1. Who we are
1.1. The controller of your personal data is RetailReport.id — “we”.
1.2. We process personal data in accordance with the Law of Georgia on Personal Data Protection of 14 June 2023 (No. 3144-XIმს-Xმპ, in force since 1 March 2024; the “Data Protection Law”). Where the data protection law of your country also applies to our processing because we offer services to people in that country — for example, Law of the Republic of Indonesia No. 27 of 2022 on Personal Data Protection (PDP Law) —, we comply with it to the extent it is mandatory, and you have the rights it gives you.
1.3. For questions or requests about personal data, write to [email protected]. At this address you can also contact the person responsible for personal data protection.
1.4. The terms “Account”, “Database”, “Export”, “Sample”, “Contact Reveal” and “Order” have the meanings given in our Terms and conditions.
2. Information processed, purposes, legal bases and retention periods
2.1. Creating and managing the Account, signing in
- Data subjects: registered users.
- Information: email address, name (if given), the password stored only as a cryptographic hash (we never store the password itself), date and time of registration, the fact and the date and time of acceptance of the Terms and conditions, IP address and date and time of registration and of signing in.
- Legal basis: performance of the agreement with you — the Terms and conditions (Article 5(1)(b) of the Data Protection Law); for the IP address, also our legitimate interest in protecting the Account and the Website from unauthorized access (Article 5(1)(i)).
- Retention: until the Account is deleted; sign-in logs — 12 months; proof of acceptance of the Terms — 3 years after the Account is deleted, for the defense of rights in court.
2.2. Contact Reveal in the Samples and the daily limit
- Data subjects: registered users.
- Information: Account identifier, the organization revealed, date and time, IP address.
- Legal basis: performance of the Terms and conditions (Article 5(1)(b)); our legitimate interest in enforcing the limit and preventing abuse (Article 5(1)(i)).
- Retention: 12 months.
2.3. Processing of Orders, payment and accounting
- Data subjects: customers and contact persons of customer companies.
- Information: name, email address, phone number (if given), company name, Order comment, payment method, content and amount of the Order, payment information (without card details), IP address, the fact and the date and time of the consents given when ordering.
- Legal basis: performance of the agreement (Article 5(1)(b)); compliance with our accounting and tax obligations (Article 5(1)(c)).
- Retention: as long as required by the accounting and tax rules of Georgia (generally 6 years from the end of the year of the transaction); unpaid Orders — 1 year.
- Card details are entered on the page of the bank or the payment service provider; we neither receive nor store them.
2.4. Contact form and requests for custom data
- Data subjects: people who send us a message or a request.
- Information: name, email address, phone number (if given), subject and content of the message, the page from which the form was sent, IP address.
- Legal basis: your consent, given by ticking the box on the form (Article 5(1)(a)); where your request is aimed at concluding an agreement — also Article 5(1)(b).
- Retention: until we have replied and the correspondence has ended, for no more than 3 years, or until you withdraw your consent.
2.5. Operation and security of the Website
- Data subjects: visitors of the Website.
- Information: IP address, browser and device information (user agent), date and time of the request, the page requested and the referring page, cookie identifiers (section 5).
- Legal basis: our legitimate interest in ensuring the availability and security of the Website and protecting it from automated collection and attacks (Article 5(1)(i)).
- Retention: server logs — no more than 12 months; longer only for the duration of the investigation of a security incident.
2.6. We do not process special categories of personal data, do not take decisions that produce legal effects for you based solely on automated processing, and do not send you promotional messages. If you ever receive commercial communications from us, you can refuse them at any time free of charge; we will stop sending them within 7 business days at the latest.
3. Information about organizations in our Database
3.1. The Database contains information about organizations: names, business addresses, geographic coordinates, phone numbers, websites, email addresses, social media links, membership of chains and categories. Most of it concerns companies and their locations and is not personal data.
3.2. Some records may concern sole proprietors, freelancers or other individuals running a business. Where such information makes it possible to identify a person, it is that person’s personal data. We include only information related to the business or professional activity of the person (trade name, business address, business contacts) and do not collect information about their private life.
3.3. Sources: publicly accessible sources — business profiles on map services and directories, the websites of organizations and their pages on social media.
3.4. Purpose: running a business directory and providing Samples and Exports to our users for business purposes. Legal basis: the information has been made public by the data subject (Article 5(1)(e) of the Data Protection Law) and the legitimate interests of us and of our users, which do not override the rights of the data subjects because only business contacts are processed (Article 5(1)(i)).
