Confidentiality Policy

2024

About Us

We are the Joint-Stock Company “Microfinance Organization: Georgian Capital”
(hereinafter referred to as the “Company”);
Tax ID: 204568574;
Legal address: N37, Rustaveli Avenue, Mtatsminda District, Tbilisi, Georgia;
Date of registration: May 22, 2009.

Purpose of the Document

The Joint-Stock Company “Microfinance Organization: Georgian Capital”, being the
Company with high responsibility, attaches utmost importance to the high-quality of data
protection and security, as well as ensuring compliance with the requirements for the
data processing process stipulated under the legislation of Georgia and the international
acts. The hereby document aims to describe the personal data processing process in
the Company.

Data Processing Principles

We process your personal data in line with the requirements of the Constitution of
Georgia, the Law of Georgia on “Personal Data Protection”, other respective national
legislative acts or norms, and international standards/acts.
Upon processing your personal data, we adhere to the principles as follows:
a) We process data in a legal, fair, and transparent manner without prejudice to
your dignity;
b) We collect/obtain data for certain, clearly determined and legitimate purposes
solely;
c) We process data in the capacity solely that is necessary for the achievement of a
respective legitimate purpose;
d) The processed data is authentic, accurate, and updated if necessary. We correct,
delete, or erase inaccuracies without unjustified delay;
e) We store the data with the term solely that is necessary for the achievement of
the respective legitimate purpose of data processing. Upon the achievement of

the goal, for which the data has been processed, they are deleted, erased, or
stored in a depersonalized form other than the legally prescribed events;
f) In view of ensuring data security, we apply the technical and organizational
measures upon the data processing that ensure due protection of your data.

Data Processing Basics

We process your data in the event solely, if:
a) You issue a permit for the processing of your personal data;
b) Data processing is necessary for the fulfillment of the commitments envisaged
under the agreement concluded with you or for the conclusion of the agreement
based on your request;
c) Data processing is envisaged under the Law;
d) Data processing is necessary for the fulfillment of the commitments imposed on
the Company under the legislation of Georgia;
e) Pursuant to the Law, the data is publicly accessible or you made your data
publicly accessible;
f) Data processing is necessary for the protection of the legitimate interests crucial
for us or the third party unless the availability of the interest prevailing over the
protection of your rights (including, the rights of the minors);
g) Data processing is necessary for the consideration of your application (in view of
the service provision);
h) In other events envisaged under the Law of Georgia on “Personal Data
Protection” and the applicable legislation of Georgia.

Personal Data Groups

Upon undertaking the activity, we collect and process the personal data as follows:
– Identification data – name, last name, gender, date of birth and place of birth,
personal number/passport number (ID/Passport data), citizenship;

– Reference information – e-mail address, telephone number, registration
address, actual residence;
– Socio-demographic data – information on employment/profession, education;
– Data related to social relations – marital status, family members, including
children, information on reference persons;
– Financial data – financial state, status and financial activity background, credit
history, creditworthiness, the background of the use of financial products in the
Company, financial background, including defaults, data on revenues, account-
related information, including the bank account number;
– Publicly accessible information – information obtained by the Company about
the person through the publicly/openly/legally uploaded database/lists/sites;
– Data of special category – health state, a record of conviction (for the
identification of the conviction of a person for the economic crime in view of the
appointment on the position where he/she enjoys access to the financial
resources of the Company) and drug test certificate (for the position of a driver
and/or other position). Data related to the status of the convict, accused,
acquitted, or aggrieved person as recognized a victim of the human trafficking or
the crime envisaged under the Law of Georgia on “Violence against Women
and/or Elimination of Domestic Violence, Protection and Support of the Victims of
Violence” in the criminal proceedings, conviction, accusation, diversion, his/her
imprisonment and enforcement a penalty towards him/her;
– Other information – IP address and whereabouts, information on the real
estate/movable property under the ownership of a person, as well as all
information that a person shares with the Company through a website. Besides,
information that the Company obtains in hard copy, as well as via e-mails,
telephone conversation, or other communication means.
We process the data about minors, including the data of a special category in the angle
of labor relations only in view of the benefits for our employees established based on
the rights envisaged under the legislation of Georgia or the internal regulations of the
Company providing the best interests of minors.

We process the data about the deceased persons in view of the fulfillment of the
contractual obligations and the realization of the contractual authorities/interests of the
Company in line with the Law of Georgia on “Personal Data Protection”.

