Personal data protection policy
This policy explains how Enex Solutions LLC (enex.ge) collects, uses, stores and protects your personal data, in accordance with the Law of Georgia "On Personal Data Protection" (14.06.2023, No. 3144-XIმს-Xმპ).
This is a translation for convenience. In case of any discrepancy, the Georgian version prevails.
1. General provisions
1.1. Controller. The controller of your data is Enex Solutions LLC (შპს „ინექს სოლუშენს“), ID code 405646038, legal address: 63a Shermadini St., Dighomi village, Saburtalo district, Tbilisi, Georgia (hereinafter "the Company", "we"). The Company sells online through the website enex.ge (hereinafter "the Website").
1.2. Scope. This policy applies to every visitor of the Website, every registered user, everyone who places an order, and any natural person who contacts the Company through other channels (phone, email, social media). By using the Website you confirm that you have read this policy.
1.3. Key terms (in accordance with Article 3 of the Law):
- Personal data – any information relating to an identified or identifiable natural person.
- Data subject – the natural person whose data is processed (you).
- Processing – any operation performed on data: collection, recording, storage, alteration, use, disclosure, erasure, etc.
- Consent – a freely given and clear expression of will, by active action, after receiving appropriate information.
- Processor – a person who processes data on behalf of and on the instructions of the Company (e.g. a hosting or courier company).
- Direct marketing – sending advertising directly by phone, email, SMS or other means.
- Incident – a security breach leading to the unlawful or accidental damage, loss, alteration or disclosure of data.
2. What data we process
We process only the data necessary to provide the service. We do not collect special categories of data (health, religion, biometrics, etc.).
| Category | Data | Source |
|---|---|---|
| Registration data | First name, last name, mobile phone number, email, password (stored encrypted) | From you, via the registration form |
| Order and delivery data | Delivery address, recipient's name and phone, products purchased, amount, order history | From you, when placing an order |
| Payment data | Payment status and transaction number. Card data is processed by JSC Bank of Georgia or JSC TBC Bank (payment platform Flitt); the Company neither receives nor stores it | From the bank you paid through |
| Communication data | Correspondence with customer support, complaints and return requests. Phone calls are not recorded | From you |
| Technical data | IP address, browser and device type, date and time of visit, essential cookies | Automatically, when you use the Website |
If you place an order for someone else (e.g. as a gift) and provide the recipient's details, you confirm that you have that person's consent to share their data with us.
3. Purposes and legal grounds
Each purpose has a legal ground under Article 5 of the Law. We do not use data for purposes incompatible with the original purpose.
| Purpose | Legal ground |
|---|---|
| Creating and managing a user account, authorisation | Concluding and performing a contract |
| Processing orders, payment, delivery, returns and exchanges | Performing a contract |
| Contacting you to confirm an order or clarify delivery | Performing a contract |
| Handling customer requests and complaints | Performing a contract; obligation under consumer protection law |
| Tax and accounting records, requests from public authorities | Legal obligation |
| Website statistics — page view counts (Umami, on our own server; uses no cookies, does not store IP addresses, does not identify you) | The Company's legitimate interest in improving the Website |
| Website security, fraud prevention, technical operation | The Company's substantial legitimate interest |
The Company does not make decisions with significant effects for you based solely on automated processing (profiling).
4. Direct marketing
The Company does not send advertising SMS or email and does not use your data for direct marketing. If we start doing so in future, it will be only with your prior consent (Article 12 of the Law). You will then be able to withdraw consent at any time, free of charge, and sending will stop no later than 7 business days after your request.
5. Who receives your data
We do not sell or rent your data. We share it only with the recipients listed below, and only to the extent necessary:
| Recipient | Purpose | Data |
|---|---|---|
| Onway LLC (onway.ge) – logistics company, ID 402059419, 8 Rostevani St., Dighomi village, Tbilisi | Order delivery | Recipient's name, phone, delivery address |
| JSC Bank of Georgia | Online payment processing | Order number, amount |
| JSC TBC Bank and its payment platform Flitt (flitt.com) | Online payment processing | Order number, amount, email |
| SMS service provider uBill (ubill.ge) | Sending verification and password reset codes | Mobile phone number |
| Hosting provider Hetzner Online GmbH (Germany) | Hosting the Website, database and email sending service | Data stored on the Website |
| Public authorities (Revenue Service, law enforcement, courts) | Complying with requests provided for by law | As required by the request |
We have written contracts with our processors obliging them to keep data secure and use it only on our instructions.
