PRIVACY POLICY FOR THE PROTECTION AND PROCESSING OF PERSONAL DATA OF SITE USERS

PERSONAL DATA PROTECTION AND PROCESSING POLICY (PRIVACY POLICY) OF WEBSITE USERS’
Update date: “12” July, 2023.
This document (hereinafter – the “Policy”, “Agreement”) is a legally binding document and defines the policy of the Individual Entrepreneur Aleksei Stepanov (registered in accordance with the legislation of Georgia, IE identification number: 305592025, registration date: 20.01.2023, hereinafter – “Administration”) in relation to the privacy policy and processing of the Users’ Personal Data on the Website      https://www.bimstep.com/.

1.    General Provisions
1.1 The User is obliged to fully familiarize himself/herself with this Policy before starting to use the Website. Use of the Website and/or filling in any forms on the Website by the User means full and unconditional acceptance of this Policy by the User.
1.2 This Policy is publicly available and and is subject to posting on the Website at the following address: https://www.bimstep.com/ (hereinafter – the “Website”).
1.3 Local normative acts and other documents regulating the processing of Users’ Personal Data on the Website are developed taking into account the provisions of the Policy.
1.4 The Administration has the right to make changes to this Policy, for reasons related to business practices or regulatory changes, without prior notice to the User and/or obtaining approval from him. When changes are made, the date of the last update of the revision shall be indicated in the title of the Policy. The new edition of the Policy comes into force from the moment of its posting on the Website, unless otherwise provided by the new edition of the Policy. In this regard, we recommend that you review the Policy when you visit the Website again.
1.5 The Administration has the right, at its discretion, to notify the User about the addition and/or modification of this Agreement in a way that the Administration considers most acceptable. The use of the Website, materials and services offered on it at any time means the unconditional acceptance by the User of all terms and conditions of this Agreement. In case the User does not agree with the current version of this Agreement in full or in part, he must immediately stop using the Website.
1.6 By accepting this Agreement by using the Website and filling out any forms placed on it, the User confirms his consent to the processing by the Administration of his personal data provided during registration, as well as placed by the User voluntarily on his personal page in his personal account.
1.7 The Administration acts as a Data Processor in accordance with the Law of Georgia “On Personal Data Protection”.
1.8 The Policy applies to terms and definitions used in accordance with the legislation of Georgia and the usual rules of interpretation of the relevant terms established in the Internet, in particular:
– Users (Subjects of personal data) – all persons using the official Website of the Administration;
– Personal Data – any information related to an identified or identifiable natural person. A person is identifiable when he/she may be identified directly or indirectly, in particular by identification number or by any physical, physiological, psychological, economic, cultural or social features specific to this person. The information may include, without limitation, name, photo, e-mail address, postal or other physical address, credit or debit card number, job title, mobile phone number and other identifying data;
– Data Processor – public institution, natural or legal persons who individually or together with other persons determine the purposes and means of personal data processing, directly or with the help of an authorized person carry out data processing;
– Personal Data Processing – any operation performed in relation to personal data using automatic, semi-automatic or non-automatic means, in particular collection, recording, photographing, audio recording, video recording, systematization, storage, alteration, replacement, recovery, retrieval, reclamation, use or disclosure for the purpose of transmission, dissemination of data or providing access to them in any other way, grouping or combination, blocking, deletion or destruction of data. The said actions shall be interpreted in accordance with the Law of Georgia on “Personal Data Protection”. 
– cookies are text files containing a small amount of information that are downloaded by the User’s computer or mobile device when visiting the Website.

2. Purposes of personal data collection and processing
2.1 The Administration collects and/or processes Personal Data when the User uses the services offered by the Administration, as well as when using or otherwise interacting with the products of the Administration.
2.2 The Administration collects and/or processes Personal Data in order to enable the User to fully utilize the Website, to provide the User with services offered by the Administration and other Users, to participate in research and marketing activities conducted by the Administration.
2.3 The Administration collects and stores only the Personal Information, that is necessary for the provision of the Website’s services or the execution of agreements and contracts with the User, except for cases when the legislation provides for mandatory storage of personal information for a period of time specified by law, including for the purpose of: 
– identification of the User; 
– providing personalized services and maintenance to the User; 
– communication with the User, including sending notifications, requests and information related to the use of the Website, the provision of services, as well as processing requests and applications from the User; 
– conducting statistical and other research based on anonymized data; 
– conducting marketing campaigns for the Users, including for the purpose of distributing offers to participate in the promotion and receiving prizes/rewards provided by the promotion; 
– distribution of advertising and information materials via telecommunication networks, including through the use of telephone, Internet, mobile radio telephony, or through direct contacts; 
– targeting of mailings, promotional materials and other information brought to the Users’ attention.

