Privacy Policy

We collect information that you provide directly to us and information that is generated automatically when you interact with tshop.ge.

Information you provide at registration and during use of the service:

• Email address (verified via a 6-digit code we send by email)
• Full name — for individual (PERSON) accounts
• Company / legal name and business identification number — for organization (ORGANIZATION) accounts
• Phone number
• Billing and shipping address
• Password (stored only as a salted bcrypt hash — we never store, log, or transmit your plaintext password)
• Customer type (individual or organization) and assigned pricing role (CORPORATE, DILER, or VIP — VIP is assigned only by tshop.ge administrators)
• Order history, cart contents, and any messages you send to support

Information collected automatically:

• IP address and approximate geographic location
• Browser user-agent string and device type
• Operating system and screen settings
• Language preference
• Referral source (the page that brought you to us)
• Session duration and time on page
• List of products you viewed and pages you visited

We use your information for the purposes below, each grounded in a specific legal basis in line with GDPR principles:

• Performance of a contract — to create and authenticate your account, process and fulfil orders, apply role-based pricing, send transactional emails (verification codes, order confirmations, shipment updates, password resets), and handle returns and refunds.
• Legal obligation — to keep order, invoice, and tax records for the period required by applicable accounting and tax law in Georgia.
• Legitimate interest — to keep tshop.ge secure (fraud prevention, abuse detection, rate limiting), to understand aggregated usage patterns, to improve the product, and to provide customer support. We balance this against your rights and you may object at any time.
• Consent — for non-essential cookies (analytics and marketing) and for optional marketing communications. You can withdraw consent at any time via the cookie preferences panel or by unsubscribing from any marketing email.

tshop.ge does not sell your personal information. We share data only with the categories of trusted processors required to run the service, and only to the extent necessary for each purpose:

• Cloud storage providers — Amazon Web Services (AWS S3) for hosting product images, documents, and uploaded files.
• Email delivery providers — our SMTP provider (Nodemailer-compatible) for sending verification codes, order confirmations, shipping updates, and password-reset emails.
• Payment processors — for card payments, bank transfers, and cash-on-delivery handling. Payment data is processed by the relevant provider; tshop.ge does not store full card numbers.
• Logistics and delivery partners — to fulfil and ship your orders. They receive only the data needed for delivery (name, address, phone).
• Professional advisors and authorities — when required by law, court order, or to defend our legal rights.

All processors are bound by contract to safeguard your data and use it only for the purposes we specify. Where data is transferred outside Georgia or the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses.

We protect your information with controls that include HTTPS/TLS encryption for data in transit, encryption at rest for files stored in AWS S3, passwords hashed with bcrypt (never stored in plaintext), HTTP-only authentication cookies that are inaccessible to JavaScript, role-based access controls inside our systems, and routine security review of dependencies and infrastructure. No system is ever completely secure, so if you become aware of a vulnerability or suspect your account has been compromised, please contact us immediately at privacy@tshop.ge.

tshop.ge uses cookies and similar local-storage technologies to keep you signed in, remember your preferences, and (with your consent) measure how the site is used. You can review and change your choices any time via the cookie preferences panel on this site.

Strictly necessary — required for the platform to function. These cannot be switched off.

• accessToken — HTTP-only JWT, short-lived (~15 minutes), authenticates your session.
• refreshToken — HTTP-only JWT, long-lived (~7 days), used to renew your session securely.
• tsshop-cookie-consent — localStorage entry that records the consent choices you made on this site.
• cookie_consent — 1-year cookie that mirrors your consent on the server so preferences apply during server-side rendering.

Functional — improve usability and remember your preferences.

• NEXT_LOCALE — stores your selected language (English or Georgian).
• cart-store — localStorage entry that keeps your cart contents between visits.

Analytics — none active today. If we add analytics cookies in the future they will fire only after you grant consent, and we will list them here.

Marketing — none active today. If we add marketing or advertising cookies in the future they will fire only after you grant consent, and we will list them here.

Depending on your jurisdiction (and in line with GDPR for EU/EEA visitors), you have the following rights over your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete information.
• Right to erasure ("right to be forgotten") — ask us to delete your data where we are not legally required to keep it.
• Right to restriction — ask us to limit how we process your data in specific circumstances.
• Right to data portability — receive your data in a structured, machine-readable format and transmit it to another service.
• Right to object — object to processing based on legitimate interest, including profiling.
• Right to withdraw consent — withdraw any consent you have given (for example, marketing or analytics) at any time, without affecting prior lawful processing.
• Right to lodge a complaint — with the Personal Data Protection Service of Georgia, or your local supervisory authority if you are based in the EU/EEA.

To exercise any of these rights, email privacy@tshop.ge. We will respond within 30 days and may ask you to verify your identity before fulfilling the request.

We keep your personal data only as long as we need it for the purpose we collected it, after which we delete or anonymize it. In practice:

• Account data — kept while your account is active and for a short grace period after closure so you can recover access.
• Order, invoice, and payment records — retained for the period required by Georgian tax and accounting law (typically several years), even after account closure.
• Email verification codes and password-reset codes — short-lived; expire and are deleted shortly after issue.
• Authentication tokens — access tokens expire in minutes, refresh tokens in days.
• Support correspondence — retained for a reasonable period to handle follow-ups and quality assurance.
• Logs and security events — retained for a limited period for security and abuse-prevention purposes, then deleted or aggregated.

tshop.ge is not directed to children and is intended for users aged 16 and over. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact privacy@tshop.ge and we will delete the data promptly.

We may update this Privacy Policy to reflect changes in our practices, our service, or applicable law. When we make material changes we will revise the "Last updated" date at the top of this page and, where appropriate, notify you in advance by email or via an in-app notice. We encourage you to review this page periodically.

tshop.ge operates from Tbilisi, Georgia. If you have any questions, concerns, or requests about this Privacy Policy or your personal data, please contact our privacy team at privacy@tshop.ge. For general support, write to support@tshop.ge. We aim to respond within 30 days.