Privacy Policy

This policy explains how Detailing Mall LLC processes personal data when you visit bestauto.ge, contact BESTAUTO Detailing and receive services at the studio at 78 Guramishvili Avenue, Tbilisi. The policy is a notice about data processing. Its publication, reading it or contacting the studio do not in themselves mean consent to advertising or to any other actions for which the law requires separate consent.

1 Controller and contacts

The controller responsible for the processing of data is Detailing Mall LLC, identification number 405710798, legal address: 20 Anna Politkovskaya Street, Tbilisi, Georgia. In this policy it is referred to as “we”, “the studio” or BESTAUTO.

Requests concerning personal data: [email protected]; phone and WhatsApp +995 550 000 299. You can also contact us in person at the studio at 78 Guramishvili Avenue, Monday to Saturday, 10:00 to 20:00 Tbilisi time.

The provisions on services and on the request management system apply to the studio on Guramishvili Avenue. The processing of data of visitors to the shared website bestauto.ge is also described here. Services at the studio on Politkovskaya Street are not covered by this policy.

2 What data is processed

The main source of data is you: messages in WhatsApp, Instagram and Facebook, phone calls, Meta lead forms, visits, reviews and quality-related requests. The platform you use also transfers the information available to it about your profile, the channel and the time of your request. Our database may contain requests you left earlier and your service history, including information from the former website form and Google Sheets.

Contacts and communications. Name, phone number, account name and identifier, language of communication, text of correspondence, photos, voice messages and other attachments you provide; date and content of your request, ratings and comments.

Car and order. Make, model and year of the car, services of interest and services performed, agreed price, history of bookings, visits, cancellations and payments. The registration plate may be visible in a photo or video recording you provide.

Telephony and cameras. Number, time, duration and outcome of a call, voicemail message; images of people and cars, the time and circumstances of presence in the area under video surveillance.

Website and advertising. IP address, information about the device and browser, pages and actions on the website, time of visit, cookies, advertising identifiers and click tags, for example UTM, gclid and fbclid. A short code in a WhatsApp message may link your request to a website visit or to an advertisement.

Record-keeping data. Source of the request, progress of the request, internal notes and tasks, information on consents and refusals, operation and security logs. Evaluative notes reflect an employee’s working assessment, not an established fact about a person.

To answer you and to process an order, we only need the information relevant to it: a contact for communication and details of the car and the service. Without the necessary information we may be unable to fulfil a particular request or confirm a booking. You can receive a general consultation without providing excessive data. Consent to advertising is not a condition of service.

Please do not send unnecessary information about other people, payment secrets or special categories of data, such as data on health or beliefs. If you are contacting us on behalf of another person, please tell us; we may clarify your authority and the necessary scope of information. This does not release us from our own data protection obligations.

3 Purposes and legal grounds for processing

Processing is carried out under the Law of Georgia “On Personal Data Protection”. Data is used to the extent necessary for the relevant purpose:

Request and contract. To answer a question, calculate a price, agree a booking, perform the work and warranty obligations, and inform you that the car is ready — handling your request and preparing and performing a contract under Article 5(1)(b) and (j).

Mandatory record-keeping. To document transactions, keep accounting and tax records and comply with a lawful request of a competent authority — performance of obligations established by law under Article 5(1)(c) and (d).

Quality, security and protection of rights. To handle a complaint, confirm arrangements, review the service, obtain neutral feedback on the work performed and protect people, cars and systems — important legitimate interests under Article 5(1)(i), subject to the special rules on surveillance. Reliance on this ground requires justification of necessity and proportionality and the absence of an overriding interest in the protection of your rights. It does not replace consent to direct marketing.

Marketing and advertising profiling. To offer services, select personalised offers and build advertising audiences — the relevant informed consent. Its scope is defined by the text to which you agreed. Evidence of consent and refusal is kept to meet the requirements of the law. Limited evaluation of advertising effectiveness is addressed separately under the conditions of Section 5.

The transfer of materials to an external AI for additional analysis is governed by Section 6. The requirements of Section 8 additionally apply to transfers abroad. One legal ground for processing does not automatically permit any other purposes.

4 Communication about orders and advertising messages

Following your request we may answer you, call you back after a missed call, agree the terms, confirm a booking, remind you of a visit, clarify a no-show and inform you of changes or that your car is ready. No separate consent to advertising is required for communication about a current order, its performance, the warranty or your complaint. This also applies to personal calls to regular customers on these matters. The content and duration of communication are limited by the relevant obligation or the current request; a completed service does not in itself permit new advertising contacts.

