Privacy policy

1.The controller

1. 1.1შპს პრაიმჰოსტი, identification code 404541634, registered in Georgia at 13 Mtatsminda Turn, Tbilisi, Georgia and trading as Wehost, determines the purposes and means of the processing described in this policy and is therefore the data controller in respect of it.
2. 1.2All correspondence concerning personal data is to be addressed to contact@wehost.ge, or to the address above marked for the attention of the data protection contact. A request may be made in Georgian or in English.
3. 1.3The Company answers a request within the period allowed by law and informs the applicant where it needs the extension the law permits. No charge is made.

2.Definitions

1. 2.1In this policy the terms below have the meanings given, unless the context plainly requires otherwise.

• Personal data: any information relating to an identified or identifiable natural person.
• Data subject, you: the natural person to whom the personal data relates.
• Processing: any operation performed on personal data, including collection, recording, storage, use, disclosure and erasure.
• Controller, the Company, Wehost, we: შპს პრაიმჰოსტი.
• Processor: a person who processes personal data on the Company's behalf and on its instructions.
• Website: wehost.ge, together with every page and subdomain operated by the Company.
• Supervisory authority: the Personal Data Protection Service of Georgia.

3.Categories of personal data

1. 3.1The Company collects only the data required for the purpose for which it is collected. No field on the Website requests data that is not used.
2. 3.2Where data marked as required is not provided, the Company is unable to conclude or perform the contract concerned.

• Booking data: name, electronic mail address, telephone number, the apartment, the dates, the number of guests, the amount payable and any note left at checkout.
• Account data: the above, together with the language in which the Website is read. A password is stored as a cryptographic hash and is not readable by the Company.
• Correspondence data: name, electronic mail address, telephone number, the content of the message and the form through which it was sent.
• Lease request data: the above, together with the intended month of occupation, the term sought and the rent quoted.
• Owner enquiry data: name, contact details and the approximate location of the apartment offered for management.
• Payment data: the payment provider's reference, the amount, the outcome of the transaction and, at most, the brand and the last four digits of the card.
• Technical data: internet protocol address and the ordinary parameters of the request, recorded in server logs.
• Browsing data, only where the data subject has accepted the cookies of the Meta Pixel: the pages visited on the Website and the actions listed under Advertising measurement and profiling below, together with the internet protocol address and the technical parameters of the browser.

4.Sources

1. 4.1Personal data is obtained from the data subject directly, at the moment it is entered on the Website or sent to the Company.
2. 4.2Where a stay was booked through a booking platform, the Company receives the reservation data from that platform, which acts as a controller in its own right in respect of it.
3. 4.3The Company does not purchase personal data, does not acquire it from data brokers and does not enrich what it holds with data obtained elsewhere.

5.Purposes and legal grounds

1. 5.1The Company processes personal data only where a ground provided by the Law of Georgia on Personal Data Protection applies to the purpose concerned. The grounds relied upon are set out below.
2. 5.2Performance of a contract: arranging a stay or a lease from the booking through to arrival, occupation, departure and any refund.
3. 5.3A request of the data subject before the conclusion of a contract: answering an enquiry, quoting for a lease or estimating what an apartment may earn.
4. 5.4Compliance with a legal obligation: accounting, tax and other records the Company is required to keep.
5. 5.5The legitimate interests of the Company: keeping the Website available, preventing fraud and abuse, establishing and defending legal claims, and the internal administration of the business. Those interests are weighed against the rights of the data subject in each case.
6. 5.6Consent: measuring and directing the Company's advertising through the Meta Pixel, as described under Advertising measurement and profiling below, and any other purpose outside the grounds above. Consent is requested at the time and may be withdrawn at any moment without affecting the lawfulness of processing carried out beforehand.

6.Data of special category

1. 6.1The Company does not request and does not knowingly process data revealing health, racial or ethnic origin, political opinions, religious or philosophical belief, trade union membership, sexual life, or biometric or genetic data.
2. 6.2Data subjects are asked not to include such data in correspondence. Where it is received unsolicited, it is deleted unless its retention is required by law.

