English edition R3.3 · Prepared 1 October 2026 · Effective from the date of publication on the website.
1 Data controller
The website operator and accommodation provider in Georgia is LLC Luxury Apart Hotel Group (შპს ლაქშერი აპარტ ჰოტელ გრუპ), identification number 405888455, hereinafter the Company. Website: https://luxuryaparthotel.ge.
The Company is the controller of personal data within the website and its own service processes. For data matters: info@luxuryaparthotel.ge. The actual office and correspondence address is given in the contacts section.
This Policy explains what data is used, for what purpose, to whom it is transferred and how to exercise your rights. Reading it is not universal consent to advertising or any processing.
2 Scope and sources
The Policy applies to website visitors, guests, payers, persons making bookings, owners, and applicants regarding property, tours and other services.
Through the standard online booking form you can pay for apartment accommodation and, where the guest selects them, for breakfast and transfer. Breakfast and transfer are not automatically included in every rate: their inclusion in the price, or a separate price, is stated clearly before payment and in the booking confirmation. No other paid services are added automatically.
The remaining sections of the website are informational. Tours, excursions, private journeys, events and concierge services are booked only on request via WhatsApp or the relevant email address, after separate agreement. They are not paid through the standard online accommodation booking form. Viewing a section or submitting a request does not constitute a confirmed order and does not create an obligation to pay for a service.
Data comes from the user, the person making or paying for the booking, the relevant partner, the bank and the technical provider. If data is obtained from a third party, the Company fulfils the information duties provided by law. A person transferring another’s data must have a lawful basis; this does not remove the Company’s obligations.
An independent provider may process data as a separate controller for its own lawful purposes. Where necessary, its policy is provided to the user.
3 Categories of personal data
Contact data: first and last name, email, telephone, language of communication.
Booking: booking number, property, location, dates, number of guests, selected services, requests and booking history.
Payment and refund: transaction identifier, amount, currency, method, status and the necessary confirmations. The full card number and CVV are not stored by the Company when the card is processed in the secure environment of an independent provider.
Identification: the fact of document verification and the necessary details. A full copy is not requested or stored automatically for all guests.
Owners and property: city, type, area, floor, property condition, management needs, interest in purchase or sale, a voluntarily stated budget, photos and documents on request.
Breakfast, transfer and tours: dates, number of participants, route, meeting point, flight and necessary preferences.
Communications: letters, WhatsApp messages, enquiries, claims, reviews and the history of resolving matters.
Technical data: IP address, browser, device, language, security logs, session identifiers and cookies, depending on the technologies actually used.
Incidents: lawfully obtained photos, video, reports and damage information to the extent necessary.
Preferences: consent to or refusal of advertising and optional cookies, and confirmation of that choice.
4 Purposes and legal bases
Processing a request, booking, accommodation, and the selected breakfast or transfer is carried out to conclude and perform the contract and for actions at the user’s request before it is concluded.
Payment, refund and financial records are used to perform the contract and for accounting and tax obligations. Security, fraud prevention, handling claims and defending claims may be based on applicable legal obligations or legitimate interest after assessing necessity, proportionality and the user’s rights.
Owner, purchase, sale and tour forms serve the consideration of the specific request and negotiations; after a separate contract is concluded, its performance.
Strictly necessary technical means are used for the operation of the website, protection and provision of the requested functions. Optional analytics, advertising cookies and direct marketing are based on separate prior consent.
Mandatory fields correspond to the necessary amount of data. The absence of necessary information may prevent the performance of a service; refusing advertising or optional data does not deprive the user of the main service. Special categories of data, including health information, are not usually requested. Where genuinely necessary, an appropriate separate legal basis and enhanced protection apply.
5 Identity verification and documents
At check-in, a visual check of a passport or ID is usually carried out. A biometric passport is not mandatory. A copy, photograph or additional document numbers are requested only in exceptional cases, where necessary for a specific lawful purpose that cannot be achieved with less data.
The Company states the purpose, basis, whether provision is mandatory and the consequences of refusal. Details not relevant to the purpose are concealed where possible. A copy is transferred via a secure agreed channel, stored with restricted access and deleted after the purpose is achieved or the mandatory period ends. A technical mismatch does not, in itself, rule out reasonable additional verification.
6 Forms and correspondence
For Owners requests go to the Owner Relations direction; Investment & Sales to the sales direction; tours to the concierge direction. Submitting a form does not create a contract and does not subscribe the user to advertising.
If a form opens the user’s mail application, the rules of the chosen mail provider also apply on sending. Correspondence via WhatsApp uses a third-party service and is also subject to its rules. The Company processes received correspondence under this Policy; the presence of WhatsApp does not mean consent to advertising.
Advertising is sent only with the relevant consent. It can be withdrawn free of charge through the means indicated in the message or via info@luxuryaparthotel.ge. Service messages, vouchers and refund notifications are not an advertising subscription.
7 Data recipients
To the extent necessary, data may be received by banks and payment providers for payment and refund; by providers of hosting, the website, the booking system, CRM, email, backup and IT for technical maintenance; by accountants and legal advisers for lawful professional tasks; by building administration and reception for check-in, keys and safety; by specific providers of breakfast, transfer, hotels and tours for the ordered service; and by state authorities on a lawful request.
Analytics and advertising providers receive data only for tools actually enabled and with the necessary prior consent. Staff access is limited to their tasks. Necessary contractual and protective obligations are put in place with processors.
