Privacy policy

1. Who processes your data

The data controller is an individual entrepreneur, identification number 345788506 (Georgia), operating as Grig Studio (the “studio”, “we”).

This policy covers the website grig-studio.ge, the client account at my.grig-studio.ge and project demos on demo.grig-studio.ge subdomains. It is drawn up under the Law of Georgia on Personal Data Protection of 14 June 2023.

For any question about your data, contact us: Telegram @grigstudioo or WhatsApp.

2. What data we collect

• From the request form: your name, Telegram or WhatsApp to reply to, what you need, budget, your message, the language and the page the request was sent from.
• From our conversations: what you write to us on Telegram, WhatsApp or in the client account, and the files you send.
• For contract work: your name or company name, contact, the contract, project stages and payments.
• Technical data: IP address, browser and device type, time of the request. We need it to protect against spam and break-ins.

We don’t collect special categories of data (health, beliefs and so on) and ask you not to include them in a request.

3. Why we use it

• To reply to your request, discuss the task and propose a solution and timeline.
• To conclude and perform a contract: build the project, show progress in the client account, accept payments.
• To protect the website, client account and demos from spam and unauthorised access.
• To comply with Georgian law, including tax law.

We don’t use your data for advertising and don’t make decisions about you by automated means alone.

4. Legal grounds

• Your consent: when you send a request or write to us.
• Contract: when the data is needed to conclude or perform a contract with you.
• Legal obligation: keeping records for accounting and tax purposes.
• The studio’s legitimate interest: website security and protection against abuse.

5. Who we share data with

We don’t sell your data or share it with third parties for their own purposes. Data is processed only by providers the website can’t work without:

• Hetzner Online GmbH (Germany, EU): the server that stores the website, client account and requests.
• Cloudflare, Inc.: the network that makes the website load fast and protects it from attacks.
• Telegram and WhatsApp: if you choose to talk to us there; their own privacy rules apply.

Data is transferred outside Georgia only to countries with an adequate level of data protection or with safeguards provided by law. Data may be disclosed to public authorities only where Georgian law expressly requires it.

6. How long we keep data

• A request without a contract: up to 3 years after our last contact or until you withdraw consent.
• Contract data: for the duration of the project and afterwards for as long as Georgian tax and accounting law requires.
• Technical logs: up to 90 days.

After that, data is deleted or anonymised.

7. Cookies and browser storage

The website uses no advertising or analytics cookies and doesn’t track you across other sites. Your browser only remembers the language and theme (light or dark) you chose. The client account uses a sign-in cookie, without which you can’t sign in.

8. Your rights

Under the law, you can at any time:

• find out whether we process your data, which data and why;
• access your data and get a copy;
• ask us to correct, update or complete it;
• ask us to delete your data or restrict its processing;
• withdraw consent (this doesn’t affect processing carried out before);
• receive your data in a convenient machine-readable format;
• object to decisions made by automated means alone.

Write to us on Telegram or WhatsApp. We’ll reply within 10 working days. If we need more time, we’ll let you know, and the period may be extended by no more than another 10 working days.

If you believe your rights have been violated, you can file a complaint with the State Audit Office of Georgia, which has supervised personal data protection since 2 March 2026, or go to court.

9. How we protect data

The website and client account work only over a secure connection (HTTPS). Only the studio has access to requests and projects. Admin sign-in is protected by a password and confirmation, and sign-ins are logged. The server makes daily backups. In case of a data breach, we’ll notify the supervisory authority and you in the cases and within the time limits set by law.

10. Children

The website is intended for adults and businesses. If you are under 16, you may send a request only with the consent of a parent or legal guardian.

11. Changes

We may update this policy. The new version is published on this page with the date of the change.