Privacy Policy

How Happy Georgia handles your personal data. We collect minimal information, use it only for the purposes stated below, and respect the rights you have over it under Georgian data protection law.

Slide 1 of 1: Privacy Policy
Contact us with privacy questions

Privacy Policy#

Last updated: 22 October 2026.

This Privacy Policy explains how Happy Georgia collects, uses, retains, and shares personal data, and the rights you have over your data under the Law of Georgia on Personal Data Protection No. 3144/2023 (in force from 1 March 2024).

Controller identity#

The data controller is:

Happy Georgia
Operated by Manuel Masseret, Individual Entrepreneur (IE)
Identification number: 306277686
34 Nutsubidze Street
0170 Tbilisi, Georgia
Contact: contact us using our form
Legal and privacy correspondence: our privacy and legal enquiry form

For privacy-related questions, contact us using our privacy and legal enquiry form.

What personal data we collect#

We collect personal data when you interact with us through the channels below.

Contact form submissions. When you submit our contact form at /contact, we collect: first name, last name, email address, phone number (optional), country of citizenship, current country of residence (optional), what you would like help with, and your description of your situation.

Privacy and legal enquiry form. Privacy and legal enquiries, including requests to exercise your rights, can be sent through our dedicated privacy and legal enquiry form. It collects your first name, last name, email address and your message. Submissions are delivered by email to our designated internal inboxes. This form does not create contacts, activities or notes in our customer relationship management system (HubSpot).

Information captured with either form. At the time of submission of either form, our system also captures: your IP address, approximate geolocation derived from your IP (country, region, city), the page URL where the form was submitted, and a timestamp. The IP address and geolocation are used for security, fraud prevention, and to inform our response to your enquiry.

Booking page interactions. When you book a consultation through our /book page, the booking is handled by Cal.com, which collects the data you provide directly through their interface (typically name, email, phone number if you give one, citizenship, current country of residence, what you would like help with, your description of your situation, and the time slot you select). Cal.com is the controller for the booking interaction itself; we receive the booking details to fulfill the consultation and record them in our customer relationship management system.

Email correspondence. When you correspond with us by email, for example when you reply to our messages or during an engagement, we collect the contents of your messages and any attachments you send.

Anti-bot verification. Our contact forms use Cloudflare Turnstile for anti-bot verification. Turnstile may collect device and browser characteristics, IP address, and behavioural signals to determine whether the submission is from a human or automated bot. Turnstile is configured in privacy-preserving mode and does not track users across sites.

Server logs. Our hosting provider maintains standard server logs (IP address, browser user agent, timestamp, requested URL) for security, performance monitoring, and abuse prevention. These logs are not used for marketing or profiling.

Website analytics. We measure how our website is used with Umami, an open-source analytics tool that we run ourselves on a server we rent (analytics.happygeorgia.ge). You can turn analytics off for your browser at any time with the "Turn off analytics" link at the bottom of every page. If you turn it off, nothing more is sent from that moment and the analytics script is no longer loaded; if your browser sends a "Do Not Track" signal, the analytics script is not loaded at all. Otherwise, when you load a page the analytics script sends the page address, keeping only campaign tags such as utm_source (other URL parameters, and campaign values that look like an email address or a long number, are removed before sending), the referring website (only its domain, such as google.com, for other websites), the page title, and your browser's language and screen size. From the request, the analytics server records the time and derives your browser, operating system, device type and approximate location (country, region and city). We also record three named actions without any of the information you enter: a successful contact-form submission, a completed consultation booking, and clicks on our consultation-booking buttons. To count visits, the server combines your IP address and browser details with a secret value into a pseudonymous identifier that changes at least once a month; Umami itself does not store the IP address. We use these statistics only to understand which pages and channels lead to enquiries and bookings, and we do not combine them with your contact details or our customer records.

We do not use Google Analytics or other third-party analytics services. We do not use behavioural advertising trackers, cross-site tracking pixels, or marketing automation tools.

