Privacy Policy

Last updated: 05.10.2026

This Privacy Policy describes the procedure for processing the personal data of users of the Qure online store and applies to data that Qure receives through the website, the personal account, the placing and fulfillment of orders, requests to customer support, marketing communications and other channels related to Qure's activities.

01. Personal data controller

Qure

Individual entrepreneur: ANASTASIIA GOLETIANI

Identification number: 306563368

Legal address: Georgia, Tbilisi, Samgori District, Police Lane I, No. 5, Floor 2, No. 4a

Email for personal data matters: example@qure.ge

Phone: +995 555 12 34 56

02. Categories and sources of data

Qure may process first name and surname, phone number, email, delivery address, personal account data, order and return history, information about products and amounts, payment and transaction information, payment identifiers and technical tokens, information about installment plans to the extent received by Qure, the content of requests, IP address, device and browser information, website usage data, cookies, information about marketing consent and its withdrawal, as well as voluntarily provided data. Qure does not request a PIN code, an internet banking password or any other secret banking credentials.

Data may be received directly from the user, automatically when the website is used, from banks and payment providers, courier and logistics partners, technical service providers and other persons where a lawful basis exists.

03. Purposes and legal bases

Data may be processed for registering and maintaining an account, placing and fulfilling an order, payment and refund, delivery, returns and claims, fraud prevention, security, accounting and tax obligations, protection of rights, maintaining and improving the website, analytics where a basis exists, and direct marketing where the required consent has been given.

For each purpose, Qure relies on a basis provided for by law: the performance or conclusion of a contract, a legal obligation, a legitimate interest permitted by law, consent or another basis so provided. Placing an order does not mean that all processing is based on consent.

04. Personal account

When an account is created, Qure may process contact details, addresses and order history. Deletion of an account does not mean automatic deletion of all data if their retention is required to fulfill a legal obligation, for record-keeping, to protect rights or to resolve a dispute.

05. Payments and saved payment instruments

Payments may be processed by TBC Bank, Bank of Georgia and other connected providers. If the full card number and CVV/CVC are entered directly in the provider's secure environment, Qure does not receive or store such full card details. Qure may receive the status, amount, currency, identifier and method of payment.

If a card-saving feature is available, Qure may receive a token, recId or another technical identifier rather than the full card details.

06. Cookies, analytics and advertising

The website may use necessary, functional, analytics and marketing cookies or similar technologies. Optional technologies are used only on an appropriate legal basis. Where consent is required, the user is given the opportunity to give, decline and withdraw it through an available settings management mechanism.

The list of analytics and advertising services actually used must correspond to the actual technical configuration of the website.

07. Direct marketing

Personal data are processed for direct marketing only with the user's consent, in the cases and in the manner established by law. Consent is requested separately from acceptance of the terms and is not a condition of purchase.

Following a request to stop direct marketing, Qure ceases the relevant processing within a reasonable time, but no later than 7 working days. Qure retains information on the giving and withdrawal of consent for the period of direct marketing and for 1 year after it ends. Service messages are not considered direct marketing merely because of the channel used.

08. Recipients and processors

To the extent necessary, data may be transferred to banks and payment systems, installment providers, courier and logistics companies, hosting providers, cloud services, CRM, email and SMS services, analytics and advertising services where a basis exists, professional advisers and public authorities. Qure does not sell personal data as a commodity.

Where a third party processes data on behalf of Qure, the relationship is formalized in accordance with the requirements of the law regarding processors, confidentiality, security and sub-processors.

09. International transfer

Where a service provider processes data outside Georgia, international transfer is carried out only where there is a basis provided for by law and the necessary safeguards are in place, taking into account the country and the provider actually used.

10. Retention periods and security

Qure retains data for no longer than is necessary for the relevant purpose, unless a longer period is required or permitted by law. Account is taken of contract performance, accounting and tax obligations, time limits for claims, security and dispute resolution.

Qure applies technical and organisational security measures appropriate to the risks. Absolute security of an information system is not guaranteed. In the event of an incident, Qure fulfills the applicable obligations relating to assessment, documentation and notification.

11. User rights

In the cases provided for by law, the user is entitled to receive information about and access to the data and a copy of the data, to request rectification or supplementation, cessation of processing, deletion, destruction or blocking where there are grounds for doing so, to withdraw consent, to object to processing, to exercise the right to portability, to receive information about automated decisions and to appeal against unlawful processing.

12. Withdrawal of consent and account deletion

Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal and does not stop processing if another independent lawful basis exists. When an account is deleted, data that are no longer required and have no other basis for retention are deleted.

13. Minors

When processing the data of minors, Qure takes their best interests into account. Where processing is based on consent, a minor is entitled to give it independently from the age of 16, except where the law also requires the consent of a parent or other legal representative.

If a minor is under the age of 16 and processing is based on consent, the consent of a parent or other legal representative is required, except in cases expressly provided for by law. Qure takes reasonable measures to verify such consent.

Processing of special categories of personal data of a minor, including health data, on the basis of consent is permitted only with the written consent of a parent or other legal representative, except in cases expressly provided for by law. Consent is not considered valid if the processing threatens or harms the best interests of the minor.

14. Health data

Information about allergies, skin condition, a diagnosis or other health information may fall within special categories of data. Qure does not require such data for an ordinary order or an ordinary withdrawal from a distance contract. If the user voluntarily provides such data in connection with a complaint, a reaction or a safety concern, Qure processes only as much as is necessary, where an appropriate legal basis exists.

15. Changes, requests and complaints

Qure may update the Policy in the event of changes in legislation, technologies, providers or processes. If a change requires separate consent, such consent is obtained before the relevant processing begins.

Requests: email example@qure.ge, phone +995 555 12 34 56. Qure may reasonably verify the identity of the requester. The user is entitled to use the administrative and judicial remedies provided for by law.

16. Contact information