7.Recipients

1. 7.1Personal data is disclosed only to the recipients listed below, only to the extent required for the purpose stated, and, save for Meta as described below, only under a contract that prohibits any use of the data for the recipient's own purposes.
2. 7.2The Company does not sell personal data, does not disclose it for consideration and displays no advertising on the Website. The only disclosure made for the purposes of advertising is the one made to Meta, with consent, as described under Advertising measurement and profiling.

• Guesty: the property management system in which reservations and guest correspondence are held.
• Flitt: the payment service provider, which receives the payment data directly from the data subject's browser.
• Supabase: the provider hosting the Company's database, located in Frankfurt, Federal Republic of Germany.
• Vercel: the provider hosting the Website and holding its server logs.
• Resend: the provider delivering electronic mail sent by the Company.
• Booking platforms on which the apartment is listed, in respect of a reservation made through them.
• Personnel engaged in cleaning the apartment and in admitting the guest, who receive the name, the dates and the telephone number.
• The Company's accountants, auditors and legal advisers, under a duty of confidentiality.
• A public authority, where disclosure is required by the legislation of Georgia.
• Meta Platforms Ireland Limited, Ireland: only where the data subject has accepted the cookies of the Meta Pixel, and only the data described under Advertising measurement and profiling. Meta receives that data as a controller in its own right and uses it in accordance with its own privacy policy.

8.Transfer outside Georgia

1. 8.1The Company's database is located in the Federal Republic of Germany. Certain of the processors named above are established outside Georgia and outside the European Union. Data sent to Meta with consent is received by Meta Platforms Ireland Limited in Ireland, which may transfer it to Meta Platforms, Inc. in the United States of America.
2. 8.2A transfer is carried out only where the receiving state ensures appropriate protection of personal data, or where the contract with the recipient itself provides the safeguards required by the Law of Georgia on Personal Data Protection. The Company holds such an agreement with each processor named above.
3. 8.3Meta is not a processor of the Company, and the agreement described above is not held with it. Its transfers are made under the safeguards Meta itself maintains, described in its privacy policy, and under the terms on which the Company uses the Meta Pixel.

9.Retention

1. 9.1Personal data is retained for as long as the purpose for which it was collected requires, and thereafter for the period during which the legislation of Georgia requires the Company to keep it.
2. 9.2On expiry of the period the data is deleted or irreversibly anonymised.

• Bookings, leases and payment records: six years, in accordance with the legislation on accounting, reporting and audit.
• Account data: until the account is deleted, whether at the request of the data subject or by the Company. Deletion removes the name, the electronic mail address, the telephone number and the correspondence, and severs the account from the bookings and lease requests made through it, which remain as accounting documents without a name attached to them.
• Enquiries not resulting in a contract: two years from the last correspondence.
• Correspondence attached to a booking: for the retention period of that booking.
• Session records: thirty days, or until the data subject signs out.
• Server and system logs: thirty days. Records of a payment or of a failure are retained longer, being the records from which a subsequent dispute is answered.

10.Cookie policy

1. 10.1The Website places the cookies listed below and holds in the browser the further items listed with them. The first six are set by the Company itself, are necessary for the functioning of the service requested or record the visitor's own choice, and are placed without consent.
2. 10.2The remaining three belong to the Meta Pixel and are placed only after the data subject has accepted them in the notice shown on the first visit. Until then, and after a refusal, Meta's script is not loaded, nothing is sent to Meta and none of the three is placed. The choice may be changed at any time through Cookie settings at the foot of every page; withdrawing consent removes both Meta cookies from the Company's domain.

