Confidentiality Policy

Your privacy

This policy explains how Aneta Concept collects, uses, stores and protects your personal data when you visit anetaconcept.com, place an order or contact us. We process personal data in line with the Law of Georgia on Personal Data Protection and, where it applies to you, the EU General Data Protection Regulation (GDPR).

Who is responsible for your data

The data controller is Ani Kemkhadze, individual entrepreneur registered in Georgia (identification number 01001088321), trading as Aneta Concept.
Address: Arnold Chikobava 33, Tbilisi, Georgia
Email: conceptaneta@gmail.com

What data we collect

• Order details: your name, email address, phone number, delivery address (street, city, region, postal code, country), order notes, the items you order, prices, currency and the payment method you choose.
• Payment status: whether a payment succeeded, failed or was refunded, and the bank's payment reference. We never receive or store your card number or security code — they are entered directly on the bank's secure payment page.
• Messages you send us by email, phone or Instagram.
• Technical data: your IP address and approximate country, used to show prices in your currency and to protect the shop against abuse.
• Visit statistics, only if you accept them: the page you viewed, the website you came from (without any query details), your device type (mobile, tablet or desktop) and country. We do not use advertising or third-party tracking cookies.

Why we use your data and our legal basis

• To take, process and deliver your order, handle returns and communicate with you about it — necessary to perform our contract with you.
• To keep accounting and tax records of completed sales — necessary to comply with our legal obligations.
• To prevent fraud and abuse of the shop (for example, limits on repeated orders) and to keep the website secure — our legitimate interest in running a safe shop.
• To answer your questions — our legitimate interest in responding to you, or to take steps at your request before an order.
• To produce visit statistics — only with your consent, which you can withdraw at any time.

We do not sell your personal data, and we do not use it for automated decision-making or profiling that has legal or similarly significant effects on you. We do not send marketing emails.

Who we share your data with

We share only what each party needs to provide its service to us:

• Bank of Georgia and TBC Bank (through its payment partner Flitt), to process card payments.
• Courier and postal services, to deliver your order (name, phone and delivery address).
• Lovable, which hosts our website and sends our order emails.
• Supabase, which provides our database and file storage.
• Public authorities, only where the law requires it.

Some of these providers may store or process data on servers outside Georgia. Where this happens, we use providers that apply appropriate safeguards for international transfers.

How long we keep your data

• Paid orders and pay-on-pickup orders: 1 year from the order date. After that, your personal details are anonymised; we keep only the order number, items, amounts, city and country for our accounts.
• Unpaid card orders are cancelled automatically after 2 hours. Personal details in failed or cancelled card orders are anonymised after 90 days; we keep only the order number, items, amounts, city and country.
• IP addresses used for abuse protection: deleted automatically within 1 day.
• Visit statistics: kept for up to 13 months, then deleted.
• Emails and messages: kept as long as needed to deal with your request.

Your rights

You have the right to:

• ask for access to your personal data and receive a copy;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data, or to restrict its use, where the law allows;
• object to processing based on our legitimate interests;
• receive the data you gave us in a portable format;
• withdraw your consent to visit statistics at any time, without affecting processing that happened before.

To use any of these rights, email conceptaneta@gmail.com. We will reply within the time required by law. We may need to confirm your identity first, for example by asking you to write from the email address used for your order. Some data, such as records of paid orders, must be kept for the period required by law even if you ask us to delete it.

If you think we have handled your data unlawfully, you can complain to the Personal Data Protection Service of Georgia (pdps.ge). If you live in the European Union or European Economic Area, you can also complain to the data protection authority in your country.

Cookies and storage

Essential browser storage keeps your shopping bag, your currency choice and your cookie choice working. The website cannot work without it, so it is always on.

With your permission, we also record visit statistics as described above. No statistics are recorded before you choose, and rejecting them never affects your shopping. You can change your choice at any time using the Cookie settings link at the bottom of every page.

Our website loads its fonts from our own server and does not load third-party advertising or tracking scripts.

Security

Our website uses encrypted connections (HTTPS). Access to customer data is limited to the people who need it to fulfil orders and is protected by password. Card payments take place on the banks' own secure pages.

Children

Our shop is not intended for children under 16, and we do not knowingly collect their personal data.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. If the changes are significant, we will ask for your cookie choice again.

Contact us

For any question about this policy or your personal data, email conceptaneta@gmail.com or write to us at Arnold Chikobava 33, Tbilisi, Georgia.