Privacy Policy

Draft notice

DRAFT — this text was written from the payment provider's requirements and has NOT been reviewed by a lawyer. The club must replace it before the first card payment is taken. Edit it in the admin under Site → Pages.

1. What we collect

• Account data: name, e-mail address, telephone number, date of birth and your Fan ID.
• Order data: the items you bought, the delivery address, the amount and the status of the payment.
• Technical data: IP address and browser identification of form submissions, used only to stop abuse.

2. Why we use it

To deliver what you ordered, to run your fan-club membership, to answer your questions, to meet our accounting and tax obligations, and to protect the site from fraud and abuse. We do not sell your data and we do not use it for advertising by third parties.

3. Cardholder data and how long we keep it

For every card order we record the cardholder's name, address and telephone number, as our payment service provider requires, and we keep the order data for at least six months after the transaction so that the provider can obtain it on request. Accounting records are kept for the period Georgian tax law prescribes. You can ask us to delete anything we are not legally required to keep.

4. Who else sees your data

• Our payment service provider, for the payment itself.
• The courier company, for the delivery address and telephone number.
• Our hosting and e-mail providers, as processors, under contract.

5. Transaction security policy

• The whole website is served over HTTPS/TLS; the checkout cannot be used over an unencrypted connection.
• Card details are entered only on the payment provider's own PCI DSS certified page. They never reach this website, are never stored by the club and are never visible to club staff.
• Payment results are accepted only through a signed, verified callback from the provider, and every payment is re-checked against the provider before an order is marked paid.
• Passwords are stored only as salted hashes; accounts are locked after repeated failed sign-in attempts.
• Access to the administration area is restricted to named club staff.

6. Your rights

You may ask what we hold about you, correct it, or ask for its deletion. Write to the e-mail address at the bottom of this page. You may also lodge a complaint with the Personal Data Protection Service of Georgia.

7. Cookies

This website uses only the cookies it needs to work: your sign-in session and your language choice. No advertising or third-party tracking cookies are set.