1. Who processes the data

1.1. Website operator and data controller: IE “Alexey Polyanskiy”, ID 306427916, Politsiis St., Isani-Samgori, Tbilisi, Georgia. Contact for data-related requests: a1@100doc.ge.

1.2. When processing data for its own purposes (providing the service, support) the Operator acts as a data controller. When processing data on behalf of the Insurer for the issuance of a policy, the Operator acts as a processor, and the controller is JSC "IRAO" (ID 205023856).

2. What data is processed

• Identification data: first name, last name, passport number, date of birth, nationality, gender.
• Contact data: e-mail, phone number.
• Trip data: dates, policy term, selected product.
• Payment data: payment amount. Card data is processed by the payment provider; the Operator does not store bank card data.
• Technical data: cookies and similar technologies (see Section 8).

3. Purposes of processing

3.1. Arranging and issuing the insurance policy (transferring data to the Insurer).

3.2. Providing the service, user support, performance of the contract (offer).

3.3. Fulfilment of obligations imposed by the legislation of Georgia.

3.4. Marketing — only with separate consent.

4. Legal grounds

4.1. Processing for the conclusion and performance of the contract — on the grounds provided for by the Law "On Personal Data Protection".

4.2. Processing for direct marketing — only with separate consent; consent may be withdrawn at any time, free of charge.

5. Disclosure of data to third parties

5.1. To the Insurer (JSC "IRAO") — for registration and issuance of the policy and performance of the insurance contract.

5.2. To the payment provider — for processing payment.

5.3. To other persons — only where required by the legislation of Georgia or necessary for the performance of the contract.

5.4. Cross-border transfer of data is carried out only where an adequate level of protection is ensured.

6. Rights of the data subject

In accordance with the Law "On Personal Data Protection" you have the right to:

• obtain confirmation of the fact of processing and access to your data (Art. 14);
• request correction, updating, blocking or deletion of data (Art. 22);
• withdraw consent at any time — free of charge and without giving reasons;
• object to processing for direct marketing purposes;
• appeal the Operator's actions to the Personal Data Protection Service of Georgia and/or to court.

Requests are sent to a1@100doc.ge. A response will be provided within the time limits set by law.

7. Storage and security

7.1. Data is stored for the period necessary to provide the service and to fulfil obligations under the law; upon expiry of that period it is deleted.

7.2. The Operator applies technical and organisational protective measures (encryption, access restriction, HTTPS) in accordance with the principles of lawfulness, minimisation and security.

7.3. In the event of a data incident, the Operator notifies the Personal Data Protection Service within 72 hours, and, where there is a significant threat to rights, also the data subject.

8. Cookies and analytics

8.1. The website uses technically necessary cookies (for the operation of the Service) and — only with the user's consent — analytical and marketing cookies/pixels. Non-essential cookies are disabled by default and are enabled after consent is given in the banner.

8.2. The user may change their choice in cookie settings at any time.

9. Changes

9.1. The Operator has the right to update this Policy; the current version is published on the website together with its date.

10. Contact

For questions regarding the processing of personal data: a1@100doc.ge