Privacy Policy

Introduction

The Privacy Policy (hereinafter "Policy") ensures transparency in the processing of personal data (hereinafter "Data") by Aid Group LLC (hereinafter "Company", "Supta.ge" or "We") in accordance with and within the framework of Georgian legislation, for the purpose of providing you with products/services and entering into subsequent transactions.

Who We Are

Aid Group LLC (hereinafter "Company", "Supta.ge" or "We") is a legal entity registered in accordance with Georgian legislation, which acts as a data controller (person responsible for processing) when processing your data.

Identification Code: 405176973

Legal Address: Georgia, Tbilisi, Chugureti District, Tsinamdzghvrishvili Street, No. 162

Contact Information:

Email: info@supta.ge

Phone: +995 322 110 626 (calling is free)

Purpose of the Policy

Our goal is to inform you how the Company processes and uses your personal data. Accordingly, through this Privacy Policy, we provide you with information on the following issues:

• The principles by which the Company is guided in the process of processing your personal data;
• What kind of personal data the Company collects about you when you register as our customer and use the Company's product;
• How your data is processed by us and how the security, confidentiality, accessibility and integrity of your data is ensured;
• How the Company ensures the protection of your rights provided by law.

General Provisions

The Company processes your data in accordance with the Law of Georgia "On Personal Data Protection", for specific, clearly defined purposes and on the grounds defined by the same law. You can see these purposes and grounds in relation to a specific process below.

It is inadmissible for the Company to process your data for a purpose different from the predetermined purpose, unless it has an appropriate legal basis.

When processing your data, all principles of data processing defined by the Law of Georgia "On Personal Data Protection" are observed.

We do our utmost to protect your data and for this purpose we have implemented appropriate organizational and technical security measures.

The terms used in the Policy have the meaning defined by the Law of Georgia "On Personal Data Protection".

Data We Process

We process, including collect and store, personal data that you provide to us when filling in the fields intended for registration as our customer on the platform. Such data includes:

• Personal identification number;
• Email address;
• Mobile phone number.

* The specified data is necessary for your registration as a Supta.ge customer. Additionally, you are required to confirm your identity and the authenticity of the data through an authorization SMS code received at the mobile number you provided.

In addition to the personal data listed above, Supta.ge may process other personal data about you that is defined by Georgian legislation or/and is necessary for the provision of services. Such data may include:

Identification data - name, surname, address, information about your workplace if you register as a representative of a legal entity, and other information that you provide to the Company at the order fulfillment stage.

Financial and transactional data - information about your payments on the platform, bank account number, payment card information (last four digits of the card).

Technological data - information about the devices you use when using our products/platforms.

Location data - data related to your location, which the Company may obtain through your mobile phone, from your computer's internet connection address, or from the location of the object where you perform operations.

After selecting the desired product, the customer chooses a convenient payment method for settlement - payment by invoice or online payment system. In the case of online payment, the customer is redirected to the bank's settlement page, where they enter their card details and confirm the transfer. Supta.ge receives information only about the customer's settlement from the customer's provider bank. It is important to remember that such settlement is carried out in the secure space of the selected provider bank and Supta.ge does not process the data specified in the process.

Cookies

Supta.ge uses Cookie files. A Cookie is a small text file, so-called "ready-made records", which the website sends and is stored in your device's browser when you visit our website. It contains information about a specific visitor, actions performed on the website, and the website address. "Cookies" act as a kind of "memory" that remembers your behavior when visiting the website and allows the site to better adapt the service to your needs based on previous visits, ultimately creating a more personalized and comfortable experience.

We collect information about your visit to the website using the following types of Cookie files:

1. Essential (Technical) Cookie Files

These files ensure the proper functioning and security of the website. Without them, it is impossible to use the basic functions of the website.

What we store: Session identifier (Session ID), authorization token (Token), user device data (User Agent), IP address, and cookie consent status (cookie_consent).

2. Functional Cookie Files

Helps the website personalize the user experience. They are not critical to the site's operation, although without them the service will be less convenient.

What we store: Your selected language (lang), products added to cart, guest unique identifier (guestid), and information about whether you have seen the advertising notification (popup) so that it does not appear repeatedly and does not cause discomfort.

3. Analytical Cookie Files

Used to analyze website usage. Stores data about your behavior: how long you spend on the page, which links you click, and how you came to us.

Google Analytics: We use a user internal identifier to receive statistical data. This data is stored for 2 years, however, you can delete it at any time from your browser settings.

4. Marketing Cookie Files

Used to study your interests in order to provide you with tailored offers.