International transfer. The Website and database are hosted on Hetzner Online GmbH servers in Germany (European Union), where the General Data Protection Regulation (GDPR) applies. We store data abroad only where the safeguards required by Georgian law are in place: the country has an adequate level of data protection, or a data protection agreement has been signed with the provider.
6. Retention and security
We keep data only as long as necessary for the purpose. After that we delete, destroy or anonymise it.
| Data | Retention period |
|---|---|
| Account data | While the account is active; deleted 3 years after account closure or last activity, unless another legal ground exists |
| Orders, invoices, fiscal documents | For the period set by tax and accounting law |
| Correspondence with customers, complaints | 3 years after the request is closed |
| Technical logs | 12 months |
| Cookies | Until the end of the session or for each cookie's lifetime |
Security measures. We use technical and organisational measures: encrypted connections (HTTPS/SSL), password hashing, access limited to authorised staff, logging of actions performed on data, backups, and confidentiality obligations for staff. The Company does not store full card details.
Incidents. In the event of a data breach we notify the Personal Data Protection Service within 72 hours of discovery and, if the incident may cause you significant harm, we notify you as well, without delay and in plain language.
7. Cookies and minors
7.1. Cookies. A cookie is a small file the Website stores in your browser. We use:
- essential cookies – for login, the shopping cart and security. The Website cannot work without them, so they do not require consent.
The Website does not use analytics or advertising cookies (e.g. Google Analytics, Meta Pixel). If we add them in future, they will be enabled only after your consent (via a cookie banner), and this policy will be updated. You can delete or block cookies in your browser settings.
7.2. Minors. Registration on the Website is intended for persons aged 18 and over. Data of persons under 16 may be processed only with the consent of a parent or legal representative (Article 7 of the Law). If we learn that such data was provided without that consent, we delete it.
8. Your rights
Exercising your rights is free of charge. We may ask for additional information to verify your identity.
| Right | What it means | Response time |
|---|---|---|
| Information | Which data we process, for what purpose and on what ground, its source, retention period and recipients | 10 business days |
| Access and copy | Receiving a copy of your data | 10 business days |
| Rectification, update, completion | Correcting inaccurate or incomplete data (most of it you can edit yourself in your account) | 10 business days |
| Cessation of processing, erasure, destruction | Deleting your account and data, except what the law requires us to keep (e.g. tax documents) | 10 business days |
| Blocking | Temporarily suspending processing (e.g. while accuracy is checked) | 3 business days |
| Portability | Receiving your data in a structured, machine-readable format or having it transferred to another company, where technically feasible | 10 business days |
| Protection from automated decisions | Not being subject to decisions based solely on automated processing | – |
| Withdrawal of consent | At any time, without giving reasons, in the same form in which it was given | 10 business days |
In exceptional cases the 10-day period may be extended by no more than 10 business days, and we will inform you with reasons. Your rights may be restricted only in cases expressly provided for by law. Before fulfilling a request we may ask you to confirm your identity.
9. Contact us
9.1. Submitting a request. To exercise your rights or ask a question, contact:
- Person responsible for personal data protection: Director Merab Beruashvili
- Email: info@enex.ge
- Phone: +995 511 722 622
- Address: 63a Shermadini St., Dighomi village, Saburtalo district, Tbilisi, Georgia
9.2. Complaints. If you believe your rights have been violated, you may apply to the Personal Data Protection Service or to a court, as provided by law. We recommend contacting us first – we will try to resolve the issue quickly.
9.3. Changes to this policy. We update this policy when the law or our practice changes. The new version takes effect as soon as it is published on the Website. Registered users will be notified of material changes by email.
Last updated: 10.10.2026