Privacy policy

1.The controller

1. 1.1შპს პრაიმჰოსტი, identification code 404541634, registered in Georgia at 13 Mtatsminda Turn, Tbilisi, Georgia and trading as Wehost, determines the purposes and means of the processing described in this policy and is therefore the data controller in respect of it.
2. 1.2All correspondence concerning personal data is to be addressed to contact@wehost.ge, or to the address above marked for the attention of the data protection contact. A request may be made in Georgian or in English.
3. 1.3The Company answers a request within the period allowed by law and informs the applicant where it needs the extension the law permits. No charge is made.

2.Definitions

1. 2.1In this policy the terms below have the meanings given, unless the context plainly requires otherwise.

• Personal data: any information relating to an identified or identifiable natural person.
• Data subject, you: the natural person to whom the personal data relates.
• Processing: any operation performed on personal data, including collection, recording, storage, use, disclosure and erasure.
• Controller, the Company, Wehost, we: შპს პრაიმჰოსტი.
• Processor: a person who processes personal data on the Company's behalf and on its instructions.
• Website: wehost.ge, together with every page and subdomain operated by the Company.
• Supervisory authority: the Personal Data Protection Service of Georgia.

3.Categories of personal data

1. 3.1The Company collects only the data required for the purpose for which it is collected. No field on the Website requests data that is not used.
2. 3.2Where data marked as required is not provided, the Company is unable to conclude or perform the contract concerned.

• Booking data: name, electronic mail address, telephone number, the apartment, the dates, the number of guests, the amount payable and any note left at checkout.
• Account data: the above, together with the language in which the Website is read. A password is stored as a cryptographic hash and is not readable by the Company.
• Correspondence data: name, electronic mail address, telephone number, the content of the message and the form through which it was sent.
• Lease request data: the above, together with the intended month of occupation, the term sought and the rent quoted.
• Owner enquiry data: name, contact details and the approximate location of the apartment offered for management.
• Payment data: the payment provider's reference, the amount, the outcome of the transaction and, at most, the brand and the last four digits of the card.
• Technical data: internet protocol address and the ordinary parameters of the request, recorded in server logs.

4.Sources

1. 4.1Personal data is obtained from the data subject directly, at the moment it is entered on the Website or sent to the Company.
2. 4.2Where a stay was booked through a booking platform, the Company receives the reservation data from that platform, which acts as a controller in its own right in respect of it.
3. 4.3The Company does not purchase personal data, does not acquire it from data brokers and does not enrich what it holds with data obtained elsewhere.

5.Purposes and legal grounds

1. 5.1The Company processes personal data only where a ground provided by the Law of Georgia on Personal Data Protection applies to the purpose concerned. The grounds relied upon are set out below.
2. 5.2Performance of a contract: arranging a stay or a lease from the booking through to arrival, occupation, departure and any refund.
3. 5.3A request of the data subject before the conclusion of a contract: answering an enquiry, quoting for a lease or estimating what an apartment may earn.
4. 5.4Compliance with a legal obligation: accounting, tax and other records the Company is required to keep.
5. 5.5The legitimate interests of the Company: keeping the Website available, preventing fraud and abuse, establishing and defending legal claims, and the internal administration of the business. Those interests are weighed against the rights of the data subject in each case.
6. 5.6Consent: any purpose outside the grounds above, which is requested at the time and may be withdrawn at any moment without affecting the lawfulness of processing carried out beforehand.

6.Data of special category

1. 6.1The Company does not request and does not knowingly process data revealing health, racial or ethnic origin, political opinions, religious or philosophical belief, trade union membership, sexual life, or biometric or genetic data.
2. 6.2Data subjects are asked not to include such data in correspondence. Where it is received unsolicited, it is deleted unless its retention is required by law.

7.Recipients

1. 7.1Personal data is disclosed only to the recipients listed below, only to the extent required for the purpose stated, and only under a contract that prohibits any use of the data for the recipient's own purposes.
2. 7.2The Company does not sell personal data, does not disclose it for consideration and operates no advertising on the Website.

