Privacy Policy

Last updated: 2 October 2026

This policy explains what personal information I collect through alenadzibrova.com, how I use it, who I share it with, and the choices you have. It applies to visitors to the website and to people who contact me or work with me as clients. “I”, “me” and “my” mean Individual Entrepreneur Alena Dzibrova, the data controller. It is written to meet the Law of Georgia on Personal Data Protection (in force since 1 March 2024) and, where they apply to you, the EU and UK GDPR.

1. Information I collect

Information you give me

• Contact form. Your name, email address, website and anything you choose to write in the message or service fields.
• Direct correspondence. Whatever you send me by email or messaging channels.
• Client relationships. Company name, billing details, invoicing information and project specifics needed to deliver the work.

Information collected automatically

• Technical data such as IP address, browser type, device information, pages visited and referring URLs.
• Aggregated, cookieless analytics used to understand how the site is used and to improve it — see Cookies and analytics below.

Giving me your details is voluntary. The form needs a name, an email address and a message — without them I cannot reply. Everything else is optional.

I do not knowingly collect special categories of personal data, and I ask that you do not send them to me.

2. How I use it

• To respond to your enquiry and communicate with you about it.
• To prepare quotes, proposals and service agreements.
• To deliver the services we have agreed, and to invoice for them.
• To keep the website secure and prevent misuse.
• To improve the website and my services.
• To meet legal, accounting and tax obligations.

I do not send marketing emails or newsletters. If you write to me, I reply about your enquiry and nothing else. I do not use your information for automated decision-making that produces legal effects, and I do not build advertising profiles from it.

3. Legal basis

Under Article 5 of the Law of Georgia on Personal Data Protection (and Article 6 GDPR where it applies) I rely on: the performance of a contract or steps taken at your request before entering one — replying to your enquiry, preparing a proposal, delivering the work; my legitimate interests in running, securing and improving the business, balanced against your rights; legal obligation where Georgian accounting and tax law requires records to be kept; and your consent, where I ask for it. I do not process personal data for direct marketing, which under Article 12 of the Georgian law would require your separate consent.

4. Who I share it with

I do not sell personal information. I share it only with:

• Service providers who help me operate — website hosting (Cloudflare), form delivery (FormSubmit), email, analytics (Cloudflare Web Analytics), accounting and payment processing — and only to the extent they need it to do that job.
• Specialists I bring into a project (for example a developer, designer or copywriter), under a duty of confidentiality and only as far as the work requires.
• Professional advisers such as accountants and lawyers, under a duty of confidentiality.
• Authorities, where I am legally required to disclose.

5. International transfers

I operate from Georgia and use service providers located in other countries, including in the EEA and the United States. Transfers abroad are governed by Article 37 of the Law of Georgia on Personal Data Protection. Where the recipient country is on the list of states with adequate data protection approved by the Georgian supervisory authority, no further step is needed; otherwise I rely on the contractual safeguards those providers offer and, for the contact form, on your consent: by sending the form you agree that what you type is delivered through FormSubmit and hosted by Cloudflare, whose servers may be outside Georgia and in a country without an adequacy finding. If you would rather not, email me directly instead.

6. How long I keep it

• Enquiries that do not become projects — normally up to 24 months, then deleted.
• Client records, contracts and invoices — six years, the period the Tax Code of Georgia (Article 43) requires accounting documents to be kept.
• Website analytics — in aggregated form, which does not identify you.

7. Your rights

Subject to the law that applies to you, you can ask me to: give you a copy of the personal information I hold about you; correct it if it is wrong; delete it; restrict or object to how I use it; or provide it in a portable format. Where I rely on consent, you can withdraw it at any time — that does not affect anything done before you withdrew it.

Write to [email protected]. I will respond within 10 working days, as Articles 14–17 of the Georgian law require, and sooner where I can. You also have the right to complain to the State Audit Office of Georgia, which has supervised personal data protection in Georgia since 2 March 2026 (previously the Personal Data Protection Service), or to apply to a court; if you are in the EEA or the UK, to your local supervisory authority as well.

8. Security

I use reasonable technical and organisational measures to protect personal information, including HTTPS across the whole site, access controls, and reputable service providers. No method of transmission or storage is completely secure, so I cannot guarantee absolute security.

9. Cookies and analytics

Georgian law treats cookies and similar identifiers as personal data. This website sets no cookies of its own — no advertising cookies, no tracking cookies, no third-party pixels.

For visitor statistics I use Cloudflare Web Analytics, which is cookieless: it does not use a client-side identifier, does not fingerprint your device and does not track you across websites. It reports aggregate figures — page views, referrers, country, browser — and does not identify individual visitors. That is why this site shows no cookie consent banner: there is nothing to consent to.

The contact form is delivered to my inbox through FormSubmit. What you type into the form passes through that service on its way to me.

10. Other things worth knowing

• Children. My services are for businesses. I do not knowingly collect information from anyone under 18.
• Data breaches. If a breach is likely to cause you significant harm, I will notify the supervisory authority within 72 hours of becoming aware of it and tell you without undue delay.
• Changes. If I update this policy I will post the new version here with a revised date.

11. Contact

Questions about this policy, or about the information I hold about you: