Privacy policy

Privacy Policy

Last updated: August 7, 2026

1. General Information

This Privacy Policy explains how AQUAREA LLC collects, uses, stores, processes and, where necessary, transfers the personal data of customers and website visitors.

This Policy applies to the processing of personal data when using AQUAREA's website, online store, customer support, ordering, delivery, returns, warranty and other related services.

The entity responsible for processing personal data is:

Company name: AQUAREA LLC
Identification code: 406514703
Address: 37 Davari St., Didi Dighomi, Tbilisi 0159, Georgia
Website: www.aquarea.ge
Email: info@aquarea.ge
Phone: +995 32 2 12 22 32

Use of the website and the Company's services implies that you have reviewed this Policy. Personal data is processed in accordance with the applicable legislation of Georgia, including the Law of Georgia on Personal Data Protection.

If there is any conflict between this Privacy Policy and other website terms regarding the collection, use or processing of personal data, this Privacy Policy prevails in relation to those matters.

2. What Is Personal Data

Personal data means any information relating to an identified or identifiable natural person through which that person can be identified directly or indirectly.

Anonymous or properly de-identified information that cannot be linked to a specific person is not considered personal data.

3. Personal Data We Collect

The amount and type of data processed by the Company depends on how a user interacts with AQUAREA and which services are used.

We may process the following categories of information:

  • Identification and contact data - first name, last name, phone number and email address;
  • Address data - delivery address and, where necessary, billing address;
  • Order and transaction data - products purchased or viewed, products added to cart, order history, returns, exchanges, cancellations and other related information;
  • Payment-related data - payment method, payment status and information required to process and confirm a transaction or payment;
  • Customer account data - account information, preferences and related settings, if the user creates an account;
  • Communication data - information provided to us by email, phone, website form, social media or another communication channel;
  • Technical data - IP address, device type, browser, operating system, network-related technical information and other technical identifiers;
  • Website usage data - information about visits to the website, pages viewed, functions used and the user's interaction with the website;
  • Marketing preferences - relevant consent, subscription status and choices related to marketing communications.

The Company does not request personal data that is not necessary for the provision of a specific service.

4. Sources of Personal Data

Personal data may be obtained:

  • directly from the user when placing an order, creating an account, completing a form, contacting the Company or otherwise providing information;
  • automatically when using the website and online services, through cookies and similar technologies;
  • from payment, delivery, technology or other service providers where necessary to provide the relevant service;
  • from partners or other third parties where an appropriate legal basis exists for receiving and processing the data.

5. Purposes of Personal Data Processing

The Company processes personal data only for specified and lawful purposes.

Receiving and fulfilling orders

Data is used to:

  • receive and confirm orders;
  • process payments;
  • organize product delivery;
  • inform customers about order status;
  • process returns, exchanges or order cancellations;
  • provide warranty and after-sales service.

In these cases, processing is generally necessary to enter into a transaction with the customer or to perform obligations under an existing transaction.

Customer service

Personal data may be processed to review and respond to a customer's question, application, request, complaint or other communication and to provide the relevant service.

Security and fraud prevention

Data may be processed to protect the website, users and the Company, and to prevent and detect unauthorized access, possible fraud, unlawful or malicious activity.

Legal and financial obligations

The Company processes data when necessary to comply with obligations imposed by Georgian law, including tax, accounting, consumer protection and other legal requirements.

Improving services and the website

Technical and usage data may be used to improve website functionality, user experience, products and services, to perform statistical analysis and to identify technical issues.

Marketing communications

Where the user has provided the appropriate consent, contact details may be used to send offers, news, promotions, product information and other marketing communications.

6. Legal Bases for Processing Personal Data

The Company processes personal data only where an appropriate legal basis exists.

Such a basis may include:

  • the data subject's consent;
  • the necessity of processing to enter into or perform a transaction with the customer;
  • a requirement established by Georgian law;
  • performance of an obligation imposed on the Company by law;
  • the necessity to review a customer's application or request and provide the relevant service;
  • protection of an important legitimate interest of the Company or a third party, where that interest is not overridden by the data subject's rights and freedoms.

Where processing is based on consent, the data subject has the right to withdraw consent in accordance with the procedure established by law.

7. Requirement to Provide Data

Providing certain personal data is necessary to place an order or receive a specific service.

For example, product delivery requires the customer's name, contact details and delivery address, while payment for an order requires information necessary for the relevant payment process.

If required information is not provided, the Company may be unable to accept or fulfill an order, deliver a product or provide the service requested by the customer.

Providing other data is voluntary unless otherwise indicated in a specific case.

8. Cookies and Similar Technologies

Cookies and similar technologies may be used to ensure the proper functioning of the website.

Cookies may be used to:

  • provide essential website functions;
  • remember the cart and user settings;
  • support security and authentication;
  • analyze website performance and usage;
  • improve the user experience;
  • for marketing and advertising purposes, where the appropriate consent has been provided.

Cookies that are necessary for website functionality may be used where required to provide the relevant service.

Analytical, marketing or other non-essential technologies will be used in accordance with the user's selected privacy settings and applicable law.

Disabling certain categories of cookies may affect the operation of some website functions.

9. Recipients of Personal Data

The Company transfers personal data to third parties only to the extent necessary to achieve a specified purpose and where an appropriate legal basis exists.

Recipients or categories of recipients may include:

  • payment service providers and financial institutions;
  • courier and logistics service providers;
  • website, hosting, e-commerce, IT and other technology service providers;
  • customer service, analytics or marketing service providers, where an appropriate legal basis exists;
  • the Company's professional advisers, including legal and accounting service providers;
  • state authorities, courts, law enforcement or other authorized bodies where disclosure is required by law or necessary to protect the Company's lawful rights and interests.