For order-related messages in WhatsApp we take into account the channel you have chosen: you wrote to us yourself, asked us to send information there or allowed this method of communication when booking. Another available channel can be agreed. Permission for service messages does not mean consent to advertising.

After the work is done we may send a neutral feedback request to identify shortcomings and review the quality of the particular service. The legal ground is the important legitimate interest in quality control, subject to the conditions of Article 5(1)(i); separate advertising consent is not used for such a request. It must not contain offers of new services, discounts, invitations to come back or requests to publicly promote the studio. You can opt out of further feedback requests using the contacts in Section 1. A request to post a public review, for example on Google, is not covered by this internal quality control regime.

Promotions, seasonal offers, invitations to come back and calls offering a new paid service are marketing and require prior consent. Regular-customer status and the fact that a manager is calling do not change this rule. A request for a public review aimed at promoting or supporting the studio’s image is subject to the direct marketing regime; the legitimate interest in internal quality review does not replace it.

Personal selection of offers based on your car, chosen services and visit history requires written, including electronic, consent that expressly covers this information. Selection may involve profiling of interest in services. We do not make decisions based solely on automated processing that have legal or similarly significant effects on a customer.

Uploading contacts to Meta or Google for matching with accounts and showing advertising is permitted only if consent expressly covers this purpose and these recipients. Consent only to offers in WhatsApp does not cover it. Hashing a phone number does not in itself make it anonymous data.

Consent is expressed by an active action, for example by answering a specific question in the conversation or by ticking an optional box in a form. Silence, a pre-ticked box, providing a phone number and a previous visit do not replace it. An advertising call is possible only within consent that covers this channel.

You can opt out free of charge and without giving reasons: write STOP, СТОП or სტოპ, use the opt-out method offered, tell a manager or contact us using the details in Section 1. Instructions for opting out are provided with direct marketing. Processing for the relevant direct marketing stops within a reasonable time, no later than 7 working days after the refusal is received. Necessary messages about a current order do not depend on advertising consent.

5 Website, cookies and evaluation of advertising

Google Analytics, Google Ads, Meta Pixel, Yandex Metrica, TOP.GE and Cloudflare Web Analytics are connected on bestauto.ge. They receive technical information about visits and interaction with the pages. Metrica uses the Webvisor feature, which makes it possible to replay actions on a page, including scrolling and interaction with elements.

Technical processing to provide and protect the website relies on the legitimate interest in its availability and security. Optional advertising technologies, profiling and related identifiers are subject to the relevant consent. Limited evaluation of the effectiveness of requests is addressed separately below and does not mean a general permission to track visitors. Visiting the website does not in itself constitute consent.

To assess which sources lead to requests, bookings and payments, we match internal events with the source of the request. A possible legal ground for limited evaluation of advertising effectiveness is the studio’s important legitimate interest in reviewing the effectiveness of advertising spend under Article 5(1)(i), provided that the necessity and proportionality of the processing are justified and there is no overriding interest in protecting the customer’s rights. Separate consent is not a mandatory legal ground for this narrow purpose when these conditions are met.

The evaluation may use booking and payment events transferred to Meta through the Conversions API for requests from WhatsApp, Instagram and Messenger, with identifiers for matching. The text of correspondence and the payment amount are not included in the events described for Meta. Events that can be linked to a person remain personal data. Whether legitimate interest applies to their transfer must be assessed taking into account the actual settings, Meta’s terms, its further use of the data and the requirements for transfers abroad.

Reliance on legitimate interest for evaluating effectiveness does not cover the creation of advertising audiences, personalisation or optimisation of targeted ad delivery, or other actions that constitute direct marketing: consent under Article 12 applies to them. If the processing by the recipient cannot be limited to a permissible analytical purpose, this ground cannot be used as permission to transfer events without consent. Similar restrictions apply to Google events. A server-side method of transfer does not in itself remove the requirement for a legal ground.

To opt out of optional analytics or withdraw consent, contact us using the details in Section 1. You can also delete or restrict cookies in your browser. This may affect some website functions and does not replace withdrawal of consent to the transfer of server-side events. Consent to newsletters does not substitute consent to website analytics.

The website has no active stand-alone request form: requests are made by going to WhatsApp or by phone. When you go to a website or app of a third-party platform, its own data processing rules also apply.

6 Voicemail, video surveillance and analysis of requests

If a call is not answered, you can leave a voicemail message after the recording notice. It is needed to handle your request and call you back; it is stored by Zadarma and may be delivered to the studio’s Gmail. If you do not want to leave a recording, you can use a written channel or call later. The existence of this policy does not in itself replace the notice of audio recording.

