PERSONAL DATA PROCESSING POLICY
LLC “Prestige”
General Information
The purpose of this Policy is to promote transparency in the processing of your personal data (hereinafter referred to as “Data”) by the Company within the scope of the services provided to you (supply of perfumery and cosmetic products), including when using the Company’s website/application, purchasing products, joining the loyalty program/using the loyalty card, receiving direct marketing communications, etc.
LLC “Prestige” (Identification No. 205038252) (hereinafter referred to as the “Company” / “ICI PARIS” / “Artinscent”) respects and protects fundamental human rights and freedoms and ensures compliance with the principles and data subject rights stipulated by the Law of Georgia on Personal Data Protection.
The Company processes your Data in accordance with the Law of Georgia on Personal Data Protection, for specific, clearly defined purposes and on the legal grounds established by the same Law. Furthermore, the Company processes only those Data that are necessary to achieve the Company’s legitimate purposes.
All principles of data processing established by the Law of Georgia on Personal Data Protection are observed when processing your Data. We make every effort to protect your Data and have implemented appropriate organizational and technical security measures for this purpose.
The terms used in this Policy have the meanings assigned to them under the Law of Georgia on Personal Data Protection, including the following:
Personal Data – any information relating to an identified or identifiable natural person. A natural person is identifiable if they can be identified directly or indirectly, including by name, surname, identification number, geolocation data, electronic communication identification data, or physical, physiological, mental, psychological, genetic, economic, cultural, or social characteristics.
Data Processing – any operation performed on Data, including their collection, acquisition, access, photographing, video monitoring and/or audio monitoring, organization, grouping, interconnection, storage, modification, restoration, retrieval, use, blocking, erasure or destruction, as well as disclosure of Data through transfer, publication, dissemination, or otherwise making them available.
Data Subject – any natural person whose Data are processed.
Written Consent of the Data Subject – consent signed by the Data Subject or otherwise expressed by them in writing (including electronically), after receiving the relevant information, for the processing of their Data for a specific purpose.
Controller – a natural person, legal entity, or public institution that, individually or jointly with others, determines the purposes and means of Data Processing and carries out Data Processing directly or through a Processor.
Processor – a natural person, legal entity, or public institution that processes Data for or on behalf of a Controller. A natural person employed by the Controller under an employment relationship shall not be considered a Processor.
Recipient of Data – a natural person, legal entity, or public institution to whom Data have been transferred, excluding the State Audit Office.
Video Monitoring – the processing of visual image data using technical equipment installed or placed in a public or private space, specifically video surveillance and/or video recording, except for covert investigative actions.
Audio Monitoring – the processing of sound signal data using technical equipment installed or placed in a public or private space, specifically audio surveillance and/or audio recording, except for covert investigative actions.
Direct Marketing – the direct and immediate provision of information to a Data Subject by telephone, post, electronic mail, or other electronic means for the purpose of generating, maintaining, realizing, or supporting interest in a natural person and/or legal entity, goods, ideas, services, work and/or initiatives, as well as image-related and social topics. The provision of information by a public institution to a natural person shall not be considered Direct Marketing if such provision is compatible with any of the grounds for Data Processing stipulated by Articles 5 and 6 of this Law.
Incident – a breach of Data security resulting in unlawful or accidental damage to or loss of Data, as well as unauthorized disclosure, destruction, alteration, access to, collection/acquisition of, or other unauthorized processing of Data.
How and What Types of Data We Process About You
We process only those Data that you voluntarily provide to us after receiving appropriate information, during registration on the website for the purpose of purchasing products, when purchasing products through the website, and when opening or using a loyalty card. Furthermore, the application itself is intended solely for joining the loyalty program/creating a loyalty card and subsequently using the card. Accordingly, upon completing registration in the application, you become a member of the loyalty program. You are responsible for the accuracy and correctness of the Data provided to the Company.
Products may be purchased either through the website (www.iciparis.ge) after registration or at the Company’s branches. During registration on the website, we process the user’s first name, surname, and email address. In the case of authorization through a social network (“Facebook”), we also process the first name/surname (account name) and profile photograph provided by you on that social network. In the case of authorization through email (“Google”), we process the email address provided by you. Please note that your website password can be reset using the email address specified during registration.
