BeeTravel Guide Privacy Policy

1. General provisions

1.1. This Personal Data Processing Policy (the Policy) sets out how personal data is processed and the security measures taken by Georgian individual entrepreneur DMITRII STARIKOV, trading as BeeTravel Guide (the Operator).

1.2. The Operator’s core priority is to respect human rights and freedoms when processing personal data, including the right to privacy.

1.3. The Policy applies to all information the Operator may obtain about visitors and customers of:

• https://beetravel.guide
• https://g.beetravel.guide
• https://in.beetravel.guide
• https://lk.beetravel.guide

(collectively, the Website), as well as in connection with orders and support.

1.4. The Policy is drawn up in accordance with:

• Law of Georgia on Personal Data Protection No. 6156 of 14.06.2023;
• mandatory consumer-protection rules applicable to relations with the Customer;
• Regulation (EU) 2016/679 (GDPR) — to the extent applicable to data subjects in the European Economic Area.

1.5. Operator details:

• Full name: Individual Entrepreneur DMITRII STARIKOV;
• Legal form: Georgian individual entrepreneur;
• Brand: BeeTravel Guide;
• Identification number: 306461058;
• Legal address: Georgia, Tbilisi, Samgori District, Police I Lane N5, Floor 2, N4a;
• E-mail for personal data requests: hello@beetravel.guide;
• Phone: +995 599 18 22 74.

2. Key terms used in this Policy

2.1. Automated processing of personal data — processing of personal data using computer equipment.

2.2. Blocking of personal data — temporary suspension of personal data processing (unless processing is necessary to clarify personal data).

2.3. Website — the collection of pages and services of BeeTravel Guide at the addresses specified in clause 1.3.

2.4. Depersonalisation (anonymisation) — actions that make it impossible to determine the ownership of personal data by a specific User without using additional information.

2.5. Personal data processing — any action or set of actions performed on personal data, including collection, recording, organisation, accumulation, storage, clarification, extraction, use, transfer, depersonalisation, blocking, deletion and destruction.

2.6. Operator — the person specified in clause 1.1 who independently determines the purposes and means of processing personal data.

2.7. Personal data — any information relating directly or indirectly to an identified or identifiable User of the Website.

2.8. User — any visitor to the Website, as well as a person placing an order or contacting support.

2.9. Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons.

2.10. Digital Content — digital self-guided audio tours and related materials sold under the BeeTravel Guide brand.

2.11. Payment provider — an entity processing payments on behalf of the Operator: Flitt (GEL payments) and Lava (USD and EUR payments).

3. Rights and duties of the Operator

3.1. The Operator has the right to:

• obtain from the data subject accurate information necessary for contract conclusion and performance, support and legal compliance;
• continue processing personal data without consent where permitted by applicable law (e.g. for contract performance, legal obligation or legitimate interests);
• independently determine the set of data protection measures adequate to the nature of processing and risks.

3.2. The Operator is obliged to:

• provide the data subject upon request with information about data processing in the scope provided by applicable law;
• respond to data subject inquiries within statutory deadlines;
• ensure unrestricted access to this Policy on the Website;
• take legal, organisational and technical measures to protect personal data;
• not disclose personal data to third parties without lawful grounds;
• perform other duties provided by applicable data protection law.

4. Rights and duties of data subjects

4.1. The data subject has the right (within the limits of applicable law, including Art. 30 of Georgian Law No. 6156 and GDPR):

• to receive information about the processing of their personal data;
• to request access, clarification, updating or correction of their data;
• to request deletion, restriction of processing or object to processing where provided by law;
• to data portability where applicable;
• to withdraw consent where processing is based on consent (withdrawal does not affect lawfulness of prior processing);
• to lodge a complaint with the Georgian data protection authority and/or a court.

4.2. The data subject is obliged to:

• provide accurate personal information necessary for ordering and delivery of access;
• promptly notify of changes affecting contract performance (e.g. e-mail address).

4.3. Persons providing false information or third-party data without legal grounds are liable under applicable law.

4.4. Requests regarding rights are sent to hello@beetravel.guide. The Operator may request verification details.

5. Principles of personal data processing

5.1. Processing is carried out on a lawful and fair basis.

5.2. Processing is limited to predetermined and legitimate purposes.

5.3. Only personal data adequate and relevant to the purposes of processing is processed; redundancy is not permitted.

5.4. Accuracy and timeliness of data are ensured.

5.5. Storage is for no longer than required by the purposes of processing, contract or law.

5.6. An appropriate level of personal data security is maintained.

6. Purposes and legal bases of processing

6.1. The Operator processes personal data for:

1. conclusion and performance of contracts for Digital Content (order placement, access provision and restoration);
2. payment processing and reconciliation with Flitt and Lava;
3. customer support (inquiries, technical troubleshooting);
4. service security and fraud prevention;
5. compliance with legal and accounting obligations;
6. improvement of the Website and routes based on anonymised/aggregated analytics;
7. advertising effectiveness measurement — only with User consent (sections 11–12);
8. information or marketing messages — only with consent where required by law.

6.2. Legal bases for processing:

• performance of a contract or steps prior to entering into a contract;
• compliance with a legal obligation of the Operator;
• the Operator’s legitimate interests in security, fraud prevention and service operation — provided they are not overridden by the data subject’s rights;
• the data subject’s consent — for optional analytics, advertising identifiers and marketing where consent is required.

