Privacy Policy

LLC „Synergy Georgia“ (brand MODI)

Personal Data Protection Policy

Company: LLC „Synergy Georgia“ (brand MODI)
Identification code: 400358117
Registered address: 140 Tsereteli Ave., Tbilisi, Georgia
Website: https://www.modi.shopping
E-mail: info@modi.shopping

1) Introduction

This document explains the purposes, legal grounds and rules under which LLC „Synergy Georgia“ (the Company, brand MODI) processes the personal data of its customers.

By ticking the terms and conditions / policy box on the website, the customer confirms that they have read and accept this policy; that the data they have provided is accurate and truthful; and that the information was given voluntarily and that they hold the rights required by law to do so.

By accepting the website terms and policy, the customer authorises the Company, within the limits of applicable law, to obtain and process information about them — including personal data — for the purposes of identification, verification, validation and the performance of statutory and contractual obligations.

Definitions:
Website — the domain https://www.modi.shopping and other digital channels belonging to the Company.
Company / data controller — LLC „Synergy Georgia“, which determines the purposes and means of processing and carries it out directly or through an authorised processor.
Customer / data subject — any natural person who visits the store or the website and receives services.
Personal data — information relating to an identified or identifiable natural person (first name, surname, personal number, contact details, electronic identifiers, technical identifiers, etc.).

2) Purpose of the policy and compliance

2.1 The Company processes personal data in compliance with Georgian legislation (the Law of Georgia on Personal Data Protection and other acts) and with international best practice.
2.2 Data protection is the foundation of the trust in our business and of our good-faith relationship with the customer.
2.3 The Company processes data:

to comply with legal obligations;
to conclude and perform a contract;
for direct marketing — only with the customer's consent.

3) Scope

3.1 The policy applies to every automated, semi-automated and non-automated personal data processing operation within the Company.
3.2 It covers customers, employees, contractors and every third party whose data the Company processes, as well as data recipients and authorised processors.

4) Principles and legal grounds of processing

4.1 Principles:

lawfulness, fairness and transparency;
purpose limitation, and a prohibition on processing incompatible with that purpose;
minimisation — only as much data as is necessary;
accuracy and updating; prompt correction or deletion of inaccurate data;
storage limitation — only for as long as the purpose requires;
security — technical and organisational measures against unauthorised or unlawful processing and against accidental loss or destruction.

4.2 Legal grounds:

the data subject's consent for one or more specific purposes;
necessity to conclude or perform a contract;
a statutory obligation;
a legitimate interest of the Company or a third party (where the data subject's rights do not override it);
the data subject has made the data publicly available themselves;
vital interests or an important public interest;
provision of a service at the data subject's own request or application.

4.3 Further processing incompatible with the original purpose is not permitted. Data collected without grounds, or incompatible with the purpose, must be blocked, deleted or destroyed.

5) Special categories of data

5.1 As a rule, the Company does not process special categories of (sensitive) data.
5.2 Where a specific service makes this necessary, processing takes place only in accordance with the law and only where the appropriate grounds exist (e.g. written consent; a direct legal basis and proportionality; vital interests; healthcare purposes; employment-law grounds, etc.).

6) Categories of data and processing operations

6.1 The Company may process: first name, surname, personal number (where required), telephone number, e-mail, delivery address, the minimum data required for payment, technical identifiers (e.g. IP address, device/browser identifiers), order and delivery history, and records of service-related communication.
6.2 Processing may include collection, recording, organisation, storage, alteration, retrieval and destruction, etc. (by automated, semi-automated or non-automated means).
6.3 Typical purposes: the sale and delivery of goods (online or in store); warranty and service communication; accounting and tax obligations; customer support; direct marketing with consent; analytics and service improvement.
6.4 Consent may be given in writing, electronically (a checkbox, a form, e-mail) or by any other recordable means.
6.5 The Company may use authorised processors (service providers) under a written contract that provides for appropriate security measures and compliance with the law.

7) Direct marketing

7.1 Direct marketing takes place only with consent.
7.2 Processing for marketing of data beyond the necessary contact details requires additional written or electronic consent.
7.3 The customer is informed in advance and clearly of the right to withdraw consent at any time and of how to do so.
7.4 The Company is obliged to stop marketing processing no later than 7 working days after receiving the request.
7.5 Refusal or withdrawal is possible through the same channel by which the message was received, or by e-mail to info@modi.shopping.

8) Video and audio monitoring

8.1 A video surveillance system may be used on the Company's retail premises, in its warehouses and at its entrances for security, protection of property and quality control of service — subject to the requirements laid down by law. Telephone support calls may be recorded, of which the customer is notified in advance (by an audio message or a notice).
8.2 Video recordings are kept for a period proportionate to the technical means and the purpose, as a rule no longer than 60 days (save for the exceptions provided by law).
8.3 Call recordings are kept for a period proportionate to the purpose (as a rule no longer than 5 years, unless litigation or dispute handling requires longer).
8.4 Only those employees and providers whose duties require it have access to the recordings.

9) Transfer of data to third parties

9.1 The Company may transfer data to third parties in order to fulfil an order or delivery (couriers), to process payments, for accounting and tax purposes, for IT infrastructure and hosting, to service providers, and to state authorities in the cases laid down by law.
9.2 Transfers are made with protective safeguards and only to the extent necessary.
9.3 Where data is transferred to a foreign country or an international organisation, the appropriate safeguards required by law are ensured.

10) Receiving data from third parties

The Company may receive customer data from third parties (e.g. a courier operator, a payment provider, a partner platform) for the provision of services, the performance of obligations and the purposes laid down by law — in accordance with the law and on the minimisation principle.

11) Processing through an authorised processor

Processing on the Company's behalf takes place only under a written contract between the parties, after prior due diligence and subject to information security measures (organisational and technical).

12) Data security

12.1 The Company applies appropriate technical and organisational measures (access control, encryption where possible, logging, backups, staff training) to reduce the risk of unauthorised or unlawful processing, loss, destruction or damage.
12.2 Access to data is restricted on a need-to-know basis.
12.3 Compliance with this policy, the law and internal procedures is supervised by the person responsible for personal data protection (see „Contact information“).

13) Rights of the data subject

The customer / data subject has the right to:

request confirmation of whether their data is being processed, and to receive information on the purposes, legal grounds, sources, storage period or criteria, and recipients — and, in the case of transfer abroad, on the safeguards;
access their own data and obtain copies in the cases laid down by law;
request the correction, updating or completion of inaccurate or incomplete data;
request the cessation, blocking, deletion or destruction of processing in the manner laid down by law;
appeal or complain to the Personal Data Protection Service, to a court or to another competent authority.

As a rule, the Company answers a request for information no later than 10 working days (with a reasoned temporary extension of no more than a further 10 working days).

14) Withdrawal of consent

The customer may withdraw consent at any time (for example, consent to marketing). In that case, if no other legal ground exists, the Company will stop processing and will delete or block the data no later than 10 working days afterwards. Withdrawal is made through the same channel or by e-mail to info@modi.shopping.