At the stage of receiving services through the website, for the purpose of providing services to you, the Company processes information related to your order, including the following Data:
a) The product name, order number, date, status, price, discount, delivery cost/type, and payment method;
b) Telephone number;
c) Address (city/region, street/number, postal code in the case of a region, and an address-related comments field in which you may provide additional address details);
d) The text of a greeting card and the information provided by you therein.
Furthermore, you may manage the address field as you wish, specifically by adding or deleting any address at any time.
The information required to join the loyalty program/create a loyalty card includes your first name, surname, personal identification number, gender, mobile phone number, and date of birth. Your email address is optional. Without providing the mandatory Data, you cannot complete registration and, consequently, cannot become a member of the loyalty program or use the loyalty card. Verification is required to complete registration, for which a verification code will be sent to the mobile phone number provided by you.
To authorize yourself in the application, you are required to provide your personal identification number. After providing this Data, you must undergo verification by means of a text message containing a verification code sent to the mobile phone number registered by you. Authorization in the application is not possible without completing this process.
Regardless of the method of use, when you use the loyalty card, information about purchases made using the card will be processed, including information about the products and order details, prices, discounts, purchase dates, and the place of purchase.
If you consent to Direct Marketing, the Company may process your first name, surname, gender, mobile phone number, date of birth, and information about your orders/purchases for the purposes of promoting the Company’s activities, advertising products, providing information about discounts/promotions/offers, analyzing the Company’s activities, improving service quality, and planning measures aimed at improving its operations. Advertising messages will be sent by the Company to the mobile phone number provided/registered by you in the form of text messages (SMS). Refusal to receive advertising messages does not restrict your right to join the loyalty program/create a loyalty card or subsequently use the card.
Audio Monitoring Process (Hotline)
In accordance with the rules governing audio monitoring through the Company’s hotline, we process, record, and store calls made by you to the Company’s hotline. Such calls may contain your Personal Data, including your first name, surname, personal identification number, telephone number, voice, and information relating to the services provided to you, which may include information about purchased or intended-to-be-purchased products, services rendered, and other related information.
Video Monitoring Process
In accordance with the rules governing video monitoring, we process, record, and store recordings obtained through video monitoring. The Company’s retail premises are subject to continuous, 24-hour video monitoring through video monitoring systems installed along the internal and external perimeters. The rules governing video monitoring ensure the availability of your rights as a Data Subject, as defined in Chapter III of the Law of Georgia on Personal Data Protection.
Audio Monitoring Process
In accordance with the rules governing audio monitoring, we process, record, and store recordings obtained through audio monitoring. Continuous, 24-hour audio monitoring is carried out at the Company’s premises through the video monitoring system installed in the internal area around the cash registers. The rules governing audio monitoring ensure the availability of your rights as a Data Subject, as defined in Chapter III of the Law of Georgia on Personal Data Protection.
Purposes of Data Processing
The purpose of processing your Data by the Company is to ensure your use of the Company’s website and application, your membership in the loyalty program/creation of a loyalty card and subsequent use of the card, as well as the placement of orders and purchase of products.
The loyalty program, in turn, serves to identify you and provide you with individual discounts and offers and, subject to your consent, to send marketing messages offering the Company’s services and products. Without opening a loyalty card, you cannot benefit from the discounts and offers available to members of the Company’s loyalty program.
The Data provided by you are used by the Company for the following purposes:
- To enable you to join the loyalty program/create a loyalty card and subsequently use the card, and to provide you with the benefits established under the loyalty program;
- To enable registration on the website and the placement of orders through the website, including for product delivery;
- To enable authorization on the website and in the application;
- To provide services to you and improve such services, including sending informational messages;
- To send marketing messages to you and offer products tailored to your preferences, subject to your consent;
- To conduct statistical and marketing analyses of the Company’s activities and improve the Company’s products and services;
- To improve the Company’s operations and service quality and plan measures aimed at improving its activities.