Video surveillance is carried out at the studio at 78 Guramishvili Avenue for the safety of people, the protection of cars and property and the investigation of incidents. Visitors, employees, cars and their registration plates may be captured. Ordinary recordings are stored at the studio for 7 calendar days, without uploading to the cloud. The cameras do not record audio. A fragment relating to a specific incident or a justified request may be extracted and kept for the period necessary to handle it and to protect rights.

Video surveillance must be indicated by warning signs with the name and contact details of the controller. Access is granted to authorised persons for the stated purposes in accordance with the law. To locate a fragment, please indicate the approximate date, time and place; a copy is provided taking into account the rights of other people. If a fragment needs to be preserved, please let us know, where possible, before the ordinary retention period expires.

Employees may review correspondence to answer you, for quality control and to handle complaints. Anthropic (Claude) may be engaged for the same limited purposes: identifying the topics of requests, finding unanswered questions, preparing internal summaries and checking the quality of answers. The legal ground may be the studio’s important legitimate interest under Article 5(1)(i), if the analysis is necessary and proportionate, meets the customer’s reasonable expectations and the customer’s rights do not override it. When these conditions are met, separate consent specifically to internal quality analysis is not required.

This regime provides for the minimum necessary sample and amount of text; direct identifiers are excluded unless they are needed for a particular review. Special categories of data are not covered by legitimate interest alone. Before transfer, the applicable terms of processing, confidentiality, storage, deletion and restriction of the provider’s use of the materials, including for model training, are checked. The use of customer materials for the provider’s own model training is not permitted on the ground of the studio’s internal quality control alone.

Processing on behalf of the studio requires the written terms provided for in Article 36. Whether such terms apply depends on the specific product and account; the name Claude alone does not confirm that they exist. Legitimate interest under Article 5 is not in itself a ground for transfer abroad: Articles 37 and 38 and the conditions of Section 8 must also be complied with. If these conditions are not ensured, the regime without separate consent does not apply to the transfer of identifiable materials.

Masking names and phone numbers does not guarantee anonymity if a person can be identified from the context or linked to a customer record. The result of automated analysis may contain errors and must be checked by an employee before it is used in working with a customer. Quality control does not permit the use of materials for direct marketing without the relevant consent.

This edition does not introduce the recording of all phone conversations, regular automated transcription or daily analysis of correspondence by a new provider. Before such processing is introduced, additional information about the purposes, data and recipients will be provided; consent will be requested where it is the necessary legal ground.

7 Who receives the data

We do not sell personal data. Access within the studio is determined by work tasks. The following services and categories of recipients are used for processing, to the extent necessary for the relevant purpose.

The list does not mean that every service receives all data of every customer. Processors acting on behalf of the studio must act on the basis of written terms and instructions provided for by law. Platforms may also act as independent controllers with respect to their own purposes. Their rules do not remove our obligations for the processing and transfers that we determine.

If a request concerns another studio, we may give you its contacts. The request itself is passed on to that studio’s employees at your request or with your permission, to the extent necessary.

8 International processing of data

The use of foreign services involves processing outside Georgia, including storage and remote access. Depending on the provider, its contracting company and its infrastructure, processing may involve the USA, EU countries and the United Kingdom; record-keeping services and international groups may also be connected with Kazakhstan, Russia, the UAE and the British Virgin Islands. The country where a company is registered does not necessarily coincide with the country of the server or of access.

Articles 37 and 38 of the Law of Georgia “On Personal Data Protection” apply to international transfers. A transfer to a country recognised by Georgia as providing adequate safeguards does not remove the other processing requirements. For a country outside this list, another ground provided for by law is required. Contractual safeguards under Article 37(2)(b) require prior permission of the State Audit Office of Georgia. This policy is not such a permission and does not claim that it has been obtained.

If written consent under Article 37(2)(d) is used, before it is obtained you are separately informed of the specific recipient, the country, the absence of appropriate safeguards and the possible risks, including difficulties in protecting your rights, access by foreign authorities and onward transfer. General acceptance of the policy, use of a messenger and consent to advertising do not replace such consent. Information about specific recipients, purposes and applicable safeguards can be requested using the contacts in Section 1.

9 How long data is kept

Data is kept no longer than necessary for its lawful purpose. Where a single predetermined period is not applicable, we take into account the completion of the request or order, the warranty period, the need to comply with legal obligations and the existence of a specific dispute or a justified need for evidence. The technical possibility of storing data is not in itself a ground.

Requests, correspondence and records. For the period of handling the request and providing the service; after completion — to the extent necessary for the warranty, mandatory record-keeping and the justified protection of rights. Irrelevant correspondence and duplicates are not kept merely because of a possible future interest in services.

