Соглашение об обработке данных

Processor ("we"): Individual Entrepreneur Sandro Tskhvariashvili, e-mail info@tavazi.ge.

Controller ("you"): the accommodation business that accepted the Terms of Service.

"Controller" and "processor" have the meaning given in the Law of Georgia on Personal Data Protection. In the Georgian text you are დამუშავებისთვის პასუხისმგებელი პირი and we are დამუშავებაზე უფლებამოსილი პირი. The supervisory authority is the State Audit Office of Georgia (the Office).

This Agreement also covers your staff's data that we process for you. We are an independent controller of your account, login and billing data, which this Agreement does not cover.

Subject: processing personal data to provide Tavazi to you.

Purpose: running your property and direct sales: bookings, stays, housekeeping, settlement, messages, reports and export.

Nature: automated collection, recording, storage, organisation, retrieval, use, disclosure to recipients you name, anonymisation and deletion. We make no decisions about guests and do no profiling.

Duration: the term of the Terms of Service, and after it only as section 11 allows.

Data: guests' identity and contact details, including date of birth and nationality; stay details; financial data; identity-document and tax numbers, stored only encrypted; consents and markers; message records; and staff data, including actions, session IP address and device.

You put no special-category data, such as health data, in free-text fields. No payment card data ever enters our systems.

Data subjects: guests and people who book; your staff and other users; contact persons at companies and travel agents.

We process personal data only on your documented instructions: this Agreement, the Terms of Service, your settings, your users' actions in the service, and your written requests. We depart from them only where Georgian law requires, and tell you first unless the law forbids it. If we think an instruction is unlawful, we tell you in writing and may pause it until you confirm or change it.

We use the data for no other purpose. We do not sell it, use it for advertising or to train AI models, or compare controllers using identifiable data. Our statistics identify no person and no controller.

Only named staff who need the data have access, each with a personal key and bound by confidentiality without time limit. Every action we take on your data is logged in a record that cannot be changed. We apply the measures in Annex 2 and change them only without lowering protection.

You give prior written consent to the sub-processors named in Annex 1, and only to them.

We notify you of a new one at least 30 days ahead, with its name, country, data and purpose. You may object in writing, with reasons, within 14 days; while you object, we do not transfer your data to it. Within 14 days we either provide the function another way or tell you the service cannot run without it. You may then, within 30 days, end the Terms of Service free of charge, with a refund of prepaid fees; otherwise the objection counts as withdrawn.

Each sub-processor is bound in writing by duties no weaker than ours, and we remain liable for it. It must be established in Georgia or in a country on the Office's list of countries with adequate safeguards, unless the Office gives prior permission.

Our servers, database and backups are in Germany, which is on that list. If Germany leaves the list, we agree another lawful basis with you or move the data. We transfer no data to a country outside the list without the Office's prior permission.

You answer guests' requests within the legal 10 working days; we pass any request we receive to you at once. The guest screens, the export and anonymisation let you do this yourself. Anything else we do on your written instruction within 5 working days, free.

Anonymisation clears the guest's name, contact details, date of birth, address, document and tax numbers, consents and markers; nationality and language stay. It does not change the name on issued invoices and folios, the recipient in the log of sent messages, or the change log, which cannot be edited. These remain until the property's record is destroyed (section 11). Anonymisation is therefore not full erasure, and you must not present it to a guest as such.

We notify you of an incident without delay and within 24 hours of learning of it, by e-mail. The notice describes the incident, the categories of data and people affected, the measures taken and our contact person. It contains no personal data, and we complete it as facts emerge.

You notify the Office within 72 hours. We help, but do not notify the Office for you without your written instruction. On request we give you your account's entry in our incident register within 5 working days.

If we disagree about the processing, we stop at your request and hand over all your data. Access to data is never used to obtain payment; in read-only mode you can still read and export everything, and nothing is deleted.

You can export your data at any time.

After the Terms of Service end, the account stays read-only for 90 days so you can export; on written request we send you the files free while the data exists. Within 30 days after that, or within 30 days of your written instruction if sooner, we delete or anonymise the personal data and its copies. If you instruct us before exporting, the risk is yours. Backups roll over within 90 days and are used only for disaster recovery. We confirm in writing what was deleted and kept.

We keep only:

• on your instruction, financial documents and linked data, including the name on them, for the retention period you set (you may withdraw this instruction at your own risk). When it ends, they are destroyed with the rest of the property's record, including the items in section 8;
• our own invoices, accounting records and acceptance records.

We give you the information you need to check that the processing is lawful, including a free yearly report on security, sub-processors and incidents.

Once every 12 months, on 30 days' written notice, you or an independent auditor who is not our competitor may audit us: in business hours, under confidentiality, at your cost and without access to other controllers' data. After a confirmed incident affecting your data, you may audit on 10 days' notice.

We keep a record of the categories of processing for you and the Office.

You have a lawful basis and give lawful instructions; inform guests; set retention periods (until you set one for guest data, we anonymise no one); manage users and remove leavers promptly; keep your own record of processing; notify the Office of incidents; and keep a current contact e-mail, where our notices count as delivered.

Liability follows the Terms of Service, but damage from breaching this Agreement is not subject to their cap. This Agreement lasts as long as the Terms of Service and, for section 11, until processing ends.

We notify the owner of a new version at least 30 days before it takes effect; you may end the Terms of Service free of charge before then. A material change applies only once you accept it. Terms agreed individually prevail over this Agreement; on personal data, this Agreement prevails over the Terms of Service.

This Agreement is concluded electronically at signup. We record who accepted which version, when and from where, and you can obtain the accepted text at any time. On request we also sign it on paper or with a qualified electronic signature. Georgian law applies, and the Georgian text prevails.

• Hostinger (VPS), Germany: server, database and backups; all database data. In use.
• Hetzner Online GmbH (Hetzner Cloud), Germany: future production and file storage; all database data and guest files. Not yet in use.

Payments: you contract your payment provider (for example Tpay LLC, Flitt) directly, under your own agreement with it. On your instruction we send it the amount, currency, order description and the payer's name and e-mail, and receive only whether the payment succeeded. The provider is your processor, not ours.

No e-mail provider has been chosen; one will receive data only after notice under section 6. Nobody else receives personal data.

• Row-level security forced on every table with controller data, tested for leaks on each code change.
• Least-privilege database roles; invoices, payments and evidence records cannot be deleted or changed.
• Append-only logs of every unmasked read of guest identity (kept 12 months, or 6 years for financial documents), of every data change (tamper-evident) and of console actions.
• argon2id password hashing, hashed session tokens, sign-in limits, breached-password checks.
• TLS everywhere; third-party credentials (AES-256-GCM) and document and tax numbers stored encrypted.
• No card data stored; card-shaped data refused.
• IP addresses anonymised in logs; no guest data in system logs.
• Daily backups kept off the server (14 days locally, up to 90 days off-site), with quarterly restore tests starting before production use.
• Tests, code review and secret scanning on every change.
• A written incident procedure; recording an incident and notifying controllers are one action.