Lawful bases for processing#

Under Article 5 of the Law of Georgia on Personal Data Protection, we process personal data on the following lawful bases:

  • Performance of a contract or pre-contractual steps. When you contact us with an enquiry or engage us for advisory services, we process your personal data to respond to your enquiry, provide the services you've requested, and maintain the engagement relationship.
  • Legitimate interests of the controller. We process IP addresses and geolocation data for security, fraud prevention, and informed response to enquiries. We use Cloudflare Turnstile for anti-bot verification on this basis. We also measure the use of our website with our own analytics on this basis (see Website analytics above), to understand which pages and channels lead to enquiries and bookings. Our legitimate interests are weighed against your rights and freedoms; you have the right to object to processing on this basis (see Your rights below).
  • Compliance with legal obligation. We retain certain client records for periods required by Georgian tax law, anti-money-laundering law, and professional record-keeping obligations.
  • Consent. Where we ask for your consent (for example, to receive direct marketing communications), processing is based on that consent. You can withdraw consent at any time through our privacy and legal enquiry form; we will cease the relevant processing within seven working days as required by Georgian law.

How we use your personal data#

We use the personal data described above to:

  • Respond to your enquiry and provide the advisory or operational services you've engaged us for
  • Communicate with you about your engagement (status updates, document requests, scheduling, billing)
  • Maintain the institutional records necessary for ongoing client relationships
  • Comply with legal and regulatory obligations applicable to our practice (Georgian tax record-keeping, anti-money-laundering due diligence where applicable)
  • Prevent fraud, abuse, and security incidents
  • Improve our website and service delivery (in aggregate, non-identifying form)

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

Recipients of personal data (processors)#

We use the following processors who handle personal data on our behalf:

  • Resend (https://resend.com) — email delivery for our contact forms (including the privacy and legal enquiry form) and booking notifications. Resend processes the form submission data (name, email, message content, IP address, geolocation) and booking details for the purpose of delivering notifications to our team and confirmations to you.
  • HubSpot (https://hubspot.com) — customer relationship management. We record contact-form enquiries and consultation bookings (name, email address, phone number, citizenship, current country of residence, what you would like help with and your description, booking time and status) so we can respond to you and manage our client relationships. Enquiries sent through our privacy and legal enquiry form are not sent to HubSpot; no contact, activity or note is created for them. We do not use this to send you marketing without your consent.
  • Cloudflare (https://cloudflare.com) — Cloudflare Turnstile anti-bot verification on our contact forms, and content delivery network services.
  • Cal.com (https://cal.com) — booking platform for our consultation scheduling page. Cal.com is the controller for the booking interaction itself; we receive booking details from Cal.com to fulfill the consultation. See Cal.com's privacy policy for their data handling practices.
  • Vercel (https://vercel.com) — hosting infrastructure for our website. Vercel processes server logs (IP, user agent, timestamps) for the purpose of serving our website.
  • Server hosting for our analytics — our self-hosted Umami analytics runs on a virtual server we rent from a hosting provider, which supplies the infrastructure only. We do not share analytics data with the provider or any other third party for their own purposes.

We do not sell, rent, or trade your personal data. We do not share it with third parties for their own purposes, except processors operating under our instructions or as required by law.

Cross-border data transfers#

Some of our processors are based outside Georgia, including in the United States. Under the Law of Georgia on Personal Data Protection, transfers of personal data to other countries are permitted where the receiving country ensures an adequate level of data protection or where appropriate safeguards exist.

We rely on the contractual data protection commitments our processors maintain (data processing agreements and equivalent contractual safeguards) as the basis for these transfers. You can request information about the safeguards applied to specific transfers through our privacy and legal enquiry form.

Retention periods#

We retain personal data only for as long as necessary for the purposes for which it was collected and for legal compliance.

  • Prospect enquiries that don't lead to engagement: retained for up to 24 months from the date of last contact, then deleted.
  • Client engagements: retained for the duration of the engagement plus 7 years thereafter, consistent with Georgian Tax Code record-keeping requirements and professional record-keeping obligations.
  • Server logs: retained for up to 90 days for security and operational purposes, then deleted unless required for ongoing investigation.
  • Website analytics: kept on our analytics server until we delete it. We delete analytics data we no longer need for comparing website performance over time.
  • Email correspondence: retained for the same periods as the underlying enquiry or engagement category.

