Privacy Policy
Your privacy is fundamental to us. This comprehensive policy explains how BBGeorgiaTravel collects, uses, processes, and protects your personal information in compliance with international privacy standards.
Our Privacy Commitment
BBGeorgiaTravel is committed to protecting your privacy and maintaining the confidentiality of your personal information. We use minimal data collection practices, focusing only on information necessary to provide exceptional travel experiences in Georgia. This policy is designed to be transparent about our data practices and your rights under Georgian, European (GDPR), and international privacy laws.
Legal Framework & Compliance
This Privacy Policy is designed to comply with multiple jurisdictions and international standards to ensure comprehensive protection for all our guests, regardless of their location:
Essential Service Providers
We work with trusted third-party service providers who help us operate our business:
- • Vercel: Website hosting and technical infrastructure
- • Google Analytics: Anonymous website usage analytics
- • Email Service Providers: Secure email communications
- • Payment Processors: Secure transaction processing (when applicable)
Safeguards: All service providers are bound by data processing agreements and GDPR compliance requirements.
Legal & Regulatory Disclosure
We may disclose personal information when required by law or to protect legitimate interests:
- • Georgian government agencies (taxation, tourism regulation)
- • Law enforcement (when legally required)
- • Emergency services (for guest safety)
- • Legal proceedings (court orders, subpoenas)
Process: We will notify you of such requests unless legally prohibited from doing so.
International Data Transfers
Your personal data is primarily processed and stored within Georgia. However, some of our service providers may process data internationally. We ensure appropriate safeguards are in place for any international transfers.
Transfer Safeguards
- • Adequacy Decisions: Transfers to countries with adequate data protection (EU, EEA)
- • Standard Contractual Clauses: EU-approved data transfer agreements
- • Certification Programs: Privacy Shield successors and equivalent protections
- • Binding Corporate Rules: For multinational service providers
Data Security & Protection Measures
We implement comprehensive technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.
Technical Safeguards
- • Encryption: All data transmissions use SSL/TLS encryption
- • Secure Hosting: Data stored on secure, monitored servers
- • Access Controls: Role-based access with multi-factor authentication
- • Regular Updates: Security patches and software updates
- • Backup Security: Encrypted backups with restricted access
Organizational Measures
- • Staff Training: Regular privacy and security training for all team members
- • Data Minimization: Collecting only necessary information
- • Access Limitation: Information accessed only by authorized personnel
- • Incident Response: Procedures for handling potential data breaches
- • Regular Audits: Internal security assessments and improvements
Data Retention Policy
We retain personal information only for as long as necessary:
- • Active Inquiries: Until service completion + 1 year
- • Completed Tours: 3 years for quality assurance and legal compliance
- • Financial Records: 7 years as required by Georgian tax law
- • Marketing Consent: Until withdrawn or 2 years of inactivity
- • Analytics Data: 26 months (Google Analytics default)
Your Privacy Rights
Under Georgian data protection law, GDPR, and international privacy standards, you have comprehensive rights regarding your personal information. These rights apply regardless of your location:
Access & Information Rights
- • Right to Access: Request copies of your personal data and information about how it's processed
- • Right to Information: Understand what data we have and why we process it
- • Data Portability: Receive your data in a structured, machine-readable format
Control & Correction Rights
- • Right to Rectification: Correct inaccurate or incomplete personal data
- • Right to Erasure: Request deletion of your personal data ("right to be forgotten")
- • Right to Restrict Processing: Limit how we use your data in certain circumstances
Consent & Objection Rights
- • Right to Withdraw Consent: Withdraw consent at any time for consent-based processing
- • Right to Object: Object to processing based on legitimate interest
- • Right to Opt-Out: Unsubscribe from communications (if applicable)
Complaint & Remedy Rights
- • Right to Complain: Lodge complaints with Georgian Data Protection Authority
- • Right to Judicial Remedy: Seek compensation for damages
- • Right to Representation: Authorize organizations to act on your behalf
How to Exercise Your Rights
To exercise any of these rights, contact us using the details below. We will respond within 30 days (1 month) as required by GDPR and Georgian law. For complex requests, we may extend this by up to 2 additional months with explanation.
No Cost: Exercising these rights is free of charge, unless requests are manifestly unfounded or excessive.
Children's Privacy Protection
We are committed to protecting the privacy of children and complying with international standards for child data protection.
Age Requirements & Parental Consent
- • Under 16 (GDPR): Parental consent required for data processing
- • Under 18 (Georgian Law): Parental/guardian involvement in booking process
- • Family Tours: Parents/guardians responsible for providing children's information
- • Special Protection: Enhanced security measures for any child-related data
If we become aware that we have collected personal information from a child without appropriate consent, we will delete such information immediately.
Data Breach Response
In the unlikely event of a data security incident, we have comprehensive procedures to protect your interests and comply with legal notification requirements.