• Guesty: the property management system in which reservations and guest correspondence are held.
• Flitt: the payment service provider, which receives the payment data directly from the data subject's browser.
• Supabase: the provider hosting the Company's database, located in Frankfurt, Federal Republic of Germany.
• Vercel: the provider hosting the Website and holding its server logs.
• Resend: the provider delivering electronic mail sent by the Company.
• Booking platforms on which the apartment is listed, in respect of a reservation made through them.
• Personnel engaged in cleaning the apartment and in admitting the guest, who receive the name, the dates and the telephone number.
• The Company's accountants, auditors and legal advisers, under a duty of confidentiality.
• A public authority, where disclosure is required by the legislation of Georgia.

8.Transfer outside Georgia

1. 8.1The Company's database is located in the Federal Republic of Germany. Certain of the processors named above are established outside Georgia and outside the European Union.
2. 8.2A transfer is carried out only where the receiving state ensures appropriate protection of personal data, or where the contract with the recipient itself provides the safeguards required by the Law of Georgia on Personal Data Protection. The Company holds such an agreement with each processor named above.

9.Retention

1. 9.1Personal data is retained for as long as the purpose for which it was collected requires, and thereafter for the period during which the legislation of Georgia requires the Company to keep it.
2. 9.2On expiry of the period the data is deleted or irreversibly anonymised.

• Bookings, leases and payment records: six years, in accordance with the legislation on accounting, reporting and audit.
• Account data: until the account is deleted, whether at the request of the data subject or by the Company. Deletion removes the name, the electronic mail address, the telephone number and the correspondence, and severs the account from the bookings and lease requests made through it, which remain as accounting documents without a name attached to them.
• Enquiries not resulting in a contract: two years from the last correspondence.
• Correspondence attached to a booking: for the retention period of that booking.
• Session records: thirty days, or until the data subject signs out.
• Server and system logs: thirty days. Records of a payment or of a failure are retained longer, being the records from which a subsequent dispute is answered.

10.Cookies

1. 10.1The Website places the cookies listed below and holds in the browser the further items listed with them. Each is set by the Company itself and each is necessary for the functioning of the service requested.
2. 10.2None of them is used for advertising, for audience measurement or for tracking the data subject across other websites, and for that reason no consent banner is presented.

• wehost_session: establishes that the visitor is signed in. Thirty days, inaccessible to script.
• wehost_signed_in: records only that some account is signed in, so that the page may be drawn correctly before the server is asked. It carries no other information.
• wehost_currency: records the currency the visitor has chosen for the display of prices. One year. Set only when a currency is chosen; until then the display currency is inferred afresh on each visit from the country from which the Website is reached, and nothing is stored.
• wehost_oauth: holds for ten minutes the data required to complete a sign-in begun with Google, and secures that sign-in against interference by a third party. Set only where that route is used, and discarded as soon as the sign-in completes or expires.
• wehost_checkout_details: retains the name, the electronic mail address and the telephone number entered at checkout, so that they survive a step back through the payment. Held in the session storage of the browser rather than as a cookie, never sent to the Company by that means, and discarded when the booking is completed or the tab is closed.

11.Absence of tracking and profiling

1. 11.1The Website operates no analytics, no advertising and no third party tracking technology.
2. 11.2Typefaces are served from the Company's own domain and map tiles are proxied through its own server, so that no third party learns of a visit to the Website.
3. 11.3The Company takes no decision producing legal effects concerning the data subject, or similarly significantly affecting the data subject, based solely on automated processing, and carries out no profiling.

12.Direct marketing

1. 12.1The Company sends no marketing communication. Electronic mail sent to a guest relates to a booking, a lease or an enquiry and is sent in performance of the contract.
2. 12.2Should the Company introduce marketing communication, it will be sent only with the prior consent of the data subject, and the consent may be withdrawn at any time by writing to contact@wehost.ge or by the means indicated in the communication itself. Processing for the purposes of direct marketing ceases within the period established by law.

