Privacy Policy

This Privacy Policy explains how Nitchiani — operated by IE Nini Gordiashvili, an individual entrepreneur registered in Georgia (ID code 01024088873), with its registered address at 17 Sulkhan Tsintsadze St, Tbilisi, Georgia — collects, uses and protects the personal data you provide when you use nitchiani.shop (the "Site"). We are the data controller for the data described below. Delivery of your order involves several named companies; section 5 sets out exactly who receives what. For questions reach us at Info@nitchiani.shop.

We collect only what we need to take your order, ship it, support you afterwards and run the Site. This includes: contact details you give us (name, email, phone, shipping address); the precise coordinates of the delivery point when you place a pin on the checkout map, or when you set the address yourself from a link we send you; order details (items, amounts, payment method, order history); communications you send us (WhatsApp messages, emails, live-chat messages); technical data automatically logged when you visit (IP address, device type, browser, pages viewed); and optional marketing data if you consent to marketing (email, phone and language preference). We do not collect special-category data (health, religion, biometrics) and we do not knowingly collect data from children under 16.

Performance of contract — to take, fulfil and deliver your order, to pass the delivery address and phone to the delivery platform and the courier that carries it, to send you the delivery status messages described in section 5, and to handle returns and customer support. Legitimate interest — to protect the Site against fraud and abuse, to analyse aggregated traffic patterns so we can improve the experience, and to follow up on abandoned carts in a non-intrusive way. Consent — to send marketing messages when you have ticked the marketing box at checkout or signed up in the footer, to let our delivery partner send you its own marketing, and to use non-essential cookies. Each of those is a separate, optional tick and none of them is a condition of buying; you can withdraw any of them at any time. Legal obligation — to keep records the tax and consumer-protection authorities of Georgia require us to keep.

We never sell your data. We share only what each recipient needs, and these are the recipients by name: EchoDesk (LLC EchoDesk, api.echodesk.ge) — the commerce and order-management system behind the Site, and the live chat; it holds your order record in full. LLC QuickShipper (ID code 405547877, quickshipper.app) — the delivery platform that takes your delivery address, coordinates, name and phone and dispatches the order to a courier. The courier company that actually carries your order — chosen per order from the providers available in the platform at that moment (Wolt, Glovo, Georgian Post, Go Delivery and others; the list changes without notice), each of which receives your name, phone, address and coordinates, and each of which has its own terms and its own privacy notice. Google (Maps and Places APIs) — the checkout address picker sends what you type in the address field and the pin you drop, as coordinates, to Google. Bank of Georgia and TBC Bank — to authorise and settle card payments. Resend — order confirmation emails and, with your consent, marketing emails. An SMS gateway contracted by QuickShipper — the delivery messages in section 5. Netlify — hosting and request logs. Google Analytics — only if you have consented to non-essential cookies. The tax authority of Georgia — when legally required. Each recipient has its own published privacy notice; links available on request at Info@nitchiani.shop.

Delivery is organised through QuickShipper, which is a platform rather than a courier: it takes the order from us, prices it across the courier companies available at that moment, and hands it to the one selected. Three things follow from that, and you should know about all three before you order. First, you will receive an SMS on the number you gave us containing a link to a tracking page, so you can follow the order in real time; that message is sent through QuickShipper's SMS gateway and may arrive under our name or under QuickShipper's. Second, if we ask you to set the delivery point yourself, you will receive an SMS with a link to a map where you place the pin — the address and coordinates you enter there are yours, and neither we nor QuickShipper can verify that they are correct, so a delivery sent to a wrong pin is redelivered at your cost. Third, the tracking page is operated by QuickShipper and may show advertising alongside your order status; that advertising is served by QuickShipper, not by us, and we do not pass your order contents to any advertiser. The courier that carries your order is an independent company with its own terms, its own handling and return policy and its own privacy notice; we are responsible for what we send them, and they are responsible for how they carry it.

Some of our processors are based outside Georgia — primarily in the EU and the United States (Google, Resend, Netlify). Where data leaves Georgia, we rely on standard contractual clauses or adequacy decisions where available, and we only use providers that publish equivalent or stronger data-protection practices than Georgian law requires. EchoDesk, QuickShipper and the courier providers operate in Georgia.

Order records: 7 years after the order date (Georgian tax record-keeping requirement). Marketing consents and the evidence of them: for as long as the consent stands, plus 3 years after you withdraw it, so we can show it was given. Marketing contact lists: until you unsubscribe or 24 months of inactivity, whichever is sooner. Customer-support correspondence: 24 months after the last message. Technical/server logs: 90 days. Anonymised analytics: indefinitely. EchoDesk, QuickShipper and the courier that carried your order keep their own copies of the delivery data under their own retention rules, which we do not control; where you ask us to delete data, we forward the request to them as described in section 10. After a retention period ends, data on our side is deleted or anonymised.

We use a small number of strictly necessary cookies to make the cart, wishlist, language and currency settings remember themselves across pages — these don't need consent. Anything optional (analytics, marketing pixels) only loads after you've given consent through our cookie banner. The Google Maps address picker at checkout loads from Google and sets Google's own cookies when you use it; it loads because it is needed to price and dispatch a delivery, and if you prefer not to use it you can type the address instead. You can change your cookie preference at any time via the link in the footer.

Data in transit is encrypted with TLS. Card details are never touched by our servers — they're entered directly into Bank of Georgia / TBC Bank's hosted payment forms. Access to the order system is restricted to a small number of named operators and is audit-logged. If a breach occurs that affects you, we'll notify you and the supervisory authority within the timeframe the law requires; where the breach happened at EchoDesk, QuickShipper or a courier rather than with us, we will tell you that and tell you which one.

Under the Georgian Personal Data Protection Act you have the right to: access the data we hold about you; correct anything that's inaccurate; ask us to delete data we no longer need; restrict or object to processing for marketing or legitimate-interest purposes; receive your data in a portable format; withdraw any consent you've given (without affecting prior processing); and lodge a complaint with the Georgian Personal Data Protection Service. To exercise any of these, email Info@nitchiani.shop — we respond within 30 days, usually much sooner. Where the data sits with EchoDesk, QuickShipper or a courier rather than with us, we forward your request to them, tell you the date we forwarded it and pass on their answer; we cannot delete records from their systems ourselves. Withdrawing consent to our delivery partner's marketing is handled the same way — tell us and we pass it on, or use the unsubscribe details in the message itself.

The Site is intended for adults. We don't knowingly collect personal data from anyone under 16. If you believe we've collected data from a minor, contact us and we'll delete it.

If we change this policy in a way that materially affects you — for example we add a new processor, or the delivery chain in section 5 changes — we'll notify you by email if we hold your address for marketing, or by a notice on the Site. Less material updates will simply replace the previous version with the new "Last updated" date. The courier providers reachable through QuickShipper change without notice to us; section 4 names the ones available when this version was published and is updated as they change.

Privacy questions and rights requests are welcome at Info@nitchiani.shop or via WhatsApp using the number in the footer. We answer most within a few hours during working days; rights requests get a written reply within 30 days.