The Company provides service providers only with the amount of personal data necessary to perform the relevant service.

To provide the website's e-commerce and technical infrastructure, the Company uses the Shopify platform. In connection with these services, certain personal data may be processed by Shopify and its authorized service providers.

Additional information about Shopify's processing of personal data is available in Shopify's consumer privacy policy.

10. International Transfers of Personal Data

Some technology or other service providers used by the Company may operate or process data outside Georgia.

In such cases, international transfers of personal data are carried out only in accordance with applicable law and subject to appropriate safeguards for data security and the protection of data subjects' rights.

For international transfers, the Company and its service providers take appropriate organizational, technical and legal measures to protect personal data.

11. Retention Period

Personal data is retained only for as long as necessary to achieve the purpose for which it was collected or processed, except where a longer retention period is required or permitted by law.

When determining retention periods, the Company considers:

  • the duration of the contractual relationship with the customer;
  • the period necessary to fulfill an order or provide a service;
  • warranty and after-sales service requirements;
  • tax, accounting and other statutory obligations;
  • the period necessary for possible disputes, claims or legal defense;
  • the purpose of processing and the nature of the data.

After the legal basis or purpose for retention expires, data will be deleted, destroyed or de-identified unless another legal basis for continued retention exists.

12. Data Security

The Company takes reasonable and appropriate organizational and technical measures to protect personal data against accidental or unlawful loss, destruction, alteration, disclosure, unauthorized access and other unlawful processing.

Access to personal data is granted only to persons for whom such access is necessary to perform the relevant function or service.

However, no method of electronic transmission or storage can guarantee absolute security. Accordingly, the Company implements appropriate security measures required by law and supported by available technical capabilities, but cannot guarantee that information systems are absolutely impenetrable.

13. Rights of the Data Subject

Under applicable Georgian law, the data subject has the right to:

  • obtain information as to whether personal data concerning them is being processed;
  • obtain information about the purpose, legal basis, source, recipients and retention period of processing;
  • access personal data concerning them and, subject to the conditions established by law, receive a copy;
  • request correction, updating or completion of inaccurate, incorrect or incomplete data;
  • request cessation of processing, deletion or destruction of data in cases provided by law;
  • request blocking of data in cases provided by law;
  • exercise the right to data portability where applicable;
  • withdraw consent at any time where processing is based on consent;
  • in cases provided by law, not be subject to a decision based solely on automated processing that produces legal or other similarly significant effects;
  • appeal an action or decision related to the processing of personal data in accordance with the procedure established by law.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

The Company reviews data subject requests in accordance with the procedures and time limits established by Georgian law.

Before fulfilling a request, the Company may require appropriate verification of the data subject's identity where necessary to prevent unauthorized disclosure of personal data.

14. Marketing Communications

Personal data is processed for direct marketing purposes on the basis of the data subject's appropriate consent.

Marketing communications may include information about:

  • new products;
  • special offers;
  • discounts and promotions;
  • Company news and other promotional offers.

The data subject has the right at any time, free of charge and without giving reasons, to withdraw consent to receive marketing communications and request that processing for direct marketing purposes cease.

Opting out is possible through the unsubscribe function in the relevant message or by contacting the Company.

The Company ensures that the method for stopping direct marketing is simple and accessible.

Opting out of marketing communications does not affect receipt of essential non-promotional communications related to orders, accounts, payments, delivery, security or other services.

Processing of personal data for direct marketing purposes will cease within a reasonable period after receipt of the relevant request, but no later than 7 business days.

The Company records the fact and time of consent to direct marketing and its withdrawal in accordance with applicable law.

15. Personal Data of Minors

AQUAREA's online store and commercial services are primarily intended for adult users.

The Company does not knowingly collect minors' personal data where processing requires an appropriate legal basis or consent prescribed by law.

If a parent or legal representative believes that a minor has provided personal data to the Company without an appropriate legal basis, they may contact the Company to request deletion of the data or cessation of processing.

16. Third-Party Websites and Links

The website may contain links to websites, platforms or services operated by third parties.

After following a link to a third-party website, the processing of data may be governed by that third party's privacy policy and terms.

AQUAREA is not responsible for the privacy practices, security or content of websites or online platforms that are not under the Company's control.

Users are encouraged to review the relevant third party's privacy policy before providing personal information.

17. Complaints and Requests Relating to Personal Data Protection

If a data subject has a question, request or complaint regarding the processing of personal data, they may first contact AQUAREA using the contact information provided in this Policy.

The Company will review the request and respond in accordance with the procedures and time limits established by Georgian law.

The data subject also has the right, in accordance with the procedure established by law, to apply to the competent supervisory authority in the field of personal data protection, the State Audit Office of Georgia, or to a court.

18. Changes to This Privacy Policy

The Company may periodically update or amend this Privacy Policy, including due to changes in the Company's activities, website functionality, technologies used or applicable legal requirements.

The updated Policy will be published on the website and will indicate the date of the latest update.

If a change by its nature requires additional notification to the user or consent, the Company will act in accordance with applicable law.

19. Contact Information

For questions and requests related to this Privacy Policy, the processing of personal data or the exercise of data subject rights, you may contact:

AQUAREA LLC
Identification code: 406514703
Address: 37 Davari St., Didi Dighomi, Tbilisi 0159, Georgia
Email: info@aquarea.ge
Phone: +995 32 2 12 22 32
Website: www.aquarea.ge