PERSONAL DATA PROCESSING POLICY
1. General Provisions
1.1. This Personal Data Processing Policy (hereinafter — the "Policy") has been developed in accordance with the Law of Georgia "On Personal Data Protection" of 28 December 2011 (hereinafter — the "Personal Data Protection Law") and determines the procedure for processing personal data and the measures to ensure their security applied by Individual Entrepreneur Serhii Mykytyuk (hereinafter — the "Operator").
1.2. The most important goal and condition of the Operator's activity is the observance of the rights and freedoms of man and citizen in the processing of their personal data, including the protection of the rights to privacy, personal and family secrecy.
1.3. This Policy applies to all information that the Operator may receive about visitors to the website https://ha-tha-volna.com/ (hereinafter — the "Website"), as well as about persons entering into contractual relations with the Operator outside the Website.
1.4. The Operator publishes this Policy on the Website in free access. The current version of the Policy is always available at https://ha-tha-volna.com/privacypolicy-en.
2. Basic Concepts
The following concepts are used in this Policy:
2.1. Personal Data — any information relating to an identified or identifiable natural person (data subject). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier (name, surname, phone number, email address) or to one or more factors specific to their physical, psychological, economic, cultural or social identity.
2.2. Personal Data Processing — any action or set of actions performed with personal data with or without the use of automation tools, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (dissemination, provision, access), depersonalisation, blocking, deletion, destruction.
2.3. Data Subject (User) — a natural person whose personal data is processed by the Operator, including any visitor to the Website, Customer of services or other person who has provided their data to the Operator.
2.4. Operator — Individual Entrepreneur Serhii Mykytyuk, who independently or jointly with other persons organises and/or carries out the processing of personal data, determines the purposes of processing, the composition of the processed data and the actions (operations) with them.
2.5. Consent of the Data Subject — a free, specific, informed and unambiguous expression of will by the data subject, by which they confirm in writing (including electronic) or by explicit active actions their consent to the processing of personal data relating to them.
2.6. Website — a set of graphic and information materials, as well as computer programs and databases, available on the Internet at https://ha-tha-volna.com/.
2.7. Cross-border Transfer of Personal Data — the transfer of personal data to the territory of a foreign state to a public authority of a foreign state, a foreign natural or foreign legal entity.
2.8. Third Party — any natural or legal person, state body or other body that is not the data subject, the Operator or a person directly authorised by the Operator to process personal data.
3. Principles of Personal Data Processing
The processing of personal data by the Operator is based on the following principles:
3.1. Legality and fairness of processing.
3.2. Limitation of processing to the achievement of specific, predetermined and legitimate purposes. Processing of data incompatible with the purposes of their collection is not permitted.
3.3. Compliance of the volume and content of the processed data with the stated purposes of processing. Excessive processing of data is not permitted.
3.4. Ensuring accuracy, sufficiency and, where necessary, relevance of data in relation to the purposes of processing. The Operator takes the necessary measures to delete or clarify incomplete or inaccurate data.
3.5. Data is stored no longer than required by the purposes of their processing, unless another period is established by law or agreement. Upon achievement of the processing purposes or in the event of loss of necessity to achieve them, the data is destroyed or depersonalised.
4. Rights and Obligations of the Operator
4.1. The Operator has the right to:
5.1. The data subject has the right to:
6. Purposes and Grounds for Personal Data Processing
6.1. The Operator processes personal data for the following purposes:
7. Conditions for Personal Data Processing
7.1. Processing is carried out with the consent of the data subject to the processing of their personal data, unless another ground is provided for by the Law.
7.2. Processing without consent is permitted if it is necessary:
7.4. The User's personal data is never transferred to third parties, except in cases:
8.1. The security of personal data is ensured through the implementation of legal, organisational and technical measures necessary to fully comply with the requirements of the Personal Data Protection Law.
8.2. The Operator takes all reasonable measures to exclude unauthorised access to personal data by persons who do not have the right to it, including:
8.4. The period of personal data processing is determined by the achievement of the purposes for which they were collected, unless another period is provided for by the agreement or the applicable legislation of Georgia.
9. Procedure for Withdrawal of Consent to Data Processing
9.1. The data subject has the right to withdraw consent to the processing of personal data at any time by sending the Operator a notice to the email address hathavolna@gmail.com with the note "Withdrawal of Consent to Personal Data Processing" or in writing at the Operator's contact details.
9.2. In the event of withdrawal of consent, the Operator ceases processing and deletes personal data within a period not exceeding 10 (ten) working days from the date of receipt of the notice, except in cases where further processing is required by law.
9.3. In the event of detection of inaccuracies in personal data, the data subject has the right to send the Operator a notice of their update to the above address with the note "Personal Data Update".
10. Cross-border Transfer of Personal Data
10.1. Cross-border transfer of personal data to the territory of foreign states is permitted only on the condition that the destination state ensures an adequate level of protection of the rights of data subjects in accordance with the legislation of Georgia, or in the presence of sufficient guarantees of protection provided for by law.