3.   Scope of Personal data processed
3.1 Within the framework of this Policy, the Personal Data of the User includes:  
– personal information that the User provides about himself/herself when leaving an application on the Website and selecting the offered product, including: name, surname, actual (postal) address, e-mail address, telephone number, place of work, company name;
– data that are automatically transmitted to the Administration in the process of using the Website using the software installed on the User’s device, including: IP-address, cookie information, information about the User’s browser (or other program that allows access to the Website services is), access time, address of the requested page, as well as other data, including those provided by the User after the User’s registration, in the process of using the Website.

4. Procedure and conditions of personal data processing
4.1 The Administration has the right: 
– to carry out any actions (operations) or sets of actions (operations) performed using automation tools or without using automation tools (Personal Data Processing), including collection, recording, copying, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (provision, access) to third parties, as well as in cases directly  provided for by the current legislation of Georgia, in compliance with the requirements of confidentiality of information, depersonalization, blocking, deletion or destruction of Personal Data. The User gives his/her consent to the processing of his/her personal data in accordance with this Policy and confirms that he/she acts with his/her own will and in his/her own interest.
– use cookies and similar technologies (including: pixel tags, web beacons, transparent GIF files, JavaScript and local data storage, etc.), to collect personal identification information or information that may become personal identification information in combination with other information, in compliance with all necessary legal and regulatory requirements regarding the confidentiality of Users’ personal data, by recognizing Users, counting their number and observing which pages of the Website they visit, to guarantee maximum User convenience by providing personalized information, remembering their marketing and product preferences, and also helping them get the right information (including for accessing secure areas of the Website or using a virtual shopping cart), analyzing User actions on the Website, in order to improve and optimize the Website, including making it easier for visitors to find the necessary information on the Website;
– provide advertising, messages and content, including by sending advertising SMS notifications (messages), advertising notifications and messages, via e-mail in the Internet, using services and databases of both the Website itself and services of third-party (external) sites and resources in the Internet;
– communicate directly with the User, including via telephone.
4.2 Administration has the right to use the information provided by the User, including Personal Data, in order to ensure compliance with the requirements of current legislation (including for the purposes of prevention and/or suppression of illegal and/or unlawful actions of Users). Disclosure of the information provided by the User may be made only in accordance with the current legislation at the request of the court, law enforcement authorities, as well as in other cases provided for by the legislation.
4.3 Personal Data Processing is carried out from the moment of filling out the appropriate form for the provision of services on the Website by the User, or the provision of Personal Data by a person in another form, and until the termination of relations between the Administration and the User as a result of withdrawal of consent to the processing of Personal Data by the person who provided such data in another form.
4.4 The Administration has the right to transfer the User’s personal information to third parties in the following cases: 
– The User has expressed his/her consent to such actions; 
– the transfer is necessary for the use of a certain service/maintenance of the Website; 
– transfer is provided by the legislation of Georgia or other applicable legislation within the procedure established by the legislation; 
– transfer occurs within the framework of the sale or other transfer of the Website (in whole or in part), at the same time the purchaser assumes all obligations to comply with the terms of this Policy in relation to the personal information received by him.
4.5 Administration does not sell or lease Personal Data to third parties for marketing purposes without prior authorization from Users. 
4.6 Access to Users’ Personal Data is possible within the Administration and its employees.
4.7 The Administration will make all reasonable efforts to ensure that:
– confidential information about Users is collected by the Administration only to the minimum extent necessary;
– confidential information is used only for the purposes stated at the time of its collection;
– confidential information will not fall into the hands of third parties, except in cases specified in this Agreement or legislation of Georgia.
4.8 The Administration stores Personal Data and ensures their protection from unauthorized access and distribution in accordance with internal rules and regulations. The User’s Personal Data shall be kept confidential, except for cases when the technology of the Website or the settings of the software used by the User provide for an open exchange of information with other Users of the Website or with any users of the Internet.
4.9 The User’s personal information is kept confidential, except for cases when the User voluntarily provides information about himself/herself for general access to an unlimited number of persons.
4.10 Administration ensures confidentiality and security of Personal Data during their processing in accordance with the requirements of the legislation of Georgia. The Administration applies appropriate standards of technological and operational security to protect information provided by visitors to our Website from unauthorized access, disclosure, distortion or destruction.
4.11 Personal data is stored on the Website until the User stops using the Website and services/maintenance provided through the Website. 
4.12 In accordance with the legislation of Georgia, upon achievement of the purpose for which the Personal Data were processed, they will be blocked, deleted or destroyed or stored in a form that excludes the possibility of identification of the person.
Accordingly, the Administration will store Users’ Personal Data only for as long as it is necessary to fulfill the purposes for which it was collected, including for the purpose of satisfying any legal, accounting or reporting requirements.
In order to determine the appropriate retention period for personal information, the Administration takes into account legal requirements and established statutory regulations, as well as the scope, nature and level of privacy of the information, the potential risk of harm from unauthorized use or disclosure of the information, the purposes for which the information is processed, and whether those purposes can be achieved through alternative ways.
4.13 In some cases, the Administration may anonymize personal information so that it is no longer linked/associated with a particular User. In such cases, the Administration may use this information without the User’s consent.
4.14 The destruction of Personal Data is carried out by erasing information using certified software with guaranteed destruction (in accordance with the specified characteristics for the installed software with guaranteed destruction).
4.15 User’s Personal Data is stored by the Administration exclusively on electronic media and processed using automated systems, except for cases when non-automated processing of Personal Data is necessary due to fulfillment of the requirements of the legislation of Georia.