Our Response Process
- • Immediate containment and assessment
- • Notification to authorities within 72 hours (GDPR)
- • Individual notification if high risk to rights
- • Remedial action and security improvements
Your Protection
- • Clear communication about what happened
- • Advice on protective measures you can take
- • Support for any resulting issues
- • Transparent reporting on resolution
California Residents' Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
California-Specific Rights
- • Right to Know: What personal information we collect and how we use it
- • Right to Delete: Request deletion of your personal information
- • Right to Opt-Out: Opt out of sale of personal information (we don't sell data)
- • Right to Non-Discrimination: Equal service regardless of privacy choices
- • Right to Correct: Request correction of inaccurate information
- • Right to Limit: Limit use of sensitive personal information
Third-Party Services & Integrations
Our website integrates with carefully selected third-party services to enhance functionality while maintaining your privacy. Each service has its own privacy practices:
Google Services
- • Google Analytics: Anonymous website usage statistics and performance monitoring
- • Google Maps: Location services, directions, and embedded maps
- • Gmail/Google Workspace: Secure email communications and file sharing
Privacy Policy: Google Privacy Policy
Hosting & Infrastructure
- • Vercel: Website hosting, content delivery, and performance optimization
- • Cloudflare: Security, DDoS protection, and global content delivery
- • Domain Services: Domain registration and DNS management
All providers maintain SOC 2 compliance and GDPR data processing agreements.
Analytics & Performance
- • Vercel Analytics: Privacy-first analytics that track page views and basic user interactions without cookies or personal data collection
- • Google Analytics: Anonymous website usage statistics and performance monitoring (uses cookies)
- • Performance Monitoring: Website speed, uptime, and technical performance tracking
Vercel Analytics Privacy Policy: Vercel Privacy Policy
Social Media & External Links
- • Social Media Platforms: Links to our profiles (Facebook, Instagram, etc.)
- • External Websites: Links to Georgian tourism sites and partner websites
- • Review Platforms: Links to TripAdvisor, Google Reviews, etc.
When you click external links, you're subject to their respective privacy policies.
Contact Us About Privacy
For any questions about this Privacy Policy, to exercise your rights, or to report privacy concerns, please contact us through any of these methods:
Tbilisi, Georgia
Postal address available upon request
Within 48 hours for acknowledgment
Full response within 30 days (GDPR compliance)
Supervisory Authorities & Complaints
You have the right to lodge complaints with relevant data protection authorities if you believe we have not adequately addressed your privacy concerns:
Georgian Data Protection Authority
Primary authority for Georgian data protection law compliance
Contact information available through Georgian government portals
EU Data Protection Authorities
For EU citizens: Your local data protection authority
Find your authority at: ec.europa.eu/data-protection
Policy Updates & Changes
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We are committed to transparent communication about any changes.
Update Notification Process
- • Website Notice: Updated policy posted with effective date
- • Email Notification: For material changes affecting your rights
- • Continued Use: Using our services after updates constitutes acceptance
- • Withdrawal Option: You may withdraw consent if you disagree with changes
Legal Framework Compliance
Georgian Law
Law of Georgia "On Personal Data Protection" - Primary governing legislation
GDPR Compliance
European Union General Data Protection Regulation for EU citizens
CCPA & Global Standards
California Consumer Privacy Act and international best practices
Data Controller Information
Data Controller Details
Legal Name: BBGeorgiaTravel LLC
Registered Address: 21 M. Tamarashvili Street, 0186, Tbilisi, Georgia
Business Type: Tourism and Travel Services
Contact: info@bbgeorgiatravel.com
Phone: +995 558 93 02 02
Jurisdiction: Georgia
As the data controller, BBGeorgiaTravel determines the purposes and means of processing your personal data and is responsible for ensuring compliance with applicable data protection laws.
Information We Collect
We practice data minimization, collecting only information that is necessary to provide our travel services. Here's a comprehensive breakdown of what we collect and why:
Information You Provide Directly
Contact & Identity Information
- • Full name (first and last name)
- • Email address
- • Phone number
- • Country/city of residence
- • Preferred language for communication
Legal Basis: Legitimate interest for service provision
Travel & Booking Information
- • Preferred destinations in Georgia
- • Travel dates and duration
- • Group size and composition
- • Special requirements (dietary, accessibility)
- • Budget preferences and payment information
Legal Basis: Contract performance and legitimate interest
Information Collected Automatically
Website Analytics Data
- • Pages visited and time spent
- • Referral sources (how you found us)
- • Geographic location (country/city level)
- • Device and browser information
- • Website interaction patterns
Legal Basis: Legitimate interest for website improvement
Technical Information
- • IP address (anonymized)
- • Browser type and version
- • Operating system
- • Screen resolution
- • Connection speed and type
Legal Basis: Legitimate interest for security and functionality
What We Do NOT Collect
In line with our privacy-first approach, we explicitly do NOT collect:
- • Credit card or financial details (unless booking)
- • Passport or government ID numbers
- • Social security or tax identification numbers
- • Biometric or health data
- • Personal browsing history outside our site
- • Social media profiles or personal posts
- • Location tracking when not using our services
- • Any sensitive personal characteristics
Legal Basis for Data Processing
Under GDPR and Georgian data protection law, we must have a legal basis for processing your personal data. Here are the legal bases we rely on:
Contract Performance (GDPR Art. 6(1)(b))
Processing necessary for the performance of a contract with you or to take steps prior to entering into a contract.