After the retention period expires, we delete the personal data unless retention is required for an ongoing legal obligation, dispute, or investigation.

Cookies#

Our website uses only strictly necessary cookies — those required for the basic functioning of the website, including session management, security, and the operation of our anti-bot verification on the contact forms.

Our analytics does not set cookies and, unless you turn it off, writes nothing to your device. The analytics script checks your browser's local storage for a single setting (umami.disabled) that, if present, switches analytics off for that browser. Choosing "Turn off analytics" at the bottom of any page stores that setting in your browser, where it stays until you turn analytics back on (which removes it) or clear your browser's data for our website. If you rejected analytics in our earlier analytics panel, we keep that choice as an opt-out. We do not use advertising cookies or third-party tracking cookies. We do not use behavioural retargeting tools.

If you visit our /book page, the embedded Cal.com booking interface may set its own cookies when it loads. Those cookies are governed by Cal.com's privacy policy, which we recommend you review if you use the booking page.

Your rights#

Under the Law of Georgia on Personal Data Protection, you have the following rights regarding your personal data:

  • Right of access. You can request a copy of any personal data we hold about you and information about how we process it. We respond within 10 working days as required by Article 14, with a possible extension of up to 10 additional working days for complex requests.
  • Right to rectification. You can request that inaccurate or incomplete personal data be corrected, updated, or completed.
  • Right to erasure (deletion or destruction). You can request deletion or destruction of your personal data where the data are no longer necessary for the original purpose, where you withdraw your consent, or in other circumstances permitted by Georgian law, subject to our retention obligations under tax and anti-money-laundering law.
  • Right to blocking and restriction of processing. You can request that we block or restrict processing of your data in circumstances permitted by Georgian law.
  • Right to data portability. You can request your personal data in a structured, commonly used, machine-readable format.
  • Right to object. You can object to processing of your personal data on legitimate-interest grounds. We will stop processing unless we demonstrate compelling legitimate grounds that override your rights. You can stop website analytics for your browser at any time with the "Turn off analytics" link at the bottom of every page; analytics stops immediately, without reloading the page. A "Do Not Track" setting or a content blocker also stops analytics in your browser.
  • Right to withdraw consent. Where processing is based on your consent, you can withdraw consent at any time. We will cease the relevant processing within seven working days.
  • Right to know about automated decision-making. We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on you.

To exercise any of these rights, contact us using our privacy and legal enquiry form. Please describe which right you are exercising.

Right to lodge a complaint#

If you believe we have not handled your personal data in accordance with Georgian law, you have the right to lodge a complaint with the Personal Data Protection Service of Georgia (https://personaldata.ge), the Georgian supervisory authority responsible for overseeing compliance with the Law of Georgia on Personal Data Protection.

We would, of course, prefer that you contact us first using our privacy and legal enquiry form to give us the opportunity to address any concern directly.

Security#

We apply technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, or destruction. These include encrypted data transmission (HTTPS), secure email infrastructure, access controls on internal systems, and contractual data protection commitments from our processors.

No system is perfectly secure, and we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in significant harm to data subjects, we will notify the Personal Data Protection Service of Georgia within 72 hours of becoming aware of the breach, and we will notify affected data subjects where required by Georgian law.

Children#

Our services are directed at adult professionals making business and tax-residency decisions. We do not knowingly collect personal data from children. If you believe we have collected personal data from a child, contact us through our privacy and legal enquiry form and we will delete it.

Changes to this Privacy Policy#

We may update this Privacy Policy from time to time to reflect changes in our processing activities, our processors, or applicable Georgian law. The "Last updated" date at the top of this policy reflects the most recent revision. We will provide additional notice for material changes (for example, a notice on our homepage or by email to active clients).

Contact#

For privacy-related questions, requests, or complaints, contact us using our privacy and legal enquiry form.

Happy Georgia
Operated by Manuel Masseret, Individual Entrepreneur (IE)
Identification number: 306277686
34 Nutsubidze Street
0170 Tbilisi, Georgia
Legal and privacy correspondence: our privacy and legal enquiry form

This Privacy Policy is governed by the Law of Georgia on Personal Data Protection No. 3144/2023 and is to be interpreted in accordance with Georgian law.