5.   User’s rights
5.1 Under certain circumstances, in accordance with the legislation of Georgia, the User has the right to:
5.1.1. Request access to his Personal Data, to receive a copy of the Personal Data about the User, which is stored by the Administration.
5.1.2. Request correction of Personal Data, which the Administration keeps about him.
5.1.3 Request deletion of Personal Data, if the User considers that the Administration has no compelling reason to continue processing it.
5.1.4. Object to the Personal Data Processing: if in a certain situation of the User there are circumstances that force the User to object to the processing on their basis, despite the fact that the Administration processes the information on a legitimate basis.
5.1.5 Withdraw the provided consent to the Personal Data Processing at any time. In accordance with the Georgian legislation, the Administration undertakes to cease data processing or (and) destroy the processed data within 5 days after submission of the application, if there is no other basis for data processing.
The User may exercise the above rights by notifying the Administration in writing through the communication channels specified on the Website.

6. Dispute resolution and applicable law
6.1 For disputes arising from the relationship between the User and the Administration of the site, it is mandatory to submit a claim (a written proposal for voluntary settlement of the dispute) through the communication channels specified on the Website.
6.2 The Administration, within 30 calendar days from the date of receipt of the claim, shall notify the User in writing of the results of consideration of the claim.
6.3 In case of failure to reach an agreement, the User has the right to appeal to the Personal Data Protection Service or the court in the manner established by the legislation of Georgia.
6.4 The current legislation of Georgia applies to this Privacy Policy and relations between the User and the Website Administration.

7. Final Provisions
7.1 The Website may contain links to websites and other information resources of third parties on the Internet, placed solely for the convenience of Users. Administration does not declare its approval and does not give any assessment of third-party sites or information contained on these sites, as well as possible results of their use, as well as does not check the accuracy and relevance of this information. Responsibility for the use of third-party websites rests entirely with the User.
7.2 This Policy is applicable only to the services of the Website. The Administration does not control and is not responsible for the sites/services of third parties, to which the User can click on links available from the services of the Website, including for the information about the User processed by third parties.
7.3 Persons processing Personal Data are obliged to comply with the requirements of regulatory documents of the Administration in terms of ensuring confidentiality and security of Personal Data.
7.4 The Website is not intended and is not specifically oriented to its use by persons under the age of 18 years. The Policy does not provide for the intentional collection or storage of personal information of persons under the age of 18.
7.5 All materials of the Website, including text, structure, design and arrangement of blocks, are protected by intellectual property rights. Full or partial copying is prohibited.

8. Administration details:
Individual Entrepreneur Alexksei Stepanov
Identification number of IE registered in accordance with the legislation of Georgia: 305592025;
Date of registration: 20.01.2023;
Legal address: 3 Berbuki str., floor 16, apt. 72, Tbilisi, Georgia;
E-mail: info@bimstep.com
Website: https://www.bimstep.com/