Privacy Policy
Last updated: 2026-06-03 (draft) · Effective date: [to be set at publication]
1. Who we are (data controller)
This policy describes how we process your personal data when you use the website alendasoft.ge and its services.
- Controller name: [CONTENT_TODO: full legal name of the LLC]
- Identification code: [CONTENT_TODO]
- Registered address: [CONTENT_TODO]
- Email (privacy matters): [CONTENT_TODO: e.g. privacy@alendasoft.ge]
- Person responsible for data protection (if appointed): [CONTENT_TODO]
The data controller determines the purposes and means of processing your personal data.
2. What data we collect
We collect only the data necessary for the purposes listed below:
a) Through the IDS questionnaire (Initial Discovery Session). Business information about the clinic (e.g. profile, scale, needs) and contact details — name, phone or email, clinic name.
b) Through the contact form. Name, contact information (phone or email), company (optional) and the text of your message.
c) Technical data. IP address, browser type and technical session data — for security and abuse prevention. The website uses only strictly necessary cookies (see section 8).
We do not collect special category personal data (health, religion, political views, etc.); please do not enter such data in free-text fields.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Handling your request and contacting you | Your consent and steps taken to provide a service |
| Service delivery and client relationship | Performance of a contract |
| Website security and abuse prevention | Our legitimate interest |
| Compliance with legal obligations | Legal obligation |
For the IDS questionnaire and the contact form, processing begins only after your prior, informed consent (the consent checkbox in the form). Giving consent is voluntary and may be withdrawn at any time (see section 6).
4. Retention periods
We retain data only for as long as necessary to fulfil the purpose:
- Abandoned (incomplete) questionnaires: 30 days, after which personal data is deleted/anonymized (only an anonymous, non-identifiable metric remains for statistics).
- Completed questionnaires and contact enquiries: 12 months, after which data is anonymized — identifying and free-text information is removed, and only non-identifiable structured data is kept.
- Security audit logs: 12 months, then deleted.
- Where an active contractual relationship exists, data is kept for the duration of that relationship and any additional periods required by law.
5. Who we share data with
We do not sell your personal data. Data may be shared only with our trusted processors, acting on our instructions and under contract:
- Hosting / infrastructure: Hetzner Online GmbH (servers in the European Union — Germany);
- Email service: Brevo (Sendinblue SAS) — for transactional notifications.
Data may be disclosed to an authorized state body only in cases provided by law. Cross-border transfers occur only where safeguards permitted by law are in place.
6. Your rights
Under Georgia's Law on Personal Data Protection, you have the right to:
- be informed about the processing of your data and request a copy;
- request correction, update or blocking of inaccurate or incomplete data;
- request erasure (right to be forgotten) in the cases provided by law;
- restrict or object to processing;
- withdraw consent at any time (this does not affect the lawfulness of processing before withdrawal);
- receive your data in a structured format (portability) within the limits set by law.
To exercise a right, contact us at: [CONTENT_TODO: email]. We will respond within the period set by law.
7. Data security
We use organizational and technical measures to protect data, including: encrypted connections (HTTPS/TLS), strict access control, auditing of administrative access, and minimized data collection. However, no method of transmission over the internet can be guaranteed to be absolutely secure.
8. Cookies
The website uses only strictly necessary cookies (e.g. a session identifier for the form-save feature). We do not use third-party advertising or tracking cookies. [CONTENT_TODO: if analytics (e.g. Plausible) is added — state that it is cookieless / PII-free.]
9. Supervisory authority and complaints
If you believe your data has been processed in breach of the law, you have the right to contact the Personal Data Protection Service of Georgia (personaldata.ge) or the courts. Please contact us first — we will try to resolve the matter quickly.
10. Changes and contact
We may update this policy from time to time. We will provide information about material changes on the website. For questions: [CONTENT_TODO: email / address].