Privacy
Policy

All Property Group (All Property Batumi) is a real estate agency operating in Batumi, Georgia. We are engaged in the selection, sale, and provision of intermediary services in the field of residential and commercial real estate.

In the terms of the GDPR (EU Regulation 2016/679) and Federal Law No. 152-FZ "On Personal Data", the Company is the personal data controller — the entity that independently determines the purposes and means of their processing.

• Name: Sole Proprietor Timur Seitgali — All Property Group
• Registered address: Georgia, Batumi, 58 V. Gorgasali St., attic, No. 6b
• Website: apb.ge
• Email for data requests: info@apb.ge
• Phone: +995 550 505 888

When you complete a lead form in an advertisement on Facebook or Instagram, we may receive the following data:

• First and last name
• Phone number
• Email address
• City or country of residence (if provided)
• Type of real estate of interest or budget (if specified in the form)

We collect only the data that is necessary to achieve the stated purposes of processing (the data minimization principle — Art. 5(1)(c) GDPR, Art. 5 of Federal Law No. 152-FZ). We do not collect special categories of data: racial or ethnic origin, political views, religious beliefs, biometric or medical data.

The collected data is used solely for the following purposes:

• Contacting you regarding your request — call, message, letter
• Selecting real estate properties according to your preferences
• Providing intermediary services for the selection and acquisition of real estate in Batumi
• Informing you about current properties, if you have given your consent
• Fulfilling contractual obligations to the client
• Complying with the requirements of applicable law

The processing of personal data is carried out on the following legal bases:

• Consent of the data subject — voluntary, informed, and specific consent expressed when completing the lead form (Art. 6(1)(a) GDPR; Art. 9 of Federal Law No. 152-FZ)
• Performance of a contract — processing is necessary for the conclusion or performance of a contract for the provision of intermediary services (Art. 6(1)(b) GDPR; Art. 6 of Federal Law No. 152-FZ)
• Legitimate interest — processing is necessary for the realization of the Company's legitimate interests, provided that they do not conflict with the rights and freedoms of the data subject (Art. 6(1)(f) GDPR)
• Compliance with a legal obligation — in cases where processing is required by applicable law (Art. 6(1)(c) GDPR; Art. 6 of Federal Law No. 152-FZ)

You have the right to withdraw your previously given consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.

We may transfer your data to a limited circle of third parties solely within the scope of the stated purposes:

• CRM system — for storing and managing requests (a data processor acting on our instructions)
• Meta Platforms (Facebook/Instagram) — with respect to the data transferred through the lead form on the Meta platform
• Messengers (WhatsApp, Telegram) — when used to communicate with you at your initiative
• Government authorities — upon lawful demand of competent authorities

With all data processors, the Company concludes data processing agreements (Data Processing Agreements) that ensure an appropriate level of protection of personal data in accordance with Art. 28 GDPR and Art. 6 of Federal Law No. 152-FZ.

Due to the use of international services (Meta, CRM systems), your data may be processed on servers located outside Georgia and the European Union, including in the USA.

Such transfer is carried out on the basis of:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions adopted by the authorized bodies
• Your explicit consent to the transfer of data (Art. 49(1)(a) GDPR)

In accordance with the requirements of Federal Law No. 152-FZ (Art. 12), in the case of cross-border transfer of the data of citizens of the Russian Federation, the Company takes measures to ensure the proper protection of personal data.

Your data is stored in a secure CRM system. Access to it is available only to Company employees who work directly with clients.

In accordance with the principle of "data protection by default and by design" (Privacy by Design & by Default, Art. 25 GDPR), we apply the following technical and organizational measures:

• Encryption of data during storage and transmission (TLS/SSL)
• Differentiation of access rights to personal data
• Regular backup and data integrity control
• Employee training on personal data protection matters
• Security incident response procedures

In the event of a security breach that entails a risk to the rights and freedoms of data subjects, the Company will notify the competent supervisory authority thereof within 72 hours (Art. 33 GDPR), and will also notify you in the case of a high level of risk (Art. 34 GDPR).

In accordance with the GDPR (Art. 15–22) and Federal Law No. 152-FZ (Art. 14–17), you have the following rights:

• Right of access (Art. 15 GDPR; Art. 14 of Federal Law No. 152-FZ) — to obtain confirmation of the fact of processing and a copy of your personal data
• Right to rectification (Art. 16 GDPR; Art. 14 of Federal Law No. 152-FZ) — to demand the correction of inaccurate or incomplete data
• Right to erasure / "to be forgotten" (Art. 17 GDPR; Art. 14 of Federal Law No. 152-FZ) — to demand the deletion of your data where there are grounds
• Right to restriction of processing (Art. 18 GDPR) — to demand the suspension of processing in certain cases
• Right to data portability (Art. 20 GDPR) — to receive your data in a structured, machine-readable format
• Right to object (Art. 21 GDPR) — to object to the processing of data on the basis of legitimate interest or for the purposes of direct marketing
• Right to withdraw consent (Art. 7(3) GDPR; Art. 9 of Federal Law No. 152-FZ) — to withdraw consent at any time without prejudice to the lawfulness of processing carried out previously
• Right to lodge a complaint (Art. 77 GDPR; Art. 17 of Federal Law No. 152-FZ) — to apply to a data protection supervisory authority

To request the deletion of personal data, use the separate page: Data Deletion.

To exercise any of the listed rights, send a request to the email address: info@apb.ge. We will review your request within 30 calendar days (Art. 12 GDPR) or 30 working days (Federal Law No. 152-FZ).

Our advertising pages may use Meta Pixel — a Facebook/Instagram analytics tool. It helps us evaluate the effectiveness of advertising and does not transmit your personal data to us directly.

Types of cookies used:

• Necessary (technical) — ensure the basic functioning of the site, do not require consent
• Analytical — allow the analysis of site traffic (Google Analytics, Meta Pixel), used only with your consent
• Marketing — used to display personalized advertising, only with your consent

On your first visit to the site, you are given the opportunity to choose which categories of cookies you accept. You can change your preferences at any time through your browser settings.

Data processing by the Meta platform is governed by the Meta Platforms Privacy Policy.

Our services are not intended for persons under 18 years of age. We do not knowingly collect the personal data of minors. If you become aware that a child has provided us with personal data without the consent of parents or legal representatives, please notify us immediately at info@apb.ge — we will delete such data as soon as possible.

In accordance with Art. 8 GDPR, in the event that the data subject is a child under 16 years of age (or the age established by national law), the processing of their data on the basis of consent is lawful only with the consent of parents or guardians.

If you believe that the processing of your personal data violates applicable law, you have the right to lodge a complaint with the competent supervisory authority at your place of residence:

• For EU/EEA citizens — the data protection supervisory authority of your country (list: edpb.europa.eu)
• For citizens of the Russian Federation — Roskomnadzor (the Federal Service for Supervision of Communications, Information Technology and Mass Media): rkn.gov.ru
• For residents of Georgia — the Personal Data Protection Service of Georgia: personaldata.ge

Before applying to a supervisory authority, we recommend that you first send a request directly to us — most issues are resolved in the ordinary course within 30 days.

We reserve the right to update this Privacy Policy. The date of the last change is always indicated in the document header.

In the case of material changes affecting your rights, we will notify you by email or through our communication channels no less than 30 days before the changes take effect. Continued use of our services after notification signifies your agreement with the updated version of the Policy.

The current version of the Policy is always available at apb.ge/privacy.