• wehost_session: establishes that the visitor is signed in. Thirty days, inaccessible to script.
• wehost_signed_in: records only that some account is signed in, so that the page may be drawn correctly before the server is asked. It carries no other information.
• wehost_currency: records the currency the visitor has chosen for the display of prices. One year. Set only when a currency is chosen; until then the display currency is inferred afresh on each visit from the country from which the Website is reached, and nothing is stored.
• wehost_oauth: holds for ten minutes the data required to complete a sign-in begun with Google, and secures that sign-in against interference by a third party. Set only where that route is used, and discarded as soon as the sign-in completes or expires.
• wehost_checkout_details: retains the name, the electronic mail address and the telephone number entered at checkout, so that they survive a step back through the payment. Held in the session storage of the browser rather than as a cookie, never sent to the Company by that means, and discarded when the booking is completed or the tab is closed.
• wehost_consent: records whether the visitor has accepted or refused the cookies of the Meta Pixel, so that the question is not asked on every page. One hundred and eighty days, after which it is asked again.
• _fbp: placed by Meta's script on the Company's domain, only with consent. Identifies the browser to Meta across visits to the Website. Ninety days, renewed on each visit.
• _fbc: placed by Meta's script on the Company's domain, only with consent, and only where the visitor arrived from an advertisement on Facebook or Instagram. Records that click. Ninety days.
• wehost_purchases_pending: held in the local storage of the browser, only with consent. Records the reference of a booking or lease when that browser goes to the payment page, and is cleared of it once the payment is confirmed and reported to Meta, so that each payment is reported once and only from the browser in which it was made. A reference not confirmed within one hour is disregarded and removed.

11.Advertising measurement and profiling

1. 11.1The Website operates no analytics. With the consent of the data subject, and only then, it operates the Meta Pixel, a technology provided by Meta Platforms Ireland Limited, so that the Company can measure the effect of its advertising on Facebook and Instagram and show that advertising to persons who have visited the Website.
2. 11.2Typefaces are served from the Company's own domain and map tiles are proxied through its own server, so that no third party other than Meta, and Meta only with consent, learns of a visit to the Website.
3. 11.3The Company takes no decision producing legal effects concerning the data subject, or similarly significantly affecting the data subject, based solely on automated processing. Save for the advertising audiences that Meta assembles, with consent, from the events described in this section, the Company carries out no profiling.
4. 11.4Where consent is given, the browser sends to Meta the address of each page visited, the internet protocol address, the technical parameters of the browser, the cookies listed above and the following events: a search; the viewing of an apartment, of the owner pages or of the pricing page; the saving of an apartment; the creation of an account; the start of a booking or of a lease request; the step to payment; a booking or a lease paid, with its reference, the apartment and the amount; the use of the earnings estimate; an owner enquiry; and a message sent through the Website, or a telephone call or electronic mail begun from it.
5. 11.5On the creation of an account with a password and on the sending of an owner enquiry, the electronic mail address, the telephone number and the name entered are also sent, and on the step to payment the telephone number entered, each reduced in the browser to a one way cryptographic hash, so that Meta can match the event to an account it holds. Data received from Google on signing in with Google is never sent.
6. 11.6No page reached through a personal link, such as a lease offer or a stay extension, is reported to Meta, and nothing is reported from the Company's administration.
7. 11.7The Company and Meta are jointly responsible for the collection of that data on the Website and its transmission to Meta. Meta processes it thereafter as a controller in its own right, in accordance with its privacy policy at facebook.com/privacy/policy, and may combine it with what it already holds about a person who uses its services. Where the browser permits, Meta may also read the cookies it holds on its own domains.
8. 11.8Consent may be withdrawn at any time through Cookie settings at the foot of every page. Withdrawal stops any further transmission at once and removes the Meta cookies from the Company's domain. It does not affect what was sent before.

12.Direct marketing

1. 12.1The Company sends no marketing communication. Electronic mail sent to a guest relates to a booking, a lease or an enquiry and is sent in performance of the contract.
2. 12.2Should the Company introduce marketing communication, it will be sent only with the prior consent of the data subject, and the consent may be withdrawn at any time by writing to contact@wehost.ge or by the means indicated in the communication itself. Processing for the purposes of direct marketing ceases within the period established by law.