10.2. Before the start of cross-border transfer, the Operator notifies the data subject of the fact of such transfer and of the destination state, unless otherwise provided by law.
10.3. The Operator has the right to transfer data to countries in respect of which the Personal Data Protection Inspector of Georgia has adopted a decision on an adequate level of protection, or on the basis of standard contractual clauses approved in the established procedure.
11. Final Provisions
11.1. The User may obtain any clarifications on issues relating to the processing of their personal data by contacting the Operator by email at hathavolna@gmail.com.
11.2. The Operator has the right to make changes to this Policy unilaterally. The new version comes into force from the moment of its publication on the Website. For relations that arose before the entry into force of the changes, the version in force at the time the data subject gave their consent to processing shall apply.
11.3. This Policy is valid indefinitely until replaced by a new version.
11.4. The supervisory authority in the field of personal data protection in Georgia is the Personal Data Protection Inspector (Personal Data Protection Service under the Ministry of Justice of Georgia).
12. Operator's Details
Individual Entrepreneur
Serhii Mykytyuk
Personal Number: 304787425
Phone: +995 591 908 340
Email: hathavolna@gmail.com
Website: https://ha-tha-volna.com/
Date of last update: 21 July 2026.
1.1. This Personal Data Processing Policy (hereinafter — the "Policy") has been developed in accordance with the Law of Georgia "On Personal Data Protection" of 28 December 2011 (hereinafter — the "Personal Data Protection Law") and determines the procedure for processing personal data and the measures to ensure their security applied by Individual Entrepreneur Serhii Mykytyuk (hereinafter — the "Operator").
1.2. The most important goal and condition of the Operator's activity is the observance of the rights and freedoms of man and citizen in the processing of their personal data, including the protection of the rights to privacy, personal and family secrecy.
1.3. This Policy applies to all information that the Operator may receive about visitors to the website https://ha-tha-volna.com/ (hereinafter — the "Website"), as well as about persons entering into contractual relations with the Operator outside the Website.
1.4. The Operator publishes this Policy on the Website in free access. The current version of the Policy is always available at https://ha-tha-volna.com/privacypolicy-en.
2. Basic Concepts
The following concepts are used in this Policy:
2.1. Personal Data — any information relating to an identified or identifiable natural person (data subject). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier (name, surname, phone number, email address) or to one or more factors specific to their physical, psychological, economic, cultural or social identity.
2.2. Personal Data Processing — any action or set of actions performed with personal data with or without the use of automation tools, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (dissemination, provision, access), depersonalisation, blocking, deletion, destruction.
2.3. Data Subject (User) — a natural person whose personal data is processed by the Operator, including any visitor to the Website, Customer of services or other person who has provided their data to the Operator.
2.4. Operator — Individual Entrepreneur Serhii Mykytyuk, who independently or jointly with other persons organises and/or carries out the processing of personal data, determines the purposes of processing, the composition of the processed data and the actions (operations) with them.
2.5. Consent of the Data Subject — a free, specific, informed and unambiguous expression of will by the data subject, by which they confirm in writing (including electronic) or by explicit active actions their consent to the processing of personal data relating to them.
2.6. Website — a set of graphic and information materials, as well as computer programs and databases, available on the Internet at https://ha-tha-volna.com/.
2.7. Cross-border Transfer of Personal Data — the transfer of personal data to the territory of a foreign state to a public authority of a foreign state, a foreign natural or foreign legal entity.
2.8. Third Party — any natural or legal person, state body or other body that is not the data subject, the Operator or a person directly authorised by the Operator to process personal data.
3. Principles of Personal Data Processing
The processing of personal data by the Operator is based on the following principles:
3.1. Legality and fairness of processing.
3.2. Limitation of processing to the achievement of specific, predetermined and legitimate purposes. Processing of data incompatible with the purposes of their collection is not permitted.
3.3. Compliance of the volume and content of the processed data with the stated purposes of processing. Excessive processing of data is not permitted.
3.4. Ensuring accuracy, sufficiency and, where necessary, relevance of data in relation to the purposes of processing. The Operator takes the necessary measures to delete or clarify incomplete or inaccurate data.
3.5. Data is stored no longer than required by the purposes of their processing, unless another period is established by law or agreement. Upon achievement of the processing purposes or in the event of loss of necessity to achieve them, the data is destroyed or depersonalised.
4. Rights and Obligations of the Operator
4.1. The Operator has the right to:
- receive from the data subject reliable information and/or documents containing personal data;
- continue processing personal data without the consent of the data subject in cases expressly provided for by the Personal Data Protection Law (for example, if processing is necessary for the performance of an agreement or for compliance with the Operator's legal obligations);
- independently determine the composition and list of legal, organisational and technical measures necessary and sufficient to ensure data security.
- provide the data subject, upon their request, with information relating to the processing of their personal data, in the manner and within the time limits established by the Law;
- take the necessary legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, dissemination, as well as from other unlawful actions;
- ensure the confidentiality of personal data;
- in the event of withdrawal of consent by the data subject — cease processing and destroy the data within a period not exceeding 10 (ten) working days, except in cases where further processing is required by law;
- respond to appeals and requests of data subjects in accordance with the legislation of Georgia.