A Zanzibar request does not mean transferring information to all partners. Data is transferred to a specific provider in Tanzania only in connection with a particular request and in compliance with the law.
8 International transfer
Foreign technical services and international providers may process data outside Georgia. Transfer is allowed only on a basis provided by law with the necessary protection safeguards. If special consent or authorisation from a competent authority is required, the Company obtains it before transfer.
The user may request information about recipients, countries and applicable safeguards via info@luxuryaparthotel.ge. A general reference to a foreign service is not, in itself, a separate lawful basis for transfer.
9 Retention periods
Booking, payment and invoice information is kept for the duration of performance of the contract and the applicable mandatory accounting or tax period. Claims, refunds and damage evidence are kept for the duration of their consideration and the period necessary to bring or defend lawful claims.
Owner, sales and tour requests that do not result in a contract are periodically reviewed and deleted or anonymised after the business purpose and legal basis end. Document copies that were specifically requested are kept only for the necessary or mandatory period.
For consents and refusals, a minimal record necessary to confirm and respect the choice is kept. Security logs are kept for the period necessary to protect against and investigate a specific incident. Cookie periods are disclosed in the website settings for each identifier actually used.
The period depends on the category of data, the purpose, legal obligation and the existence of a dispute; data is not stored indefinitely merely because it was once received.
10 Security and incidents
The Company applies technical and organisational measures proportionate to the risks: access control, password management, secure connections, backups, confidentiality obligations and incident response. Absolute technical security is not guaranteed.
In the event of an incident, the Company records the circumstances, assesses the risk and fulfils the duties to notify the competent authority and the affected persons in the cases and within the time limits established by law.
Video surveillance by the building administration does not mean that the Company controls all spaces. Obtaining and using recordings requires a lawful basis. The Policy does not permit covert surveillance in guests’ private space.
11 Cookies and similar technologies
A cookie is a small file or similar identifier used by a device or browser for website functions. Strictly necessary cookies provide the session, security, the requested booking and the saving of the consent choice. They are applied without additional consent only to the extent necessary.
Functional, analytical and marketing technologies that are not strictly necessary are blocked until the relevant prior consent. The banner offers equally accessible options: “Accept all”, “Reject optional” and “Customise”. Continuing to browse and closing the banner are not treated as consent.
The choice can be changed and consent withdrawn in the cookie settings. Refusing optional technologies does not, in itself, prevent booking; a separate additional function that depends on them may be unavailable. The choice, time and version of the notice are recorded to the extent necessary.
The cookie settings disclose the real names of identifiers, providers, purposes, categories and periods. Browser settings can also restrict cookies, including necessary ones, which may affect the operation of the website.
12 Technologies actually used
Only technologies actually enabled in the current website configuration are applied. Booking systems, WordPress, Elementor, WooCommerce, and Google or Meta tools are mentioned as possible categories, not as confirmation of their installation. Information about specific active tools is given in the cookie settings and the relevant notices.
The TBC E-Commerce / Flitt payment integration and specific payment methods are used after actual activation. The Company stores the necessary identifiers and statuses of payments and refunds, amounts and currency. Acceptance of contractual terms is recorded separately from consent to advertising and optional cookies.
13 User rights
Within the applicable law, the user has the right to receive information about processing and a copy of the data; to request correction and updating; in the cases provided, to cease processing, delete, destroy or block; to withdraw consent; to opt out of direct marketing; and to contest a relevant decision. Rights to data portability and protection against solely automated decisions apply in the cases provided by law.
A request is sent to info@luxuryaparthotel.ge; you may also use the official WhatsApp. A response is provided within the time established by law for the specific right. In the event of a refusal or restriction, the basis and the appeal procedure are communicated. Additional identification is requested only to the extent necessary and proportionate.
A data-protection complaint can be submitted to the State Audit Office of Georgia, which carries out the relevant supervision, or to a court. Withdrawing consent does not cancel the lawfulness of processing already carried out and does not stop processing for which another lawful basis exists.
14 Minors and automated decisions
Online booking is made by a responsible adult. Information about children is used only to the extent necessary for booking, safety and a specific service. Direct marketing to minors is not carried out.
The Company does not take a decision with legal or comparably significant adverse consequences solely on the basis of an automatic technical mismatch without proper human review. The independent decisions of a bank and other providers are governed by their rules and applicable law.
15 Contacts and updating the policy
General and legal matters and personal data: info@luxuryaparthotel.ge.
Booking, guest service, cancellation and refund: reservations@luxuryaparthotel.ge.
Owners and property management: ownerrelations@luxuryaparthotel.ge.
Tours and concierge services on request: concierge@luxuryaparthotel.ge.
Purchase, sale and investment enquiries: sales@luxuryaparthotel.ge.
WhatsApp: +995 557 528 285. Telephone for calls: +995 555 907 333.
Actual office and correspondence address: Georgia, Batumi, 7d Sherif Khimshiashvili St., Orbi City, Block C, 13th floor, office No. 1333.
The policy takes effect after publication on the website, stating the edition and date. For material changes, the information required by law is provided and, where required, new consent is requested. The policy does not, in itself, change the commercial terms of a confirmed booking or the party to a contract.
Processing and the technical settings of the website must comply with this policy. When new tools are added, the cookie information and the consent mechanism are updated.
