Privacy Policy

01Introduction

This Privacy Policy explains how Colchis lab LLC, a company registered in Georgia, collects, uses, stores, and protects personal information when you visit our website, contact us, request information, or use our services.

In this Privacy Policy:

• "Colchis lab," "we," "us," or "our" means Colchis lab LLC;
• "you" or "your" means a website visitor, prospective client, client, representative, or other individual whose personal information we process;
• "Personal Data" or "Personal Information" means information that identifies or may reasonably be used to identify an individual.

By using our website or contacting us, you acknowledge that you have read and understood this Privacy Policy.

02Who We Are

Legal name: Colchis lab LLC

Country of registration: Georgia

Email: info@colchislab.com

Colchis lab provides website design and development, automation, CRM integration, software development, API integrations, SEO optimization, and related digital services.

For privacy-related questions, requests, or complaints, you may contact us using the email address above.

03Information We Collect

Depending on how you interact with us, we may collect the following categories of information:

3.1 Information You Provide Directly
When you contact us, submit a form, request a proposal, or communicate with us, we may collect:

• Name, surname, and professional role / job title;
• Email address, company email address, and telephone number;
• Company name, project requirements, budget, or service preferences;
• Social media account details (WhatsApp, LinkedIn, Instagram, Facebook);
• Information included in your message or any other voluntary details.

Note: You should not provide passwords, payment card details, sensitive personal information, or confidential information through a website contact form unless specifically requested through a secure channel.

3.2 Information Collected Automatically
When visiting our website, technical details may be collected via cookies, server logs, and analytics tools:

• IP address and approximate location derived from IP;
• Browser type, operating system, and device type;
• Referring website, pages visited, time spent, date and time of access;
• Interaction with content and diagnostic data.

3.3 Information from Communications and Social Platforms
If you reach out via Instagram, Facebook, WhatsApp, LinkedIn, or email, we may receive public profile info, usernames, contact details, messages, and sent files. Third-party platforms are subject to their own policies.

04How We Use Personal Information

We process personal data for the following purposes:

• Responding to inquiries, managing client relationships, and customer support;
• Preparing proposals, quotations, estimates, and managing contracts or invoices;
• Providing, operating, and optimizing our Services and user experience;
• Measuring traffic, diagnosing technical/security issues, and preventing fraud or abuse;
• Complying with legal obligations and protecting business interests;
• Creating anonymized statistics and developing future products;
• Sending permitted marketing communications (where consent has been granted).

05Legal Bases for Processing

We process personal information based on one or more of the following legal grounds:

• Your explicit consent (which you may withdraw at any time);
• Performance of a contract or steps taken prior to entering into a contract;
• Compliance with legal obligations;
• Our legitimate business interests;
• The establishment, exercise, or defense of legal claims.

06Contact Forms and Email Communications

Information submitted through website forms is received and processed through secure email. We use this data to respond to inquiries, manage potential business relationships, and maintain communication records.

We retain correspondence as long as necessary to manage relationships, fulfill legal obligations, or resolve disputes. We do not sell form data to third parties.

07Google Services and Analytics

We utilize tools such as Google Analytics 4, Tag Manager, Google Ads, Search Console, Google Consent Mode, and Google Workspace.

These services help us analyze traffic, evaluate advertising effectiveness, and improve our digital presence. We do not intentionally send identifying personal data (names, emails) to Google Analytics. Non-essential tracking is activated only after proper user consent is obtained in compliance with EEA/UK standards.

08Cookies and Similar Technologies

Cookies are small text files stored on your device that facilitate site operations, store preferences, and track analytics.

For detailed information on essential, functional, analytics, and advertising cookies, please consult our separate Cookie Policy. You can customize, accept, or reject non-essential cookies via our consent banner at any time.

09Social Media and Communication Platforms

Our website features links and integrations for Instagram, Facebook, WhatsApp, LinkedIn, and Email. Interacting with these platforms subjects your data to their respective privacy terms. Future implementations of Meta Pixel or LinkedIn Insight Tag will strictly adhere to necessary consent frameworks.

10Future CRM and Internal Business Systems

We are developing proprietary CRM tools. Inquiries, project progress, client communications, and support records will be stored within our secure internal systems to improve service execution and business organization.

11Google Workspace and Productivity Services

We use Google Workspace for business communications, calendar scheduling, file storage, and documentation. All data stored within workspace infrastructure is safeguarded using robust administrative and technical controls.

12Payments and Financial Information

We do not collect payment card numbers directly on our site. Payments are conducted via bank transfers or formal invoices. Retained financial details include billing names, addresses, invoice IDs, transfer amounts, and dates.

13Data Sharing and Disclosure

We do not sell personal data. Information may be shared with trusted third parties strictly necessary for business operations:

• Hosting, infrastructure, analytics, and communication providers;
• Accountants, auditors, legal counsel, and professional advisers;
• Government authorities, courts, or regulators when legally mandated.