Legal Grounds for Data Processing
Your Data are processed on the applicable legal grounds established by the Law of Georgia on Personal Data Protection. Specifically, the grounds for Data Processing are as follows:
| Data | Purpose | Legal Ground |
|---|---|---|
| User’s first name, surname, personal identification number, gender, mobile phone number, date of birth, and information about orders/purchases; optional Data: email address | Joining the loyalty program/creating a loyalty card and using the card | To perform obligations undertaken under a transaction concluded with the Data Subject or to take steps at the Data Subject’s request to enter into a transaction and provide services to them |
| User’s first name, surname, gender, mobile phone number, date of birth, and information about orders/purchases made | Direct Marketing | Written consent of the Data Subject |
| User’s mobile phone number | Informing the user in connection with the performance of obligations under the service agreement, including the provision of informational messages | To perform obligations undertaken under a transaction concluded with the Data Subject and to provide services to them |
| User’s first name, surname, and email address | User registration on the website | To perform obligations undertaken under a transaction concluded with the Data Subject and to provide services to them |
| First name/surname (account name) and profile photograph provided by the user on the social network (Facebook), and email address (Google) | User authorization on the website | To perform obligations undertaken under a transaction concluded with the Data Subject and to provide services to them |
| User’s personal identification number | User authorization in the application | To perform obligations undertaken under a transaction concluded with the Data Subject and to provide services to them |
| Information related to a product order (product name, order number, date, status, price, discount, delivery cost/type, and payment method); address-related information (city/region, street/number, postal code in the case of a region, and an address-related comments field in which the address may be clarified); telephone number; text of a greeting card and information provided therein. When using the loyalty card, the place of purchase is also processed. | Providing services to the user and ensuring the purchase and delivery of products | To perform obligations undertaken under a transaction concluded with the Data Subject and to provide services to them |
| Data processed through video monitoring | Protecting the safety and property of the Company’s employees, customers, and visitors, and carrying out other tasks attributable to the Company’s legitimate interests | Protecting the safety and property of the Company’s employees, customers, and visitors, and carrying out other tasks attributable to the Company’s legitimate interests |
| Data processed through audio monitoring, including during telephone communications | Improving the quality of the Company’s services; ensuring the accuracy and security of the handling of funds in the financial settlement area; and reducing risks that may result in financial and/or reputational damage to the Company | The Company’s significant legitimate interest |
Transfer of Data to Third Parties
Whenever your Personal Data are transferred to a third party, we take all necessary measures to ensure their security, confidentiality, integrity, and availability.
Data are transferred to third parties only where the requirements established by law are fully complied with and the relevant parties undertake to ensure secure and lawful processing of the Data. In cases strictly defined by law, law enforcement authorities or other bodies/organizations may also be granted access to your Personal Data or receive such Data for the purposes of establishing, investigating, or preventing crime, or for other legal purposes.
If the third-party recipient is a Processor, a written agreement is concluded between the Company and the Processor, specifying the following:
- The legal grounds and purposes of Data Processing;
- The categories of Data to be processed;
- The Data Processing period and the rights and obligations of the Controller and the Processor.
The written agreement must also include the obligations of the Processor stipulated in paragraph 2 of Article 36 of the Law of Georgia on Personal Data Protection. Contracting companies are obliged to comply with the Law of Georgia on Personal Data Protection and ensure Data security. The Company monitors compliance with these requirements.
Cookies
The website uses cookies. A cookie is a small text file, also referred to as a “cookie record,” which a website sends to and stores in your device’s browser when you visit our website. It contains information about a particular visitor, the actions performed on the website, and the website address. Cookies act as a kind of “memory” that remembers your activity during your visit to the website and enables the website to tailor its services more effectively to your needs based on previous visits, ultimately providing a more personalized and convenient experience.
Depending on the type of cookie, the categories of Data processed may include information about the device used and activity information, such as IP address, searches, browser, browser language, device settings, the date and time of a request, the method used to send requests to the server, the size of the file received in response, and other settings of the user’s operating system.
Detailed information about the cookies used by our website is available in the Cookies Policy.
Data Retention
The Company retains user Data, including information about purchases/orders, for a period of three years in order to fulfill obligations imposed by tax legislation and for civil-law purposes.
Specifically, Data collected for the purpose of joining the loyalty program/creating a loyalty card are retained until you request the cessation of the processing of your Data. Until such a request is submitted, you may continue using the loyalty card at your discretion. If the loyalty card is canceled, your Data will be retained for three years from the date of the cancellation request. Furthermore, upon cancellation of the loyalty card, you will no longer receive marketing messages.