3.5. Removal from the Database. If the Database contains your personal data and you do not want us to process it, write to [email protected] giving the phone number, email address or other details that make it possible to find the record (preferably with a link to the organization on the Website). Within 3 business days after receiving your request, we stop showing the information on the Website and including it in Exports; within 10 business days, we delete it from the Database and confirm this to you. So that it is not collected again from public sources, we keep only a minimal identifier (such as a phone number or an email address) in an exclusion list. We may ask you to confirm that the request comes from the data subject.
3.6. Exports delivered to customers before your request was received are held by those customers, who process the data as independent data controllers. On request, we will tell you to which categories of recipients your information has been disclosed.
3.7. Representatives of an organization can also ask us, at the same address, to correct or delete information about their organization.
4. Recipients of the information
4.1. We do not sell the personal data of our users and customers. We disclose it only as far as necessary for the purposes in section 2:
- to hosting providers and data centers — to store the data of the Website;
- to banks and payment service providers — to receive payments;
- to email delivery services — to send invoices, download links and replies;
- to accounting service providers — for our bookkeeping;
- to public authorities and courts — where required by law.
4.2. Our processors act on our written instructions, under agreements in accordance with Article 36 of the Data Protection Law, which include, among other things, confidentiality and security obligations.
5. Cookies and local storage
5.1. The Website uses only strictly necessary cookies: a session cookie for signing in and forms, and a cookie that protects the forms from cross-site request forgery (CSRF). Without these cookies, signing in, ordering and the forms do not work. We do not use advertising cookies or third-party analytics tools.
5.2. Your cart is kept in the local storage (localStorage) of your browser, on your device, and is sent to our server only when you place an Order. You can delete it by clearing the site data in your browser settings.
5.3. You can block cookies in your browser settings, but some functions of the Website will not be available.
5.4. Optional cookies (preferences, analytics and marketing) are used only with your consent, given in the cookie window on the first visit. You can change or withdraw your consent at any time through the “Cookie settings” link at the bottom of every page.
6. International transfers
6.1. Our servers and service providers may be located outside Georgia. We transfer personal data abroad only where permitted by the Data Protection Law (Articles 37 and 38): to countries and international organizations recognized as providing an adequate level of protection, or on the basis of appropriate safeguards, in particular agreements with the recipients and, where required, the permission of the supervisory authority, or on other grounds provided by that Law.
7. Your rights
7.1. Under the Data Protection Law (Articles 13 to 20), you have the right to:
- be informed about the processing of your information, access it and obtain a copy;
- request the correction, updating or completion of your information;
- request the deletion of your information or the termination of its processing, including restriction of access to publicly accessible information about you (Article 16);
- request the blocking of your information;
- receive the information you provided to us in a structured, machine-readable format (portability), where the processing is automated and based on consent or an agreement;
- withdraw your consent at any time, without affecting the lawfulness of earlier processing;
- object to direct marketing at any time;
- lodge a complaint with the supervisory authority — the State Audit Office of Georgia, which since 2 March 2026 has taken over the functions of the Personal Data Protection Service — or with a court. Where local law applies to our processing (section 1.2), you can also contact the competent local authority (the Ministry of Communication and Digital Affairs of the Republic of Indonesia).
7.2. Send your requests to [email protected]. We may ask you to confirm your identity; for users, a request sent from the email address of the Account or the Order is usually sufficient.
7.3. We reply within 10 business days after receiving the request. In exceptional circumstances, this period may be extended by no more than 10 business days; in that case we will tell you the reasons.
8. Security
8.1. We apply organizational and technical measures appropriate to the risk: restricted access granted according to function; passwords stored only as hashes; encrypted connections (HTTPS); event logging; regular review of our processing.
8.2. In the event of an incident involving personal data, we notify the supervisory authority within 72 hours after becoming aware of the incident, unless the incident is unlikely to cause harm, and we notify the people affected without undue delay where there is a high risk to them (Articles 29 and 30 of the Data Protection Law).
9. Final provisions
9.1. The Website is intended for companies and professional users, not for people under the age of 18.
9.2. We may update this Privacy policy. A new version applies from its publication on this page, unless stated otherwise.
9.3. Information about our company is given in section 1 and in the Terms and conditions.