Privacy Policy
Last updated:
1. Data Controller
Company: Craftbox
Address: დავით ყიფიანის 2#, Tbilisi 0154, Georgia
Email: info@craftbox.ge
Phone: +995 557 23 42 22
Craftbox is the Data Controller under GDPR Article 4(7) for all data we collect through this website.
2. What Data We Collect
2.1 Order Data
When you place an order we collect the following personal data:
- •First and last name — for delivery and confirmation
- •Phone number — to notify you of order status
- •Email address — order confirmation and receipt
- •Delivery address — to provide the courier service
- •Order contents — personalisation requests and photo material
2.2 Analytics Data
When you use the site (with your consent) we collect:
- •Hashed IP address — for geographic statistics (not stored in directly identifiable form)
- •Device type and browser — for technical optimisation
- •Pages viewed and clicks — to improve content
- •Referral source — to measure advertising effectiveness
3. Lawful Basis for Processing
Order data
We process name, phone, address and order details to perform the contract between you and Craftbox (GDPR Art. 6(1)(b)).
Analytics and marketing
We load Google Analytics and Facebook Pixel only after your consent via the cookie banner (GDPR Art. 6(1)(a)).
4. Third Parties and Data Transfers
Your data may be shared with the following third parties solely for the purpose of providing the service:
| Service | Purpose | Basis | Policy |
|---|---|---|---|
| Railway (PostgreSQL) | Storage of orders and data | Contract | View |
| Google Analytics 4 | Site analytics | Consent | View |
| Facebook Pixel | Ad optimisation | Consent | View |
| Telegram Bot API | Order notification | Contract | View |
Analytics services (Google, Facebook) may transfer data outside the European Economic Area. Transfers are made on the basis of Standard Contractual Clauses (SCCs) (GDPR Article 46).
5. Data Retention Periods
Hashed IP, device info and session data are automatically deleted after 90 days.
Name, address and order history — to meet accounting obligations (Georgian Tax Code, Art. 49).
6. Your Rights
In accordance with Chapter III of the GDPR, you have the following rights:
Exercising your rights
Send your request to info@craftbox.ge. We will respond within 30 calendar days (GDPR Art. 12). Requests may be submitted in Georgian or English.
Data Deletion
If you signed in with Facebook (or Google), you can delete your account and the personal data linked to it at any time:
- Go to your account → settings → “Delete account”, and confirm.
- Or email us at info@craftbox.ge — we process the request within 30 calendar days.
We delete: your account, wishlist, coupons, gift-assistant chat history and marketing data. Transactional records (orders) are anonymised — personal fields are erased but the record is retained to meet accounting obligations (GDPR Art. 6(1)(c); Georgian Tax Code).
7. Cookies
craftbox.ge uses cookies and localStorage. Analytics and marketing cookies are activated only after your consent. For full information, see:
Cookie Policy8. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights, we will notify you without undue delay and no later than 72 hours after becoming aware of the breach, in accordance with GDPR Art. 33–34. Notification will be made by email.
9. Changes to this Policy
In the event of a material change to this policy, we will notify you by email or a prominent banner on the site. The current version is always available on this page. Continued use after a change constitutes acceptance.
10. Sub-processors
CraftBox uses the following trusted sub-processors under GDPR Art. 28. Each has a Data Processing Agreement (DPA) or Standard Contractual Clauses (SCCs) covering transfers outside the European Economic Area (EEA).
| Service | Purpose | Location | Transfer basis |
|---|---|---|---|
| Vercel Inc. | Web hosting, CDN, edge functions | US | SCC (Art. 46) |
| Railway Corp. | PostgreSQL database (orders, accounts) | US | SCC (Art. 46) |
| Cloudinary Ltd. | Product image storage & optimisation | US / EU | SCC (Art. 46) |
| Resend Inc. | Transactional email (order confirmation) | US | SCC (Art. 46) |
| Sentry (Functional Software, Inc.) | Error monitoring and crash reporting | US / EU | SCC (Art. 46) |
| Upstash Inc. | Redis cache — rate-limiting, session state | US / EU | SCC (Art. 46) |
| Google LLC | Google Analytics 4 (analytics) + Google OAuth (sign-in) | US | SCC (Art. 46) |
| Meta Platforms Ireland Ltd. | Facebook Pixel + Conversions API (CAPI) — ad optimisation | IE / US | SCC (Art. 46) |
| JSC Bank of Georgia (BOG) | Payment processing (iPay) | Georgia (GE) | Contract (Art. 6(1)(b)) |
Transfers to sub-processors outside the EEA (US) are made under Standard Contractual Clauses (SCCs) pursuant to GDPR Art. 46. We publish an updated sub-processor list on this page whenever a material change is made.
Questions about privacy?
Contact us — we respond within 1–2 working days.