Examples: Tour bookings, itinerary creation, travel arrangements, customer support
Legitimate Interest (GDPR Art. 6(1)(f))
Processing necessary for legitimate interests pursued by us, provided your rights are not overridden.
Examples: Website analytics, service improvement, fraud prevention, business communications
Consent (GDPR Art. 6(1)(a))
Processing based on your explicit consent for specific purposes.
Examples: Marketing communications (if requested), special data categories, optional services
Legal Obligation (GDPR Art. 6(1)(c))
Processing necessary for compliance with legal obligations.
Examples: Tax records, tourism reporting, safety regulations compliance
How We Use Your Information
We process your personal information transparently and only for specific, legitimate purposes. Here's a detailed breakdown:
Primary Travel Services
- • Itinerary Creation: Designing personalized travel experiences based on your preferences
- • Booking Coordination: Arranging accommodations, transportation, and activities
- • Guide Assignment: Matching you with appropriate local guides
- • Customer Support: Providing assistance before, during, and after your trip
- • Emergency Assistance: 24/7 support during your stay in Georgia
Business Operations & Improvement
- • Service Enhancement: Analyzing feedback to improve tour quality
- • Website Optimization: Understanding user behavior to improve site experience
- • Quality Assurance: Monitoring service delivery and customer satisfaction
- • Business Analytics: Aggregated, anonymized data for business planning
Legal & Compliance Purposes
- • Tax Compliance: Meeting Georgian tax reporting requirements
- • Tourism Regulations: Compliance with Georgian Ministry of Tourism standards
- • Safety Protocols: Maintaining records for emergency and safety purposes
- • Anti-Fraud: Preventing fraudulent bookings and protecting legitimate customers
What We Never Use Your Information For
- • Unsolicited marketing or promotional communications
- • Selling, renting, or sharing your data with third parties for profit
- • Creating detailed personal profiles for advertising
- • Cross-site tracking or behavioral profiling
- • Any commercial purposes unrelated to your travel experience
Cookies & Tracking Technologies
We use minimal cookies and tracking technologies, primarily for essential website functionality and basic analytics. Our approach prioritizes your privacy while ensuring optimal website performance.
Our Cookie Usage
- • Google Analytics: Anonymous website usage statistics to improve user experience
- • Vercel Platform: Essential cookies for website hosting, security, and performance
- • Session Management: Temporary cookies for form functionality and security
- • No Tracking: We do not use advertising cookies, social media pixels, or cross-site tracking
For detailed information about our cookie usage, please see our Cookies Policy.
Information Sharing & Disclosure
We share your information only when necessary to provide our services or when required by law. We do not sell, rent, or trade your personal information for commercial purposes.
Georgian Travel Partners
We share relevant booking information with vetted local partners to deliver your travel experience:
- • Registered hotels and guesthouses for accommodation
- • Certified restaurants for dining experiences
- • Certified activity providers (wine tours, hiking, cultural sites)
- • Registered transportation providers
Safeguards: All partners sign data protection agreements and are bound by Georgian privacy laws.
Essential Service Providers
We work with trusted third-party service providers who help us operate our business:
- • Vercel: Website hosting and technical infrastructure
- • Google Analytics: Anonymous website usage analytics
- • Email Service Providers: Secure email communications
- • Payment Processors: Secure transaction processing (when applicable)
Safeguards: All service providers are bound by data processing agreements and GDPR compliance requirements.
Legal & Regulatory Disclosure
We may disclose personal information when required by law or to protect legitimate interests:
- • Georgian government agencies (taxation, tourism regulation)
- • Law enforcement (when legally required)
- • Emergency services (for guest safety)
- • Legal proceedings (court orders, subpoenas)
Process: We will notify you of such requests unless legally prohibited from doing so.
Data Retention
We retain your personal information only for as long as necessary to fulfill the purposes outlined in this privacy policy, unless a longer retention period is required or permitted by Georgian law (such as tax, accounting, or other legal requirements). When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.
Retention Periods by Data Type
Active Service Data
- • Active Inquiries: Until service completion + 1 year
- • Completed Tours: 3 years for quality assurance
- • Customer Support: 2 years after last interaction
Legal & Technical Data
- • Financial Records: 7 years (Georgian tax law)
- • Analytics Data: 26 months (Google Analytics)
- • Security Logs: 12 months
- • Vercel Analytics: Anonymized data retained per Vercel's privacy policy
Data Deletion Process
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.
Backup Archives: Personal data in secure backup systems is isolated and deleted according to our data retention schedule or upon request where technically feasible.
Related Legal Documents
This Privacy Policy is part of our commitment to transparency and your right to privacy. For the best experience, please also review our Terms & Conditions and Cookies Policy.