1. Data Controller Identification
The designated data controller responsible for the processing of your personal data collected via the Sisuni Global web application, service portal, and digital infrastructure is:
Registered under the LEPL National Agency of Public Registry, Tbilisi, Georgia.
Corporate Seat: 75A Erosi Manjgaladze Street, Nadzaladevi district, Tbilisi, 0112, Georgia
Official Contact: +995 555 55 65 45
Privacy Inquiries: [email protected]
We process your personal information in strict adherence to the Georgia Law on Personal Data Protection and globally accepted data governance principles embodied in the General Data Protection Regulation (GDPR).
2. Categories of Personal Data Collected
We limit data collection to what is necessary, proportionate, and strictly relevant to operate our multi-vertical marketplace and ensure security:
Phone Numbers & SMS OTP Verification
Collected during user onboarding to deliver passwordless One-Time Passwords (SMS OTP), verify authentic user identities, and enable dispatch coordinator communications for active bookings.
Email Addresses & Legal Full Names
Collected for account authentication, dispatch notifications, VAT receipts, invoices, and customer care communications.
Masked Identification Documents (Specialist Onboarding)
To maintain consumer trust and safety, trade specialists must provide state-issued personal identity documents or tax certificates. All documents undergo automated validation and are stored in masked format (****-****-XXXX) so full national numbers are never exposed in unencrypted form.
Location & City Coordinates for Proximity Matching
Municipal city, district, neighborhood, or service address coordinates provided by Customers to match available verified specialists within the immediate geographic dispatch radius.
3. Lawful Bases for Data Processing
In accordance with Article 5 and 6 of the Georgia Law on Personal Data Protection and Article 6 of the GDPR, we process personal data under the following legal bases:
- Performance of a Contract: Processing necessary to fulfill service bookings, facilitate trade dispatch, manage dual-role switching, process transactions, and disburse specialist earnings.
- Compliance with Legal Obligations: Processing required under Georgian corporate law, tax filing standards, bookkeeping regulations, and lawful authority disclosures.
- Legitimate Interests: Preventing marketplace fraud, mitigating fee evasion, securing edge infrastructure, optimizing routing efficiency, and maintaining community safety standards.
- Explicit Consent: Provided when you voluntarily sign up for consultation updates, opt into communication channels, or authorize OAuth single sign-on.
4. Purposes of Data Processing
We utilize the collected personal information strictly to:
- Authenticate users via OTP and OAuth protocols
- Match customers with verified local specialists
- Execute cascading assignment when emergencies arise
- Issue verified digital invoices and tax documentation
- Enforce marketplace terms and anti-circumvention rules
- Deliver customer support via WhatsApp, telephone & email
5. Authorized Third-Party Sub-Processors
To provide high-availability edge delivery, verified authentication, and reliable transactional communications, Sisuni engages reputable third-party sub-processors bound by strict Data Processing Agreements (DPAs):
Processing Scope: SMS transmission, multi-factor One-Time Password (OTP) verification, automated dispatch alerts
Security Standard: SOC 2 Type II, ISO 27001, End-to-End Encrypted Gateway
Processing Scope: Transactional email delivery, appointment confirmations, billing receipts, account security alerts
Security Standard: TLS 1.3 Transport Encryption, SOC 2 Compliant
Processing Scope: Federated OAuth 2.0 single sign-on authentication and credential verification
Security Standard: ISO 27001, FedRAMP, OpenID Certified
Processing Scope: Federated OAuth authentication, biometric verification, and privacy-relay identity tokens
Security Standard: Apple Privacy Framework, FIDO2 / Passkey Support
Processing Scope: Global Anycast Content Delivery Network (CDN), DDoS mitigation, Web Application Firewall (WAF), edge security
Security Standard: SOC 2 Type II, ISO 27001, PCI-DSS Level 1
7. Security Safeguards & Data Retention
All data in transit is encrypted using TLS 1.3 with 256-bit AES algorithms. Our Cloudflare edge layer protects against distributed denial of service (DDoS) and unauthorized perimeter intrusion. Access to production databases is governed by Role-Based Access Controls (RBAC), multi-factor authentication, and strict principle-of-least-privilege guidelines.
Data is retained only as long as necessary to provide marketplace services, maintain active accounts, resolve disputes, or comply with statutory tax and accounting retention requirements under Georgian legislation (which mandates statutory accounting archive retention for up to 6 years).
8. Account & Personal Data Deletion Protocol
In compliance with Georgian data protection regulations and the GDPR Right to Erasure (“Right to be Forgotten”), Sisuni provides transparent, accessible mechanisms for users to permanently delete their account and associated personal data.
How to Request Account & Personal Data Deletion
Guaranteed processing within 30 calendar days of verified submission
You may exercise your right to permanent account erasure and data purge through either of the following two verified channels:
Option 1: Direct Email Request
Send an email from your registered account email address to:
[email protected]Include “Data Deletion Request” in the subject line. Our privacy response team will verify your identity and confirm deletion within 30 days.
Option 2: Portal Account Settings
Log in to your authenticated profile, navigate to the Service Portal (/home-services/portal), access the Profile & Security section, and select “Delete My Account & Erase Data”.
You will receive an SMS OTP confirmation to prevent accidental or malicious deletion.
Effect of Deletion: Upon execution, all personal identity records, phone numbers, email addresses, masked credentials, session tokens, and specialist profiles are permanently purged or irrevocably anonymized.
Note: Anonymized transaction records required under Georgian tax law for statutory commercial accounting shall be securely retained in cold storage for the statutory retention period before automatic destruction.
9. Your Statutory Data Subject Rights
Under the Georgia Law on Personal Data Protection and international privacy regulations (GDPR), you possess comprehensive rights over your personal data:
- Right of Access: You may request copies of personal information held about you.
- Right to Rectification: You may request corrections to any inaccurate or incomplete records.
- Right to Erasure: You may demand deletion of data no longer required for its original purpose.
- Right to Restrict Processing: You may contest processing while claims are investigated.
- Right to Data Portability: You may request structured, machine-readable copies of your data.
- Right to Object: You may object at any time to direct marketing or processing under legitimate interest.
- Right to Lodge a Complaint: You have the legal right to submit a complaint directly to the national supervisory authority: the Personal Data Protection Service of Georgia (Vakhtang Gorgasali St. 7, Tbilisi 0114, Georgia | pdps.ge).
10. International Data Transfers
Where personal data is transferred outside Georgia for processing by global infrastructure partners (e.g., Cloudflare, Twilio), transfers are secured through Standard Contractual Clauses (SCCs), EU adequacy determinations, and ISO-certified encryption protocols ensuring equal or superior privacy protection.
11. Children's Privacy (18+ Policy)
Sisuni Global is strictly tailored for adult consumers and commercial enterprises. We do not knowingly collect or solicit personal data from persons under the age of 18. If we learn that a minor has submitted personal data without verifiable parental consent, we will purge that data immediately.
12. Policy Updates & Continuous Consent
We may periodically update this Privacy Policy to reflect technical evolutions, new regulatory directives, or service enhancements. Material amendments will be communicated with prominent notice on our website or via email. Continuing to use the Sisuni platform following the posting of updates represents your continuous consent to our updated privacy standards.
13. Data Protection Inquiries & Contacts
To exercise your statutory privacy rights, request account deletion, or address questions to our Data Protection Officer, please reach out through our official channels:
Data Protection Office
Sisuni Global Services LLC