Privacy policy

This policy describes what personal data b2service.ge processes, for what purposes and on what legal basis, to whom it is disclosed, how long it is kept and what rights you have.

1. Controller

The controller of your data is Individual Entrepreneur Vazha Urmishvili (identification code 20001068135), address: 16, 12th Street, Kondoli village, Telavi Municipality, Georgia. For any matter related to personal data, write to hello@b2service.ge or call +995 557 66 70 50.

We process data in accordance with the Law of Georgia on Personal Data Protection.

2. What data we process

2.1. Account

  • first name, last name, email, phone;
  • password — stored only in hashed form, never in plain text;
  • when signing in with Google — the email, name and account identifier provided by Google (we cannot see your Google password);
  • addresses added to your profile (name, phone, city, street, postal code);
  • preferred language (Georgian / English);
  • consents and their times: terms and conditions, changed policies, marketing emails, cookies.

2.2. Orders and payment

  • products ordered, amounts, discounts and the coupon used;
  • customer type; for a company — company name, identification code, email, phone;
  • contact person and phone;
  • for on-site services — the address, entrance / floor / apartment, the coordinates of the place you mark on the map, the scheduled time, your comment, and when the service started and finished; used only for the visit and for keeping records of the service;
  • payment method and status, invoices;
  • for card payments — the payment status and transaction identifier provided by the bank. We cannot see or store your card number, expiry date or CVV — you enter them only on the bank's secure page;
  • the time you confirmed the waiver of the right of withdrawal for digital products;
  • license codes issued to you.

2.3. Requests and communication

  • the content of product request forms and attached documents;
  • corporate offer data: company, contact person, chosen package, reason for declining, time the offer was viewed;
  • product reviews: stars, title, text and date. Only your first name and the initial of your last name (e.g. "George T.") are shown publicly on the site.
  • our correspondence by email and phone.

2.4. Technical data

  • IP address — to limit sign-in, registration and password reset attempts (protection against password guessing). It is kept briefly in the server's memory and is not linked to your profile;
  • session and last activity time — for automatic sign-out after inactivity;
  • server technical logs to detect errors;
  • strictly necessary cookies (see the cookie policy);
  • the fact that you clicked a button in a marketing email (campaign statistics);
  • website visit statistics — the page opened, where you came from (e.g. Google, Facebook, our email), the device type, browser, operating system and time. We use no cookie for this and do not store your IP address: within one day a visitor is counted by an anonymous code that changes every day and is not linked to your account. Kept for 13 months.

We do not use third-party analytics or advertising tracking tools (e.g. Google Analytics, Facebook Pixel) on the website — visit statistics are counted on our own server and not shared with anyone.

2.5. Sources

Most data is provided by you. In addition we receive: from Google — when you sign in with Google; from the Revenue Service (RS.ge) — a company's name by its identification code, for automatic filling; from the bank — the payment status.

3. Purposes and legal basis

  • Creating and managing your account, performing orders (payment, invoice, license delivery, services, support) — conclusion and performance of the contract.
  • Accounting, taxes, tax invoices on RS.ge — legal obligation.
  • Security: fraud prevention, limiting sign-in attempts, blocking accounts, logs — our and our customers' legitimate interest.
  • Service emails (codes, order, invoice, license ready, reply to a request, terms confirmation link) — performance of the contract.
  • Marketing emails and personal coupons — only your consent. Without consent you will not receive marketing emails.
  • Product reviews — publishing a review is your request (you send it yourself and can edit it; it is deleted with your account). About a week after an order we send one email asking for a review — our legitimate interest.
  • Website visit statistics (how many people visit, when, which pages they see) — improving the website and our offers, our legitimate interest; the data is anonymous.
  • Reminders — 30 and 7 days before a license expires (with a renewal link) and about an unpaid invoice (before and after its due date) — performing the contract and our legitimate interest; "Notify me when available" — one email when the product is back in stock (your request; we keep the product and your email); one reminder about products left in your cart — only if you agreed to marketing emails.
  • Replying to requests and complaints — your request and our legitimate interest.

We do not sell data and do not use it for automated decisions that produce legal effects for you.

4. Who receives the data

We disclose data only to the extent needed for a specific purpose:

  • Hetzner Online GmbH — server hosting; the server is located in Finland (EU). The website database, files and backups are stored here.
  • Brevo (France) — sending emails (codes, invoices, notifications, marketing emails with consent).
  • Google — sign-in with Google and our business email (Google Workspace), from which we reply to your messages; Google Maps — when you mark the service address on the map (the map loads from Google's servers, which see your IP address; we store the place you mark).
  • JSC Bank of Georgia — processing card, mobile banking, points and installment payments and refunds; bank transfers. JSC TBC Bank — processing card payments, installments and refunds; bank transfers to our account.
  • Flitt — TBC Bank's online payments partner: the secure page for TBC card payments and installments and processing of the payment (the order identifier and amount; you enter your card details only on Flitt's page).
  • Revenue Service (RS.ge) — VAT tax invoices for company orders (company identification code, products, amount) and looking up a company's name by its code.
  • Public authorities — only where provided by law (e.g. a lawful request of a court or investigative body).
  • Our staff — with access only to the data their role requires (e.g. the accountant to financial data); staff actions are recorded in an activity log.

4.1. Transfers abroad

Hetzner's and Brevo's servers are in the European Union, where the General Data Protection Regulation (GDPR) applies. Google may process data in other countries as well, including the USA, under its contractual safeguards. Transfers abroad are made in the manner prescribed by law and only for the purposes described above.

5. Retention

  • Account — kept until you delete it. After deletion, the profile and sign-in data are erased.
  • Email of a deleted account — kept for 3 days to prevent re-registration with the same email during that period.
  • Orders, invoices and accounting records — kept for the period required by tax and accounting law, also after an account is deleted.
  • Product requests and attached files — kept while the matter is relevant, and then no longer than 3 years.
  • One-time codes (email confirmation, password reset) — valid for 10–15 minutes and stored only in hashed form.
  • Backups — kept for 14 days.
  • Record of marketing consent — kept for 3 years after consent is withdrawn, to prove that emails were sent with consent.

6. Security

  • all data transfer on the website is encrypted (HTTPS);
  • passwords and one-time codes are stored only in hashed form;
  • server access is protected by keys, a firewall and automatic security updates;
  • the database and private files (request documents) are not publicly accessible;
  • staff access is limited by role;
  • license codes, passwords and one-time codes are not written to technical logs.

In the event of an incident posing a significant risk to your rights, we will notify the Personal Data Protection Service within the period set by law and, where required, you.

7. Your rights

Under the law you have the right to:

  • know whether we process your data and receive a copy of it;
  • request correction of inaccurate or incomplete data (you can change your main details yourself on the profile page);
  • request erasure of data or termination of processing (you can delete your account yourself from the profile), except data we are required by law to keep;
  • request restriction of processing;
  • request your data in a structured, machine-readable format;
  • withdraw consent at any time (e.g. for marketing emails). Withdrawal does not affect processing carried out before it;
  • complain to the Personal Data Protection Service (pdps.ge) or a court.

Send your request to hello@b2service.ge from your account email. We may ask you to confirm your identity. We reply within the period set by law — no later than 10 working days. In special cases the period may be extended by no more than 10 working days, and we will notify you immediately. Unsubscribing from marketing emails takes effect immediately.

8. Minors

The website is intended for persons aged 18 or over. We do not knowingly collect data of minors; if we find such data, we delete it.

9. Changes

The new version of this policy is published on this page. For material changes, signed-in customers will see a notice on the website and must accept it again.

← Back to home