House of Bags
Privacy policy
Who processes your data
Your personal data is controlled by [company legal name] (identification code [identification code], address: [legal address]). For questions and to use your rights, write to [email protected] or call [phone].
We process data in line with the Law of Georgia on Personal Data Protection.
What data we process and why
- Orders and delivery: name, phone, e-mail, delivery address, what you ordered and the payment status. Basis: performing the contract; without this data we cannot fulfil the order. - Account: e-mail, name, phone, saved addresses and favourite products. Basis: your request and the contract. You can delete your account at any time from the account page. - Location: only when you allow it in your browser to fill in an address. - Reservations in a store: name and phone, so the store can contact you. Basis: your request. - Back-in-stock notices: e-mail, to send one message. Basis: consent. - Accounting and taxes: records of orders and payments. Basis: a legal obligation. - Security: technical records (IP address, browser, time) to detect fraud and attacks. Basis: our important legitimate interest. - News and offers: only with your written (including electronic) consent, which you can withdraw at any time.
We never see or store card details: payments are processed by the bank.
Who receives the data
- The courier company: the details needed for delivery (name, phone, address). - The bank: to process payments. - Service providers working on our instructions (servers, data storage, sending e-mail and SMS), under a written contract. - Public authorities, only where the law requires it.
We do not sell data and do not share it with anyone for advertising.
Data outside Georgia
Our servers and data storage may be located in the European Union or another country. We transfer data only where adequate safeguards for its protection are in place, as the law requires.
How long we keep data
- Orders and payments: for the period required by tax and accounting law. - Account: until you delete it. - Back-in-stock notices: until the message is sent or you cancel it. - Consent to news: until withdrawn; the fact and date of consent and of its withdrawal are kept for one more year, as the law requires. - Technical records: as long as needed for security, then deleted. - Backup copies: up to 13 months, then deleted automatically.
Your rights
You have the right to: - know what data we process and get a copy of it; - have your data corrected, updated or completed; - have the processing stopped and your data deleted or destroyed; - have your data blocked; - receive your data in a structured format where technically feasible; - withdraw your consent at any time.
We answer requests within 10 working days (extendable by up to 10 working days where necessary, in which case we will tell you); requests to block data within 3 working days. We stop sending news within 7 working days of your request.
If you believe your rights have been breached, you may apply to the State Audit Office of Georgia or to a court.
Cookies
The website uses only the cookies it needs to work: your language, signing in to your account, the shopping bag and security. Favourites and comparisons are kept in your browser and reach us only when you sign in to your account.
Statistics and advertising cookies are used only with your consent, which you can change at any time.
Security
We protect data with encrypted connections (HTTPS), restricted access, secure staff sign-in, records of actions and regular backups. If a security incident occurs, we act as the law requires and inform you where needed.
Changes
This policy may be updated. The new version is published on this page.