Google Tag Manager (GTM): Through it we manage tags, which allows us to effectively adapt the website to your interests, track interaction and improve marketing communication while maintaining high security standards.

* This information is confidential and we process it to improve the quality of website use (UX) and for marketing purposes. The Cookies files we use do not store personal data that would make it possible to directly identify you. Data collected and stored by Cookies files is not transferred to third parties, except in cases defined by our Privacy Policy.

Cookie Management: You can manage Cookies from your browser, the following links will help you:

• https://shorturl.at/eJ2jP - (Firefox)
• https://shorturl.at/IwzHS - (Chrome)
• https://support.apple.com/en-us/105082 - (Safari web and iOS)

If you want to learn more about Cookie files, visit the following link:

• https://allaboutcookies.org/

Data Processing

The table below presents the purpose of processing your personal data for each specific case, with reference to the relevant legal grounds:

Personal identification number, email, mobile number, workplace information (if registering as a legal entity representative)

Purpose: Registration of users on the Supta.ge website for future product delivery.

Legitimate Interest: Product and service development; effective fulfillment of obligations imposed by legislation.

Legal Basis: To provide services to the customer.

Name, surname, address, other information provided during order placement

Purpose: Product delivery to you as our registered customer through the website (platform).

Legitimate Interest: Product and service development; effective fulfillment of obligations imposed by legislation.

Legal Basis: To fulfill obligations under the contract concluded with the data subject; to provide services to the customer.

Communication data - email, mobile phone number

Purpose: To establish relationships with customers, develop new ways of cooperation and develop our business; to create a secure environment for the customer and simplify product delivery through the use of the website (platform).

Legitimate Interest: Effective fulfillment of our legal and contractual obligations; ensuring compliance with relevant regulations.

Legal Basis: To fulfill obligations under the contract with the data subject; to provide services to the customer; to protect the significant legitimate interests of the data controller.

Location-related data (address)

Purpose: To manage and deliver products and services; fulfill contractual obligations.

Legitimate Interest: Timely and effective service, which is expressed in product delivery.

Legal Basis: Fulfill obligations under contract; protect customer rights; fulfill obligations under contract with data subject; provide services to customer; protect significant legitimate interests of data controller.

Financial and transaction-related data

Purpose: To run our business effectively and properly, including managing our financial position, business capability, planning, communications, corporate governance and audit; to protect customer rights and prevent fraudulent activities.

Legitimate Interest: Ensuring compliance with relevant regulations; effective fulfillment of our legal and contractual obligations.

Legal Basis: To fulfill obligations under contract with data subject; to protect our significant legitimate interests.

Cookies (essential, functional)

Purpose: To fulfill your requests, identify products and services of interest to you and provide this information to you, develop new ways of cooperation and develop our business; to study how customers use our products and services; to adapt web pages and their components according to customer needs; to improve website performance and user experience (UX).

Legitimate Interest: Data update, identification of products and services of interest to you; product and service development; improvement of website (platform) quality (UX).

Legal Basis: Data subject consent.

Direct Marketing

We also process your personal data for direct marketing purposes only on the basis of your consent. For this purpose, we process your data to provide you with information about suitable products and offers.

You have the right to contact us at any time and request to stop processing data for direct marketing purposes. We will satisfy your request in the shortest possible time, but no later than 7 (seven) business days from receipt of the request.

Regardless of whether you revoke your consent to process data for direct marketing purposes, we will necessarily send you mandatory informational SMS notifications.

Withdrawal of Consent

You may submit a request to withdraw consent for the processing of personal data, including direct marketing, to the organization at any time. Withdrawal of consent is possible only if the basis for processing your data is the consent expressed by you.

If you decide to withdraw your consent to data processing, please contact us using any communication channel, including the channel convenient for you specified in this Policy.

Data Disclosure

We may transfer your data to third parties for the following purposes:

• For payment processing purposes;
• To fulfill requirements provided by legislation;
• In cases directly provided by current legislation of Georgia.

Sharing your personal data may also occur if the Company's structure changes in the future. For example:

• If the Company decides to sell or dispose of its assets, or carry out a merger operation.
• In case of implementation of any of the above-mentioned processes, we may share your data with the relevant party, provided that the mentioned party undertakes in advance the obligation to protect the security and confidentiality of your data.

If other parties can use your data in case of a change in the Company's structure, this should be done in accordance with the procedures and within the framework defined by this Policy and the law.