Data collected for the purpose of user registration on the website are retained until the user requests the cessation of the processing of their Data. However, regardless of account deactivation, information about orders is retained for three years.
The retention periods for Data processed during audio recording of telephone communications and Data obtained through video and audio monitoring are determined respectively by the “Rules for Audio Monitoring of Telephone Communications by LLC Prestige” and the “Rules for Video and Audio Monitoring by LLC Prestige.”
Where you have consented to the processing of your Data for Direct Marketing purposes, such Data will be processed until you withdraw your consent. When processing Data for Direct Marketing purposes, the Company also records the fact and time of the Data Subject’s granting and withdrawal of consent to the processing of their Data and retains this information for the duration of Direct Marketing activities and for one year after such activities cease.
Data Security
To ensure Data security, the Company has implemented appropriate organizational and technical measures, including restricting access to Data to users whose direct duties involve Data Processing. Access to Data stored in the database is permitted only from work computers, and every person authorized to access the Data has an individual username and password.
Access to the Company’s software systems and databases is strictly restricted both within the Company and at entities authorized to process Data. Furthermore, all actions performed in relation to Data stored in electronic databases are recorded through a logging system in accordance with applicable legislation. Physical documents, where applicable, are stored in locations protected against access by unauthorized persons, and access to such documents is strictly restricted.
Written agreements concluded with Processors also address matters relating to Data security.
Rights of the Data Subject
You have the right to cancel your loyalty card/leave the loyalty program at any time, in which case the relevant services will cease. Upon termination of the services, the processing of your Data will cease, except where a legal ground for Data Processing established by the Law of Georgia on Personal Data Protection remains applicable. You may cancel your loyalty card/leave the loyalty program, deactivate your website account/application, and, where necessary, change or update the Data provided by you to the Company at any of the Company’s retail branches.
At the same time, the Data Subject has the right to withdraw, at any time and without providing any explanation and/or justification, the consent given for the processing of their Data for Direct Marketing purposes. In such cases, the processing of Data for Direct Marketing purposes will cease in accordance with the Data Subject’s request. Withdrawal of consent to Direct Marketing does not restrict your right to use the Company’s loyalty card. Consent may be withdrawn in the same manner in which you received the text message, specifically by using the “SMS OFF” function.
In accordance with the Law of Georgia on Personal Data Protection and in the cases specified therein, the Data Subject also has the right to obtain information about the processing of their Data, request access to and a copy of their Data, request the updating, rectification, or completion of their Data, request the cessation of Data Processing or the erasure of Data by withdrawing consent, and request the blocking of Data.
The Company ensures that the rights established under Chapter III of the Law of Georgia on Personal Data Protection are respected, unless circumstances restricting the exercise of those rights, as provided for by the same Law, apply.
The rights of the Data Subject provided for by the Law of Georgia on Personal Data Protection may be restricted where such restriction is expressly provided for by the legislation of Georgia, does not violate fundamental human rights and freedoms, constitutes a necessary and proportionate measure in a democratic society, and the exercise of those rights may jeopardize the interests specified in paragraph 1 of Article 21 of the Law of Georgia on Personal Data Protection.
To exercise your rights or obtain any consultation concerning the processing of your Data, please contact the Company’s Data Protection Officer: LLC “Data Protection Team” (Identification No. 402303093), email address: info@dpt.ge. You may also contact the supervisory authority responsible for personal data protection at any time to safeguard your rights.
Publication of and Amendments to the Policy
This document is available on the Company’s website/application. Users are also provided with the opportunity to review this document before registration through the website and application.
If individual matters relating to Data Processing change, this Policy shall be updated as necessary. The Company reserves the right to amend this Policy in accordance with changes in legislation and/or changes to the Company’s personal data processing practices.
Contact Us
If you have any questions regarding this Privacy Policy or our personal data protection practices, please contact us:
- Email: info@prestige.ge
- Telephone: 032 2 20 17 18
Our Data Protection Officer is:
LLC “Data Protection Team” (Identification No. 402303093)
Contact information: info@dpt.ge