Sources for the obtainment of data and the methods of the protection of the
obtained data

We obtain your personal information when:
– You become our user;
– You submit the application to the Company for employment in the vacant
position;
– You are employed in our Company;
– We conclude the service or other agreements with you;
– You use the products and services of the Company;
– Upon the telephone conversation or the visit to the Company/branch of the
Company;
– You use the website of the Company (filling out the application for the loan, and
submission of a claim);
– You send letters by postal service or via e-mail;
– You undertake transactions;
We collect data from the organizations, such as the Public Register or other public
institutions;
Besides, we collect data from other sources – publicly/openly/legally uploaded on and
accessible from the databases/lists/sites.
We ensure video and audio monitoring in line with the Law of Georgia on “Personal
Data Protection” and the Regulations on Video Monitoring and Audio Monitoring,
developed on the basis of the hereof Law.
We, in line with the Law of Georgia on “Personal Data Protection”, are entitled to collect
your personal data as directly from you, so from other sources. However, in both cases,
we undertake to notify you about the collection of your personal data in line with the Law
of Georgia on “Personal Data Protection”.

We have applied due technical and organizational measures to ensure the legal
processing of your data. We have also applied organizational and technical measures to
ensure the confidentiality, integrity, and accessibility of the data stored in electronic or
hard copies.

Your Rights

You have the right to:
– Require confirmation from us whether we process your data, whether the data
processing is substantiated, and inquire for and obtain information for free in line
with your request about the data under processing, as well as information about
the basics and objective of data processing, sources of the collection/obtainment
of data, etc.;
– Inquire about the personal data about you available at our Company and receive
copies of the hereof data;
– Require the correction, update, and/or fill-up of the inaccurate, wrong, and/or
incomplete data about you;
– Require the termination of the processing, deletion, or erasure of your data;
– Require the blocking of your data;
– In the event of automated data processing, if it is technically feasible, receive
provided data from us in a structured, commonly used, and machine-readable
format or require the delegation of the hereof data to a responsible entity for
processing;
– At any time and without any elucidations or substantiation, recall the permit
issued by you to us on the processing of your data;
– In the event of a violation of your rights, appeal to the Personal Data Protection
Service and/or the Court in an order established under the law.

Sharing Personal Data

We, perchance, in view of the fulfillment of certain assignments, may share your
personal data with the third party in the event, that the Company, within its primary
activity, uses the service of the third parties and other providers, for instance:
– The design of the web instruments and/or applications, as well as the
maintenance service;
– IT service providers capable of ensuring the provision of the application or
infrastructure services (e.g. “cloud”);
– Legal, auditing, and other professional services provided to the Company by the
lawyers, notaries, attorneys, auditing companies, etc.;
– Insurance company providing the insurance of the employees of the Company;
– Commercial bank, on the basis of which the remunerations are issued to the
employees;
– Commercial bank for the purpose of enjoying the credit products of the Company
upon the use of the respective account or ensuring other transactions.
We transfer the personal data to third parties on the basis of the legal act or an
agreement solely – the documents that stipulate the basics and objectives of data
processing, the categories of the data for processing, the data processing terms, and
the powers and duties of the person responsible for processing, or the person
authorized for processing.
The Company shall not ensure the international transfer of your data.

Terms for Personal Data Storage

We store your personal data:
– With the term that is necessary for the achievement of the processing purpose;
– With the term established within the service provision;
– With the terms envisaged under the agreement;
– In line with the terms stipulated under the legislation of Georgia.

Other Conditions

The issues, not regulated under the hereby policy document shall be governed in line
with the Law of Georgia on “Personal Data Protection” and the normative acts issued on
the basis thereof.
At that, the Company applies the “Personal Data Protection Policy”, the full version of
which is available at: ——————–

Contact Us

In the event of your expressed will to realize the rights guaranteed to you under the
legislation and the hereby document, contact us to the e-mail address:
info@georgiancapital.ge
Or during working hours visit/submit your application to the Company (address: N37,
Rustaveli Ave, Tbilisi) in person or through your proxy. At that, please, take into
consideration that for certifying the fact that we share the data truly with the data subject
or his/her authorized person, the application shall be enclosed with a copy of the ID
(when you submit the application in person) or the power of attorney and a copy of the
ID (when you submit the application through an attorney).
In addition to the aforementioned, you may call us at: (032) 296-10-10) during the
period of Monday-Friday.