Data Storage and Retention Period

We store your personal data depending on the process in which we processed, including received and collected, the data. In case of electronic processing of data through the website, including receipt and collection, your data is stored on a server located in Georgia and is protected from unlawful or accidental damage, loss, as well as unauthorized disclosure, destruction, alteration, access, collection/obtaining or other unauthorized processing. To ensure this, appropriate organizational, technical and legal data security measures have been taken.

We store your personal data throughout the entire period of your service. Also, after the completion of the service for at least 3 years, taking into account the following reasons:

• To answer questions and complaints;
• To confirm fair treatment of you;
• For record-keeping purposes within the framework of regulations related to our activities;
• To fulfill obligations defined by legislation.

* Your data may be stored for more than 3 years if we are deprived of the ability to delete it due to relevant legal grounds.

Your Rights

In accordance with the Law of Georgia "On Personal Data Protection", you have the right to:

• Request confirmation about whether your personal data is being processed, with indication of the basis, purpose and retention periods of processing;
• Access personal data collected about you;
• Request correction, updating or/and completion of false, inaccurate or/and incomplete data;
• Receive copies of personal data collected about you (if applicable);
• Request blocking of personal data held by us about you (if applicable);
• Request withdrawal of consent given by you;
• Also, realization of other rights guaranteed by Chapter 3 of the Law of Georgia "On Personal Data Protection".

We act in accordance with Georgian legislation, which may be the basis for not being able to satisfy your request and delete your personal data. Such obligations may arise from tax legislation, consumer rights protection and other relevant legislation.

It is important that the processing of your personal data by Supta.ge is not harmful to you. Supta.ge takes care of the security and protection of your data and is guided by internationally recognized standards.

Restriction of Rights

In accordance with the Law of Georgia "On Personal Data Protection", the rights of the data subject may be restricted if it is directly provided by Georgian legislation, it does not violate fundamental human rights and freedoms, is a necessary and proportionate measure in a democratic society, and the exercise of these rights may endanger:

• State security, information security and cybersecurity or/and defense interests;
• Public security interests;
• Crime prevention, crime investigation, criminal prosecution, administration of justice, enforcement of imprisonment and deprivation of liberty, enforcement of non-custodial sentences and probation, operational-investigative activities;
• Interests related to financial or economic (including monetary, budgetary and tax), public health and social protection issues important to the country;
• Detection of violation of professional, including regulated profession, ethics norms by the data subject and holding them accountable;
• Rights and freedoms of the data subject or/and other persons, including freedom of expression;
• Protection of state, commercial, professional and other types of secrets provided by law;
• Substantiation of a legal claim or submission.

Mechanisms for Realizing Your Rights

Contacting the Company:

To realize your legal rights, you can contact us in written form through the following communication channels:

• Email: info@supta.ge
• Website: https://supta.ge/ka/kontaqti
• Leave a statement at our physical address - Georgia, Tbilisi, M. Tsinamdzghvrishvili St. No. 162
• Contact us on the hotline - +995 322 110 626

* We will respond to your requests without unjustified delay and in any case within 10 business days from receipt of the request. This period may be extended, in exceptional cases and with appropriate justification, by no more than 10 business days, about which the data subject will be notified immediately.

Contacting the Supervisory Authority:

You have the right to contact the supervisory authority - the Personal Data Protection Service - regarding any violation of your rights related to the processing of your data.

Contact with the Personal Data Protection Service is possible using the following contact information:

• Address: Tbilisi, N. Vachnadze St. No. 7 / Batumi, Bako St. No. 48
• Phone: +995 32 242 1000
• Email: office@pdps.ge
• Website: https://pdps.ge/ka

Contacting the Court:

In addition to the right to contact the supervisory authority, the realization of which you can do using the above contact information, you can contact the court in case of any violation of your rights.

Security Measures

We ensure all organizational and technical measures to protect your personal data, which is required by the Law of Georgia "On Personal Data Protection" and regulatory legal acts.

We take necessary and sufficient organizational and technical measures to protect your information from unauthorized or accidental access, destruction, modification, blocking, copying, distribution, as well as other illegal actions by third parties.

We cannot be held responsible for the complete or partial loss of your personal data caused by cybercriminals and other criminal acts.

Policy Changes

Supta.ge is authorized to modify this Policy in accordance with legislative changes or/and changes in our personal data processing procedures. Any changes made to the Privacy Policy will be immediately published on the Company's website (platform) - https://supta.ge/ka and will be in force immediately upon publication.

Contact Us

If you have any questions regarding this Privacy Policy or our personal data protection practices, please contact us:

Email: info@supta.ge

Phone: +995 322 110 626