Audio and quality review materials. For the period necessary to handle the relevant request, review the identified situation and, if there is a dispute, preserve the evidence relating to it. Determining necessity does not require keeping the entire body of conversations or correspondence.

Video. Ordinary recordings — 7 calendar days. Extracted fragments — for the time necessary to handle the specific incident or protect rights.

Accounting documents. 6 years after the end of the relevant reporting period, except for special cases under the law. This does not mean that all correspondence and the advertising profile are automatically kept for the same period.

Marketing consents and refusals. For the duration of the relevant direct marketing and 1 year after it ends. A minimal record of a refusal may be kept for as long as necessary to avoid unwanted repeated contacts.

Technical data and backups. For the period necessary for security, recovery and confirmation of operations, taking into account the settings of the service used. For analytics, its specific task, the event matching period and the applicable legal ground are taken into account. Withdrawal of consent and a fulfilled deletion request are also taken into account when restoring copies.

When the relevant ground ends, data is deleted, destroyed or anonymised in the manner provided for by law. Deletion may not extend to the part of the information that must be kept on another legal ground; its use is limited to that purpose. Withdrawal of advertising consent does not require the deletion of mandatory order documents.

Anonymised statistics may be kept longer if it is impossible to establish a link with a person or doing so would require disproportionate effort, cost or time. An internal identifier or hash that preserves the link with a record does not in itself meet this condition. Your own copies of correspondence and platform accounts are also governed by the rules of those platforms.

10 Protection and limits of processing

Organisational and technical measures proportionate to the nature of the processing and the risks are applied to protect data: access restriction, account management, protection of work systems and materials. Specific measures depend on the system and the available means of protection. No method of storage or transfer eliminates all risks; this does not release us from our obligations regarding security and incident response.

We do not request excessive data to verify a request and do not publish identifiable correspondence, photos or videos of customers for advertising purposes without a proper legal ground. This policy is not a permission for such publication. In the event of an incident, the procedures provided for by law for notifying the supervisory authority and the persons concerned apply.

11 Your rights and how to exercise them

In the cases provided for by law, you have the right to receive information about the processing and its sources, recipients and safeguards, and access to and a copy of your data; to request rectification, completion, termination of processing, deletion or blocking; to withdraw consent and learn the consequences; to receive the data you provided in a machine-readable format or have it transferred to another controller where the conditions for portability are met; to be protected from decisions based solely on automated processing that have significant effects; and to lodge a complaint.

Send your request using the contacts in Section 1. To avoid disclosing information to an unauthorised person, we may ask for proportionate confirmation of your identity and clarification of the scope of the request. When providing information, the rights of other persons and secrets protected by law are taken into account; this is not a ground for arbitrary refusal.

Information and access with a copy are provided within 10 working days at the latest. In special justified cases these periods may be extended by no more than another 10 working days, with immediate notice. Rectification, termination of processing or deletion, or a reasoned refusal — within 10 working days at the latest, unless the law provides otherwise. Blocking or a refusal is communicated without delay, no later than 3 working days after the request.

When consent is withdrawn, a period of no more than 10 working days applies if there is no other ground for processing; for direct marketing — no more than 7 working days. Processing carried out lawfully before withdrawal remains lawful. Data portability is subject to the conditions of the law and technical feasibility.

Exercising your rights is free of charge, except for exceptions expressly provided for by law, including a permissible reasonable fee for certain requests for copies. The fee does not exceed the actual costs and is communicated in advance. Restrictions of rights and refusals are permitted only on an applicable legal ground, with an explanation and information on how to appeal. You may object to processing based on legitimate interest and request its termination or blocking in the cases provided for by law; we consider the request taking into account its circumstances and are obliged to justify any further storage or use of the data.

You may apply to the State Audit Office of Georgia or to a court. Contacts of the State Audit Office: [email protected], website sao.ge; address: 96 Saint Queen Ketevan Avenue, Tbilisi 0144, Georgia. Contacting us first is not a mandatory precondition for a complaint.

12 Minors and policy updates

The studio’s services are not directed at children. If processing is based on consent and the person is under 16, the requirements for consent of a parent or legal representative and for verification of their authority apply. The interests of a minor are taken into account in any processing.

A new edition is published on bestauto.ge with its date. For a new purpose or a significant change in processing, the necessary information is provided and, where required, new consent is requested. Changes to the policy do not have retroactive effect for obtaining consent. The policy does not limit the rights guaranteed by the legislation of Georgia; its provisions apply subject to the mandatory rules of the law.