7. Categories of personal data processed

7.1. Depending on how the User uses the Website, the Operator may process:

• first and last name (if provided);
• e-mail address;
• phone number (if provided);
• BeeTravel / customer-account identifiers;
• order details: items, amount, currency, payment status, order number, date and time;
• records of access granted to Digital Content;
• support messages and order-related correspondence;
• technical data: IP address, browser and device type, language, security and error logs;
• cookies and similar identifiers;
• marketing attribution data (for example, utm tags) if present when the User arrives on the Website;
• with analytics consent — data needed to measure advertising (see section 12).

7.2. Full payment-card details (card number, security code, and so on) are processed by the selected payment provider (Flitt or Lava). The Operator does not receive or store those full details.

7.3. The Operator does not require special categories of personal data (health, political opinions, and so on) to purchase Digital Content and does not aim to process them.

8. Recipients of personal data

8.1. Personal data is disclosed only to the extent necessary for the purposes of processing, to the following categories of recipients:

1. payment providers — Flitt (GEL) and Lava (USD/EUR) — to process and reconcile payments, refunds and fraud prevention;
2. hosting and infrastructure — to run the Website and store data;
3. e-mail services — to send order confirmations, access messages and support replies;
4. support and notification tools — if used to handle requests;
5. Meta Platforms Ireland Limited (Facebook, Instagram, Threads) — only with the User’s consent to analytics, in the scope and on the terms of section 12;
6. public authorities — where disclosure is required by law.

8.2. Each recipient processes data within its role and under applicable arrangements with the Operator, or as an independent controller — as stated for Meta in section 12.

8.3. The Operator does not sell Users’ personal data.

9. International transfers

9.1. Some providers may process data outside Georgia (including in the EEA or other countries).

9.2. Before any international transfer, the Operator applies the safeguards required by applicable law (contractual terms, risk assessment, and other mechanisms provided by law).

9.3. Transfers to Meta with analytics consent take place outside Georgia on the terms of section 12.

10. Retention periods

10.1. Order, payment and accounting data is retained for the periods required by applicable law and for as long as needed to resolve disputes.

10.2. Account and access data is retained while access to Digital Content remains available and while needed for support and contract performance, then for a limited period to protect the Operator’s legitimate interests (disputes, security), unless a longer period is required by law.

10.3. Security logs and technical logs are retained for a proportionate period needed for security and incident investigation.

10.4. Analytics data and marketing identifiers based on consent are processed until consent is withdrawn or until a proportionate retention period ends, after which they are deleted or anonymised unless the law requires otherwise.

10.5. When the purposes of processing are achieved, or another lawful ground for ending processing arises, personal data is deleted or anonymised unless retention is required by law or contract.

11. Cookies and first-party analytics

11.1. The Website uses necessary cookies and similar technologies for security, the shopping cart, checkout and account sign-in. These technologies are required for the service to work.

11.2. Optional analytics and marketing identifiers are not activated until the User has given the required consent (the “Allow analytics” button or equivalent).

11.3. The Operator uses its own anonymised / aggregated analytics to improve pages and tours. Screen recordings, payment-form contents and full payment details are not collected through this analytics.

11.4. The User may change the consent choice in the consent block on the Website (usually at the bottom of the page) and may also manage cookies in browser settings. Disabling necessary cookies may make some Website features unavailable.

12. Meta advertising: pixel and server-side events

12.1. If the User has allowed analytics, the Operator measures advertising performance on Facebook, Instagram and Threads. Some information is sent by the User’s browser; some is sent by the Operator’s server after payment has been confirmed by the payment provider.

12.2. In particular, the following may be sent:

• the name and time of the action (tour view, adding to a set, checkout start, purchase);
• the page address;
• order contents, amount, currency, order number;
• a technical event identifier;
• the e-mail address as an irreversible cryptographic hash;
• IP address, browser and device type;
• Meta advertising identifiers from Website cookies;
• the internal cart identifier.

12.3. The e-mail address is never sent in readable form. Card payment details, payment-form contents, support correspondence and screen recordings are never sent.

12.4. Purposes of the transfer: to measure which advertisement led to a purchase; to improve ad delivery; to show ads to people who have already visited the Website. Legal basis: the User’s consent.

12.5. Recipient: Meta Platforms Ireland Limited. Meta processes this information as an independent controller under its own rules. The transfer takes place outside Georgia; the required safeguards are applied before the transfer.

12.6. Until the User presses “Allow analytics”, the pixel is not loaded and no event is sent, including purchase information. If the User declined or later withdrew consent, nothing is sent, including from the Operator’s server.

12.7. The User may also manage advertising settings in their Meta account.

13. Operations performed on personal data

13.1. The Operator collects, records, organises, accumulates, stores, updates (clarifies, changes), retrieves, uses, discloses (provides, grants access), depersonalises, blocks, deletes and destroys personal data.

13.2. Processing is mixed: automated and/or non-automated, with or without transmission over communications networks.

14. Security of personal data

14.1. The Operator takes reasonable legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful acts.

14.2. No internet service can guarantee absolute security. If an incident is detected, the Operator takes the measures required by applicable law.

14.3. Access by staff and contractors to personal data is limited to what is needed for their duties.

15. Confidentiality

15.1. The Operator and other persons who have obtained access to personal data must not disclose or distribute it without the data subject’s consent, unless applicable law provides otherwise.

16. Final provisions

16.1. The User may obtain clarifications on personal-data processing by e-mailing hello@beetravel.guide.

16.2. Material changes to the Policy are published on the Website with a new effective date. The Policy remains in force until replaced by a new version.

16.3. Where consent is required for a new purpose, it will be requested before that processing begins.

16.4. The current version of the Policy is freely available on the Website’s “Privacy Policy” page.

16.5. Nothing in this Policy limits mandatory rights of the data subject or the consumer.