Subject..
4. Rights of the Data Subject
In accordance with the Georgian Personal Data Protection Law, the Data Subject has the right to request information from the Company regarding the processing of their personal data. The Data Subject has the right to receive the following information:
- The data being processed, as well as the legal basis and purpose of the processing;
- The source of data collection/retrieval;
- The retention period of data or the criteria for determining the period;
- The rights of the Data Subject as defined by the Personal Data Protection Law;
- The legal basis and purposes of data transmission, as well as adequate safeguards for data protection if data is transferred to another country or an international organization;
- The identity of the recipient or categories of recipients of the data, including the basis and purpose of data transfer to third parties;
- The logic behind automated processing, including profiling, as well as the impact and potential consequences of such processing.
Additionally, the Data Subject has the right to:
- Access their personal data held by the Data Controller and request copies;
- Correct, update, or supplement inaccurate, incorrect, or incomplete data;
- Cease processing, delete, or destroy data;
- Block (temporarily suspend) the processing of data.
The Data Controller may continue processing personal data even if the Data Subject requests deletion/destruction, provided there is a legal basis for doing so.
The Data Subject can withdraw consent for the collection, processing, or transfer of their data at any time by providing written notice to the Company. In such a case, data processing will be terminated and/or deleted within 10 working days (or within 7 calendar days if the data is processed for direct marketing purposes), unless another legal basis for data processing applies under the Georgian Personal Data Protection Law.
5. Methods of Data Processing
Personal data is processed in accordance with Georgian legislation, and the Company’s Marketing Department is responsible for data processing (contact: info@nutrimax.ge, Tel: +995 32 2305335).
The Company may perform actions such as collection, systematization, storage, updating, modification, use, depersonalization, blocking, deletion, and destruction of personal data, in compliance with Georgian law.
The Company does not transfer personal data to third parties, including cross-border data transfers. Only the Company has access to the personal data of the Data Subject.
6. Cookies and Website Data Collection
The Company collects information on website visitors through cookies, including:
- IP address, device type, operating system, and browser details;
- Pages visited, session duration, and session parameters;
- User interactions with website elements;
- Time and method of filling out forms on the website.
Types of cookies used:
- Necessary cookies – Ensure basic website functionality, navigation, and security;
- Functional cookies – Store user preferences, such as consent to the Cookie Policy;
- Analytical cookies – Collect information about website usage and user behavior.
Users can delete cookies via browser settings. After deletion, the website will prompt users to re-accept the Cookie Policy.
7. Data Retention Period
The Company retains personal data for the duration of the website’s existence. If the website is discontinued, data processing will be terminated, and data will be deleted/destroyed.If a Data Subject requests deletion or revokes consent, the Company will comply unless legal grounds for data processing remain.
8. Policy Updates
The Company reserves the right to modify this Personal Data Protection and Cookie Policy at any time. Any changes will be published on the Company’s website and, where necessary, announced on the homepage. The Data Subject is responsible for periodically reviewing the policy.
9. Marketing
The Company may use the Data Subject’s personal data for marketing purposes, including product promotions and personalized offers. Data Subjects can opt out of direct marketing at any time.
By agreeing to this policy, the Data Subject consents to the processing of their personal data for the purposes outlined herein.