13.Rights of the data subject

1. 13.1The data subject holds the rights set out below in respect of data concerning them, and may exercise any of them by writing to contact@wehost.ge, preferably from the electronic mail address held by the Company.
2. 13.2The Company may request such information as is reasonably necessary to establish the identity of the applicant, and no more.
3. 13.3Erasure may also be requested from within the account itself, under Profile, without writing to anybody. The request is recorded at once and is actioned by a member of the Company's personnel. It may be withdrawn at any time before it is actioned.
4. 13.4A request for erasure is refused for so long as the account holds a stay which has not ended or a tenancy for which rent has been paid, those records being required for the performance of the contract and for the purposes of accounting. The applicant is told so at the moment of asking, together with what is outstanding.
5. 13.5Where a request is refused in whole or in part, the Company states the ground of refusal and informs the applicant of the right to apply to the Personal Data Protection Service of Georgia or to a court.

• To be informed what data is processed, for what purpose, on what ground, from what source it was obtained and to whom it has been disclosed.
• To obtain a copy of the data.
• To have inaccurate or incomplete data corrected or completed.
• To have the data erased where it is no longer required and its retention is not required by law.
• To have the processing blocked while the accuracy or the lawfulness of the processing is in dispute.
• To receive the data in a structured, commonly used format and to transmit it to another controller.
• To withdraw consent where consent is the ground relied upon.
• To object to processing carried out on the ground of the Company's legitimate interests.

14.Signing in with Google

1. 14.1Where the data subject chooses to sign in with a Google account, Google transmits to the Company the electronic mail address of that account, the name held on it, the account identifier and, where one is set, the picture. No password is transmitted and the Company never holds one.
2. 14.2That data is used for one purpose: to create or identify the account, to sign the data subject in, and to address correspondence concerning a booking. It is held on the same terms as the data of an account created with a password, and is described in every other section of this policy on that footing.
3. 14.3The Company's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular the Company does not transfer or sell that information to any third party, does not use it for advertising of any kind, whether targeted, personalised or retargeted, does not use it to assess creditworthiness or for any lending purpose, and does not use it to train any generalised model of artificial intelligence or machine learning. Personnel do not read it save where the data subject has asked for support, where it is necessary for security, or where the law requires it.
4. 14.4Authorisation may be withdrawn at any time from the Google account's own security settings, at myaccount.google.com. Withdrawal prevents further signing in by that route and does not of itself delete the account held by the Company, which is erased on request in the manner described above.

15.Security

1. 15.1All traffic between the data subject and the Website is encrypted in transit. A session is identified by a random token which is stored only in hashed form, so that a copy of the database does not give access to an account.
2. 15.2Access to personal data within the Company is limited to those personnel who require it for the performance of their duties.
3. 15.3The Company does not receive the card number or the security code, both of which pass from the data subject's browser to the payment provider.
4. 15.4Where a breach of personal data security occurs which is likely to cause significant harm to the data subject, the Company notifies the Personal Data Protection Service of Georgia and, where the law so requires, the data subject, within the periods established by law.

16.Children

1. 16.1The services offered on the Website are intended for persons of 18 years of age and over. The Company does not knowingly collect the personal data of a child.
2. 16.2Where the Company learns that it holds such data without the required consent, it deletes it.

17.Complaints

1. 17.1A complaint concerning the processing of personal data by the Company is to be addressed to contact@wehost.ge in the first instance.
2. 17.2The data subject is entitled at any time to apply to the Personal Data Protection Service of Georgia, and to seek judicial protection of their rights before the courts of Georgia.

18.Amendment of this policy

1. 18.1The Company may amend this policy. The version in force is the version bearing the date shown at the head of this page.
2. 18.2Where an amendment materially affects the rights of data subjects, the Company notifies those whose electronic mail address it holds in connection with a booking or a lease.