Privacy policy
1. Data controller
Iberogeorgia
Tax ID: 406337432
Pekini 35, Tbilisi, Georgia
Email: [email protected]
2. Data we collect
We only collect data necessary to provide our services:
2.1 Form data
When you use the contact form or custom-trip form, you provide us with: name, email, phone (optional), country (optional) and the content of your message. This data is stored in our database and sent by email to our contact address.
2.2 Automatic technical data
When you browse the site, our server automatically records: IP address (used ephemerally, not stored in the database), browser and OS type, pages visited, time on page, referrer, country code (via Cloudflare, ISO-2 only) and an anonymous session identifier that rotates every 24 hours.
2.3 Google Analytics
If you accept analytics cookies, Google Analytics collects aggregated information about site usage. See section 5 (cookies).
3. Purpose and legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Respond to your enquiries and handle custom trips | Pre-contractual measures (6.1.b) |
| Necessary cookies and anonymous internal analytics | Legitimate interest (6.1.f) |
| Google Analytics with cookies | Consent (6.1.a) |
| Tax and accounting obligations | Legal obligation (6.1.c) |
| Defense against claims | Legitimate interest (6.1.f) |
4. Recipients and international transfers
We only share your data with the following providers acting as data processors:
- Hostinger International Ltd. (Cyprus/Lithuania) — web hosting and database. Data inside the EU.
- Cloudflare, Inc. (USA) — CDN and DDoS protection. Transfer under the EU-US Data Privacy Framework.
- Google Ireland Ltd. / Google LLC (Ireland/USA) — Google Analytics. Only if you accept analytics cookies. Transfer under the Data Privacy Framework.
- Google LLC (USA) — reCAPTCHA v3 to protect forms against spam.
- SMTP provider (Hostinger) — to send confirmation and notification emails.
We do not share your data with third parties for commercial purposes, nor do we sell it.
5. Cookies
See our cookie policy for details on the cookies we use and how to disable them.
6. Retention periods
- Contact form data: up to 3 years from last contact, unless longer legal retention applies.
- Anonymous internal analytics: up to 14 months.
- Technical server logs: up to 30 days.
- Consent cookies: 6 months.
7. Your rights
You can exercise the following GDPR rights at any time:
- Access: know what data we hold about you.
- Rectification: correct inaccurate data.
- Erasure (right to be forgotten): ask us to delete your data.
- Objection: object to the processing.
- Restriction: ask us to restrict processing.
- Portability: receive your data in a machine-readable format.
- Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.
To exercise them, write to [email protected] specifying which right. We will respond within 30 days.
You also have the right to file a complaint with a supervisory authority in your country of residence.
8. Security
We apply reasonable technical and organizational measures to protect your data: HTTPS connection, Cloudflare protection, origin server access restriction, CSRF on forms, reCAPTCHA and blocking of unauthorized IPs.
9. Minors
This site is not directed to children under 16. We do not knowingly collect data from minors.
10. Changes to this policy
We may update this policy. The date of last update appears at the top. If we make substantial changes, we will notify you visibly.