13.Rights of the data subject

1. 13.1The data subject holds the rights set out below in respect of data concerning them, and may exercise any of them by writing to contact@wehost.ge, preferably from the electronic mail address held by the Company.
2. 13.2The Company may request such information as is reasonably necessary to establish the identity of the applicant, and no more.
3. 13.3Erasure may also be requested from within the account itself, under Profile, without writing to anybody. The request is recorded at once and is actioned by a member of the Company's personnel. It may be withdrawn at any time before it is actioned.
4. 13.4A request for erasure is refused for so long as the account holds a stay which has not ended or a tenancy for which rent has been paid, those records being required for the performance of the contract and for the purposes of accounting. The applicant is told so at the moment of asking, together with what is outstanding.
5. 13.5Where a request is refused in whole or in part, the Company states the ground of refusal and informs the applicant of the right to apply to the Personal Data Protection Service of Georgia or to a court.

• To be informed what data is processed, for what purpose, on what ground, from what source it was obtained and to whom it has been disclosed.
• To obtain a copy of the data.
• To have inaccurate or incomplete data corrected or completed.
• To have the data erased where it is no longer required and its retention is not required by law.
• To have the processing blocked while the accuracy or the lawfulness of the processing is in dispute.
• To receive the data in a structured, commonly used format and to transmit it to another controller.
• To withdraw consent where consent is the ground relied upon.
• To object to processing carried out on the ground of the Company's legitimate interests.

14.Signing in with Google

1. 14.1Where the data subject chooses to sign in with a Google account, Google transmits to the Company the electronic mail address of that account, the name held on it, the account identifier and, where one is set, the picture. No password is transmitted and the Company never holds one.
2. 14.2That data is used for one purpose: to create or identify the account, to sign the data subject in, and to address correspondence concerning a booking. It is held on the same terms as the data of an account created with a password, and is described in every other section of this policy on that footing.
3. 14.3The Company's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular the Company does not transfer or sell that information to any third party, does not use it for advertising of any kind, whether targeted, personalised or retargeted, does not use it to assess creditworthiness or for any lending purpose, and does not use it to train any generalised model of artificial intelligence or machine learning. Personnel do not read it save where the data subject has asked for support, where it is necessary for security, or where the law requires it.
4. 14.4Authorisation may be withdrawn at any time from the Google account's own security settings, at myaccount.google.com. Withdrawal prevents further signing in by that route and does not of itself delete the account held by the Company, which is erased on request in the manner described above.

15.Security

1. 15.1All traffic between the data subject and the Website is encrypted in transit. A session is identified by a random token which is stored only in hashed form, so that a copy of the database does not give access to an account.
2. 15.2Access to personal data within the Company is limited to those personnel who require it for the performance of their duties.
3. 15.3The Company does not receive the card number or the security code, both of which pass from the data subject's browser to the payment provider.
4. 15.4Where a breach of personal data security occurs which is likely to cause significant harm to the data subject, the Company notifies the Personal Data Protection Service of Georgia and, where the law so requires, the data subject, within the periods established by law.

16.Children

1. 16.1The services offered on the Website are intended for persons of 18 years of age and over. The Company does not knowingly collect the personal data of a child.
2. 16.2Where the Company learns that it holds such data without the required consent, it deletes it.

17.Complaints

1. 17.1A complaint concerning the processing of personal data by the Company is to be addressed to contact@wehost.ge in the first instance.
2. 17.2The data subject is entitled at any time to apply to the Personal Data Protection Service of Georgia, and to seek judicial protection of their rights before the courts of Georgia.

18.Amendment of this policy

1. 18.1The Company may amend this policy. The version in force is the version bearing the date shown at the head of this page.
2. 18.2Where an amendment materially affects the rights of data subjects, the Company notifies those whose electronic mail address it holds in connection with a booking or a lease.