Privacy Policy

This Privacy Policy explains how Nitchiani — operated by [LEGAL ENTITY NAME], registered in Georgia under ID [REGISTRATION NUMBER], with its registered address at [REGISTERED ADDRESS, Tbilisi, Georgia] — collects, uses and protects the personal data you provide when you use nitchiani.shop (the "Site"). We are the data controller for the data described below. For questions reach us at Info@nitchiani.shop.

We collect only what we need to take your order, ship it, support you afterwards and run the Site. This includes: contact details you give us (name, email, phone, shipping address); order details (items, amounts, payment method, order history); communications you send us (WhatsApp messages, emails); technical data automatically logged when you visit (IP address, device type, browser, pages viewed); and optional marketing data if you sign up to our newsletter (email and language preference). We do not collect special-category data (health, religion, biometrics) and we do not knowingly collect data from children under 16.

Performance of contract — to take, fulfil and deliver your order, and to handle returns and customer support. Legitimate interest — to protect the Site against fraud and abuse, to analyse aggregated traffic patterns so we can improve the experience, and to follow up on abandoned carts in a non-intrusive way. Consent — to send marketing emails when you've opted in, and to use non-essential cookies. Legal obligation — to keep records the tax and consumer-protection authorities of Georgia require us to keep.

We never sell your data. We share only what's needed with: payment processors (Bank of Georgia, TBC Bank) to authorise and settle card payments; the shipping carrier we use for your order (only your delivery address and phone); our email-sending service (Resend) for order confirmations and, with your consent, marketing emails; hosting/infrastructure providers (Vercel, the database we operate on) under standard processor agreements; analytics (only if you've consented to non-essential cookies); the tax authority of Georgia when legally required. Each processor has its own published privacy notice — links available on request.

Some of our processors are based outside Georgia — primarily in the EU and the United States. Where data leaves Georgia, we rely on standard contractual clauses or adequacy decisions where available, and we only use providers that publish equivalent or stronger data-protection practices than Georgian law requires.

Order records: 7 years after the order date (Georgian tax record-keeping requirement). Marketing emails: until you unsubscribe or 24 months of inactivity, whichever is sooner. Customer-support correspondence: 24 months after the last message. Technical/server logs: 90 days. Anonymised analytics: indefinitely. After a retention period ends, data is deleted or anonymised. You can also request earlier deletion under section 9 below.

We use a small number of strictly necessary cookies to make the cart, wishlist, language and currency settings remember themselves across pages — these don't need consent. Anything optional (analytics, marketing pixels) only loads after you've given consent through our cookie banner. You can change your preference at any time via the link in the footer.

Data in transit is encrypted with TLS. Card details are never touched by our servers — they're entered directly into Bank of Georgia / TBC Bank's hosted payment forms. Database access is restricted to a small number of named operators and is audit-logged. If a breach occurs that affects you, we'll notify you and the supervisory authority within the timeframe the law requires.

Under the Georgian Personal Data Protection Act you have the right to: access the data we hold about you; correct anything that's inaccurate; ask us to delete data we no longer need; restrict or object to processing for marketing or legitimate-interest purposes; receive your data in a portable format; withdraw any consent you've given (without affecting prior processing); and lodge a complaint with the Georgian Personal Data Protection Service. To exercise any of these, email Info@nitchiani.shop — we respond within 30 days, usually much sooner.

The Site is intended for adults. We don't knowingly collect personal data from anyone under 16. If you believe we've collected data from a minor, contact us and we'll delete it.

If we change this policy in a way that materially affects you (for example, we add a new processor handling sensitive data), we'll notify you by email if you've signed up for marketing or by a banner on the Site. Less material updates will simply replace the previous version with the new "Last updated" date.

Privacy questions and rights requests are welcome at Info@nitchiani.shop or via WhatsApp using the number in the footer. We answer most within a few hours during studio working days; rights requests get a written reply within 30 days.