Privacy policy

The controller of your personal data on todayonly.ge is Michael Pretorius, individual entrepreneur registered in Georgia, identification number 322961522, trading as TodayOnly. Registered address: 97 Ivane Javakhishvili St, Chugureti, 0112 Tbilisi, Georgia.

We decide how and why your personal data is used. For any question about your data, write to [EMAIL].

• Contact details: your name, mobile number and, if you give it, your email address
• Delivery details: your address, entrance, floor, flat and notes for the courier; for gifts, the recipient’s name, phone number and message
• Order details: what you bought, the prices, the payment status (never your card details), your order history, returns and messages to us
• Account details: how you sign in, your saved addresses and, if you sign in with Google, the name and email Google shares with us
• Newsletter: your email or phone number, language, when you subscribed and which campaign link or site you came from, if any
• Technical data: the cookies the site needs, your IP address, browser type and server logs that keep the site secure

• To take, deliver and support your orders, and to handle returns and warranty claims: needed to perform our contract with you.
• To send one-time sign-in codes and order updates by SMS or email: also part of that contract.
• To keep accounting and tax records: required by Georgian law.
• To keep the site secure, prevent fraud and enforce deal limits: our legitimate interest in running a safe shop.
• To send you the daily deals by email: only with your consent, which you can withdraw at any time.

We don’t make decisions about you based only on automated processing that have legal or similarly significant effects.

We only send marketing emails if you subscribed. Every email has an unsubscribe link, and you can also change your choices in your account. Order updates are not marketing: we send them while you have an open order.

Card and wallet payments are handled by our bank’s payment gateway. The bank receives your card details directly; we only receive the result (approved or declined), the amount and a reference. We never see or store your full card number.

We share only what each provider needs to do its job:

• Couriers: the recipient’s name, phone number and delivery address
• Our bank and its payment gateway: the amount and the order reference
• SMS and email providers: your phone number or email and the message
• Hosting and database providers that run the site for us
• Cloudflare, which counts visits to the site for us without cookies (Web Analytics)
• Suppliers, only for a warranty claim, and without your contact details unless you agree

They may use your data only to provide their service to us. We don’t sell your personal data or share it for advertising. We disclose data to public authorities only when Georgian law requires it.

The site and its database are hosted in data centres in Frankfurt, Germany (European Union). Some email and SMS providers, and Cloudflare, which counts visits, may also process data outside Georgia. We transfer data abroad only where Georgian law allows it, for example to countries recognised as offering adequate protection, or with appropriate contractual safeguards.

• Order, payment and accounting records: as long as Georgian tax and accounting law requires
• Account data: until you close your account; then we delete or anonymise it, except what we must keep for past orders
• Newsletter subscription: until you unsubscribe
• Server and security logs: up to 90 days, unless needed to investigate an incident
• Messages to customer support: up to 2 years after the matter is closed

The site uses an encrypted connection everywhere. Only the people who handle orders can see customer data, and our admin accounts are protected with two-factor authentication. If a personal data breach puts your rights at risk, we’ll notify the supervisory authority and, where required, you.

Under the Law of Georgia on Personal Data Protection you can ask us to:

• tell you what data we hold about you and give you a copy
• correct data that is wrong or incomplete
• delete your data or stop using it, where we have no legal reason to keep it
• restrict how we use it while a question is being resolved
• give you the data you provided in a common electronic format
• stop using it for marketing; you can withdraw your consent at any time

Write to [EMAIL]. We may ask you to confirm who you are, and we reply within the time limits set by law. If you think we’ve handled your data wrongly, you can complain to the State Audit Office of Georgia, which supervises personal data protection, or go to court.

TodayOnly is meant for adults. We don’t knowingly collect data from children under 16. If you think a child has given us personal data, contact us and we’ll delete it.

We use only the cookies the site needs to work. They don’t follow you to other sites:

• Language: remembers the language you chose (1 year)
• Cart: keeps the items in your cart and their count
• Session: keeps you signed in, if you sign in
• Order access: lets you open an order you placed without an account

We don’t use advertising cookies or analytics cookies.

We count visits with Cloudflare Web Analytics, which uses no cookies and does not identify visitors. If you sign up, we store with your email the language you used and which campaign link or site you came from (if any), to understand which announcements work.

If we change this policy, we’ll update this page and the date at the bottom. If a change is significant, we’ll also tell you by email, by SMS or on the site.

• Controller: Michael Pretorius, individual entrepreneur
• Identification number: 322961522
• Registered address: 97 Ivane Javakhishvili St, Chugureti, 0112 Tbilisi, Georgia
• Email: [EMAIL]