5.1. The data subject has the right to:
- receive information relating to the processing of their personal data (purposes, grounds, volume, terms, sources of receipt, fact of transfer to third parties);
- require the Operator to clarify, block or destroy data if it is incomplete, outdated, inaccurate or excessive;
- withdraw consent to the processing of personal data at any time;
- appeal against unlawful actions or inaction of the Operator to the Personal Data Protection Inspector of Georgia or in court;
- exercise other rights provided for by the legislation of Georgia.
- provide the Operator with reliable data about themselves;
- promptly notify the Operator of changes in their personal data.
6. Purposes and Grounds for Personal Data Processing
6.1. The Operator processes personal data for the following purposes:
- Conclusion and performance of an agreement with the data subject (public offer), including provision of access to services, information and materials posted on the Website.
- Communication with the data subject: informing about the date and time of consultations, changes in the schedule, sending access to paid materials.
- Sending informational emails to the email address with the consent of the data subject.
- Compliance with the Operator's legal obligations (tax accounting, bookkeeping, responses to official requests from state bodies).
- consent of the data subject;
- necessity for the performance of an agreement to which the data subject is a party;
- legal obligations of the Operator provided for by the legislation of Georgia;
- legitimate interests of the Operator (provided that they do not violate the rights of the data subject).
- name, surname;
- email address;
- phone number;
- other data voluntarily provided by the subject when placing an order or in the course of providing services.
7. Conditions for Personal Data Processing
7.1. Processing is carried out with the consent of the data subject to the processing of their personal data, unless another ground is provided for by the Law.
7.2. Processing without consent is permitted if it is necessary:
- for the performance of an agreement to which the data subject is a party;
- for compliance with the Operator's legal obligations;
- for the protection of vital interests of the data subject or another natural person;
- for the exercise of legitimate interests of the Operator or third parties, provided that this does not infringe the rights of the subject.
7.4. The User's personal data is never transferred to third parties, except in cases:
- when the data subject has given direct written consent to such transfer;
- when the transfer is necessary for the performance of obligations under a civil law agreement with the involvement of third parties (for example, payment services);
- when the transfer is provided for by the legislation of Georgia (at the request of authorised state bodies).
8.1. The security of personal data is ensured through the implementation of legal, organisational and technical measures necessary to fully comply with the requirements of the Personal Data Protection Law.
8.2. The Operator takes all reasonable measures to exclude unauthorised access to personal data by persons who do not have the right to it, including:
- restricting the circle of persons having access to the data;
- using secure communication channels and encryption protocols;
- regular monitoring of the security of information systems.
8.4. The period of personal data processing is determined by the achievement of the purposes for which they were collected, unless another period is provided for by the agreement or the applicable legislation of Georgia.
9. Procedure for Withdrawal of Consent to Data Processing
9.1. The data subject has the right to withdraw consent to the processing of personal data at any time by sending the Operator a notice to the email address hathavolna@gmail.com with the note "Withdrawal of Consent to Personal Data Processing" or in writing at the Operator's contact details.
9.2. In the event of withdrawal of consent, the Operator ceases processing and deletes personal data within a period not exceeding 10 (ten) working days from the date of receipt of the notice, except in cases where further processing is required by law.
9.3. In the event of detection of inaccuracies in personal data, the data subject has the right to send the Operator a notice of their update to the above address with the note "Personal Data Update".
10. Cross-border Transfer of Personal Data
10.1. Cross-border transfer of personal data to the territory of foreign states is permitted only on the condition that the destination state ensures an adequate level of protection of the rights of data subjects in accordance with the legislation of Georgia, or in the presence of sufficient guarantees of protection provided for by law.
10.2. Before the start of cross-border transfer, the Operator notifies the data subject of the fact of such transfer and of the destination state, unless otherwise provided by law.
10.3. The Operator has the right to transfer data to countries in respect of which the Personal Data Protection Inspector of Georgia has adopted a decision on an adequate level of protection, or on the basis of standard contractual clauses approved in the established procedure.
11. Final Provisions
11.1. The User may obtain any clarifications on issues relating to the processing of their personal data by contacting the Operator by email at hathavolna@gmail.com.
11.2. The Operator has the right to make changes to this Policy unilaterally. The new version comes into force from the moment of its publication on the Website. For relations that arose before the entry into force of the changes, the version in force at the time the data subject gave their consent to processing shall apply.
11.3. This Policy is valid indefinitely until replaced by a new version.
11.4. The supervisory authority in the field of personal data protection in Georgia is the Personal Data Protection Inspector (Personal Data Protection Service under the Ministry of Justice of Georgia).
12. Operator's Details
Individual Entrepreneur
Serhii Mykytyuk
Personal Number: 304787425
Phone: +995 591 908 340
Email: hathavolna@gmail.com
Website: https://ha-tha-volna.com/
Date of last update: 21 July 2026.