Legal
Last updated: August 10, 2026 · Effective: August 10, 2026
At Everything Street we take your privacy seriously. This policy explains what personal data we collect, why we collect it, how we use it, and your rights — in plain language.
Everything Street Shalva Nutsubidze St, Tbilisi, Georgia Email: legal@everythingstreet.ge Phone: +995 500 09 06 14 This Privacy Policy explains how we collect, use, and protect your personal data when you use our website or place an order. It is governed primarily by Georgia's Law on Personal Data Protection (Law No. 5669, as amended) and, where applicable to customers in the European Economic Area or United Kingdom, by the General Data Protection Regulation (GDPR) and UK GDPR.
a) Account & Order Data When you create an account or place an order, we collect your name, email address, phone number, shipping address, and billing address. Legal basis: Performance of contract (GDPR Art. 6(1)(b)). b) Payment Data We do not store, see, or process your card number, CVV, or full payment details. All payment data is transmitted directly to Stripe Payments Europe Ltd. See Stripe's Privacy Policy: stripe.com/privacy Legal basis: Performance of contract; legal obligation. c) Stripe Radar — Automated Fraud Screening Stripe uses automated fraud detection technology that analyses transaction signals — including IP address, device fingerprint, and purchase patterns. If you believe a legitimate order was incorrectly declined, contact us at hello@everythingstreet.ge. Legal basis: Legitimate interests — fraud prevention (GDPR Art. 6(1)(f)). d) Device & Technical Data When you visit our website, we automatically collect your IP address, browser type, operating system, pages visited, and referring URLs. Legal basis: Legitimate interests (site security and operation). e) Analytics Data We use Google Analytics 4 (GA4) to collect anonymised usage statistics. GA4 cookies are only activated after you provide consent. Legal basis: Consent (GDPR Art. 6(1)(a)). f) Marketing Communications If you subscribe to our newsletter, we store your email address and a record of your consent. You may unsubscribe at any time. Legal basis: Consent (GDPR Art. 6(1)(a)). g) Customer Support If you contact us by email, we retain the content of those communications. Legal basis: Legitimate interests.
We use your personal data to: • Process and fulfil your orders, including arranging delivery • Process payments securely via Stripe • Detect and prevent fraud (Stripe Radar) • Send order confirmation, dispatch, and delivery notifications • Respond to customer service enquiries • Send marketing emails (with your consent only) • Analyse website usage and improve our services (with your consent) • Comply with Georgian tax, accounting, and legal obligations • Defend our legal rights if a dispute arises
We share your personal data only with service providers who require it to perform specific functions. We do not sell your personal data. • Stripe Payments Europe Ltd — payment processing and fraud detection Location: United States and EU | Safeguard: Standard Contractual Clauses Policy: stripe.com/privacy • Supabase Inc. — database and file storage Location: EU region (Frankfurt, Germany) • Resend Inc. — transactional email delivery Location: United States | Safeguard: Standard Contractual Clauses • Vercel Inc. — website hosting and edge delivery Location: US and globally distributed edge nodes | Safeguard: SCCs • Google LLC (Google Analytics 4) — anonymised website analytics Location: United States | Safeguard: Standard Contractual Clauses Opt-out: tools.google.com/dlpage/gaoptout • Upstash Inc. — rate limiting and abuse prevention Location: EU region • Functional Software, Inc. (Sentry) — technical error monitoring Data: error details, browser type, IP address Location: EU region (Frankfurt, Germany) | Safeguard: Standard Contractual Clauses • Georgian tax authorities and regulatory bodies — where legally required • Law enforcement or courts — only when legally compelled
Several of our service providers process data outside the EEA and Georgia: • Stripe: United States — protected by EU Standard Contractual Clauses (SCCs) • Resend: United States — protected by EU Standard Contractual Clauses • Vercel: United States and global edge — protected by EU Standard Contractual Clauses • Google Analytics: United States — protected by SCCs and Google's Data Processing Terms Copies of applicable SCCs are available on request from legal@everythingstreet.ge.
We retain your personal data for the following periods: • Order records and transaction data: 7 years (required by Georgian tax and accounting law) • Account profile data: for the duration of your account, plus 2 years after you close it • Marketing consent records: until you withdraw consent, plus 3 years for audit purposes • Customer support communications: 3 years from the last exchange • Analytics data: 14 months • Payment records: per Stripe's own retention policy You may request earlier deletion of your data at any time.
Under Georgia's Law on Personal Data Protection and the GDPR (for EEA/UK residents), you have the following rights: • Right to access — request a copy of all personal data we hold about you • Right to rectification — ask us to correct inaccurate or incomplete data • Right to erasure — ask us to delete your personal data • Right to restrict processing • Right to data portability • Right to object • Rights related to automated decision-making — contact hello@everythingstreet.ge to request human review • Right to withdraw consent — at any time To exercise any of these rights, email legal@everythingstreet.ge. We will respond within 30 calendar days.
If you are not satisfied with how we handle your data, you have the right to lodge a complaint: Georgia: Personal Data Protection Service of Georgia Website: pdp.ge | Email: info@pdp.ge European Union / EEA residents: Your local national Data Protection Authority (Full list at edpb.europa.eu) United Kingdom residents: Information Commissioner's Office (ICO) Website: ico.org.uk | Phone: 0303 123 1113
Some tech products we sell — such as smartwatches, fitness trackers, and smart home devices — may collect personal data when used. This data is processed directly by the product manufacturer, not by Everything Street. Please review the relevant manufacturer's privacy policy before using any connected device.
Our website and services are not directed to persons under 18 years of age. We do not knowingly collect personal data from minors. If you believe we hold data about a person under 18, contact us at legal@everythingstreet.ge and we will delete it promptly.
We may update this Privacy Policy from time to time. When we make material changes, we will update the 'Last updated' date and notify registered customers by email at least 14 days before the changes take effect.
For any privacy-related questions or to exercise your rights: Email: legal@everythingstreet.ge Phone: +995 500 09 06 14 Address: Everything Street, Shalva Nutsubidze St, Tbilisi, Georgia We aim to respond to all privacy enquiries within 5 business days.