Privacy Policy
Draft for legal review — not yet in force. Last updated: [date of publication]
This policy explains what personal data Pupbox collects, why, who we share it with and your rights under the Law of Georgia on Personal Data Protection. We keep it short and plain on purpose — if anything is unclear, ask us.
1. Who is responsible
The controller of your data is [company legal name], identification code [ID code], [legal address]. Contact for anything about your data: [privacy@pupbox.ge]. [We have not appointed a personal data protection officer because we are not required to — or: our data protection officer is … — confirm.]
2. What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Name, email, phone, password (stored only as a one-way hash — never readable, even by us) | Your account, receipts, contacting you about orders | Contract |
| Delivery addresses | Delivering your boxes and products | Contract |
| Your dog’s profile: name, breed, size, weight, gender, allergies, food and toy preferences, chewing strength, notes | Choosing what goes in each box and keeping allergens out | Contract |
| Orders, subscriptions, payment status and amounts | Fulfilling orders, renewals you chose, refunds, accounting | Contract; legal obligation (tax and accounting records) |
| Gift recipient’s name, delivery address, phone, their dog’s profile, optional email, and your message | Delivering the gift boxes; telling the recipient a gift is on its way | Our legitimate interest in delivering a gift you bought; the recipient learns of it when we contact them or deliver |
| Referral links and who registered through them | Giving referral rewards and preventing abuse | Contract; legitimate interest (fraud prevention) |
| Messages you send us | Answering you | Contract; legitimate interest |
| Technical data: IP address and request logs on our servers | Security, preventing fraud, fixing errors | Legitimate interest |
Giving us account, address and dog details is necessary to sell you a box — without them we cannot deliver it. Everything marked optional on the site is optional.
We never receive your card details. Card payments are handled entirely by our payment provider; we only receive whether the payment succeeded and its amount.
Marketing. We send marketing emails only if you agreed to them. You can stop them at any time with the link in every email or by writing to us; we stop within 7 working days.
3. Who receives your data
We share only what each provider needs to do its job for us, under a written agreement:
- Payments: [Flitt — legal entity, country]
- Email delivery: [Resend, Inc., United States]
- Delivery: [courier name] receives your name, phone and address
- Hosting: [hosting provider and data centre country]
We do not sell your data and do not share it for others’ advertising. We disclose data to authorities only when the law requires it.
4. Transfers outside Georgia
[Some providers above process data outside Georgia (e.g. email delivery in the United States). We transfer data only where the law allows it — to countries recognised as providing adequate protection, or with the safeguards the law requires. Lawyer to confirm the basis for each provider and whether a permit is needed.]
5. How long we keep it
- Account and dog profiles: while your account is open; deleted within [30] days after you close it.
- Orders, invoices and payment records: for the period required by Georgian tax and accounting law [confirm — commonly 6 years].
- Gift recipient details: while the gift plan runs, then as part of the order records above.
- Marketing consent records: while we send you marketing and for 1 year after.
- Server logs: [90] days.
6. Your rights
You can ask us, free of charge, to:
- tell you what data we hold and how we use it, and give you a copy;
- correct, update or complete it;
- delete it or stop processing it, where the law allows;
- restrict (block) it while a question about it is resolved;
- give you the data you provided in a portable format;
- withdraw any consent you gave, as easily as you gave it.
Most details can be changed directly in My account. For anything else write to [privacy@pupbox.ge]. We answer within 10 working days (in exceptional cases up to 10 more, and we will tell you why). We do not make decisions about you based solely on automated processing.
If you think we have handled your data unlawfully you may complain to the State Audit Office of Georgia (personal data protection supervision) [confirm current supervisory authority and contact] or to a court.
7. Browser storage — no tracking cookies
We use no advertising or analytics cookies. The site keeps a few items in your browser’s local storage that it needs to work:
pupbox_token— keeps you signed in;pupbox_session— remembers your cart before you sign in;pupbox_lang— your language;pupbox_dismissed_popups,pupbox_popups_shown_today— so an offer you closed doesn’t keep reappearing.
Clearing your browser data removes them. If we ever add analytics or advertising tools we will ask for your consent first and update this policy.
8. Children
Our services are for adults. We do not knowingly collect data from anyone under 16.
9. Security
We protect your data with encryption in transit (HTTPS), passwords stored only as one-way hashes, access limited to staff who need it and regular updates. If a breach could seriously affect you, we will tell you without undue delay and notify the supervisory authority as the law requires.
10. Changes
We will post any change here with a new date, and tell you by email before significant changes take effect.