14International Data Transfers

Because we collaborate internationally, your data may be stored or processed outside Georgia, including the EEA, UK, or United States. We implement recognized transfer safeguards and contractual obligations to guarantee security across all locations.

15Data Retention

We retain personal information only for as long as required to fulfill inquiry processing, contract completion, legal accounting obligations, or dispute resolution. Expired data is securely deleted or anonymized.

16Data Security

We enforce organizational and technical measures against data loss, unauthorized access, alteration, or misuse. Measures include strict password policies, access controls, and administrative procedures. However, no electronic transmission method is 100% secure.

17Your Privacy Rights

Depending on your jurisdiction, you have the right to:

• Access, correct, or request deletion of your personal information;
• Restrict processing or object to direct marketing;
• Request data portability or withdraw previously granted consent.

To exercise your rights, email us at info@colchislab.com.

18European Economic Area and UK Visitors

For individuals in the EEA and UK, data handling conforms with GDPR/UK GDPR standards. Consent is requested prior to activating non-essential cookies or analytics. You have the explicit right to complain to your local data protection supervisory authority.

19United States Visitors

US residents enjoy privacy protections tailored to applicable state legislation (such as access rights, opt-out mechanisms for targeted ads, and non-discrimination protection). We do not sell personal information for monetary considerations.

20Direct Marketing

We do not currently send regular marketing newsletters. Should direct marketing campaigns launch in the future, explicit consent mechanisms and simple opt-out links will be provided in every communication.

21Children’s Privacy

Our website and services are intended for general adult audiences and businesses. We do not knowingly collect information from children. If you believe a minor has submitted data to us, please notify us for immediate removal.

22Third-Party Websites

Our website may link to external sites. Colchis lab LLC is not responsible for the privacy practices, policies, or content of third-party platforms. We recommend reading their statements independently.

23Changes to This Privacy Policy

We may update this policy periodically to reflect operational, legal, or technology changes. Updates will be posted directly to this page with an updated "Last Updated" timestamp.

24Contact Us

If you have questions, concerns, or privacy requests, please reach out directly:

Legal Name: Colchis lab LLC

Country of Registration: Georgia

Email: info@colchislab.com

25Colchis Cookie Consent Service

25.1 Two situations and who we are. The Colchis Cookie Consent Plugin can operate independently. When the connection to the Colchis Service is disabled (the default on new installations), the Plugin does not send data to ColchisLab and loads its files from the Client's own website. This section describes processing that occurs when a website operator (the "Client") enables the Service connection. The Service is provided by Colchis lab LLC (identification number 405882674), Giorgi Shatberashvili Street No. 12, Apartment No. 1, Vake District, Tbilisi, Georgia. For questions about this section or about personal data, contact info@colchislab.com.

25.2 What is processed about website visitors.

• When a page with the banner opens, the visitor's browser requests the banner configuration for the relevant domain from api.colchislab.com. The API receives the visitor's IP address and browser information as part of handling the request.
• When the visitor makes a choice (accept all, reject all or customise), the Service records a consent record ID, the domain, a random visitor identifier stored in the website's first-party colchis_consent cookie, the choice and its version, the visitor's decision for each category (functional, analytics and marketing; the necessary category is always on), language, the page address without its query string and fragment (so parameters such as ?email= are not stored), the Global Privacy Control (GPC) signal, the browser's User-Agent string, the time of the choice and a value derived from the visitor's IP address. To derive that value, the address is truncated (IPv4 to its first three numbers, IPv6 to its first 48 bits) and the result is processed with a keyed one-way hash (HMAC-SHA-256). The raw IP address is not included in the consent record.
• If the Client enables region-based rules, the API reads the country code that Cloudflare attaches to the request in order to choose between opt-in and opt-out banner behaviour. The country code is not stored in the consent record or anywhere else, and the response is not cached. The visitor's browser may keep the result (the banner mode, not the country) in its session storage under the name colchis_region for the duration of the browsing session.
• If the Client loads banner scripts from cdn.colchislab.com, the visitor's browser requests those scripts from that server. The script server receives the IP address and browser information needed to serve the request.
• Separately from consent records, the web server and API may temporarily record request IP addresses in technical logs for security and abuse prevention. These logs are retained for approximately five weeks on the web server and up to 30 days in the API system journal. These periods apply to technical logs, not to consent records.

25.3 Purposes and legal bases. Consent records are processed to provide the Client with a record of visitors' consent choices and to operate the consent-management Service. The Client is responsible for determining and documenting the legal basis for processing visitor data on its website, including retaining evidence of consent where required. ColchisLab processes visitor data on the Client's behalf to provide the Service. ColchisLab may separately process limited technical log data for its own security and abuse-prevention purposes where permitted by applicable law. The applicable legal basis depends on the relevant processing activity and the role of the party concerned.

25.4 Roles and requests. For visitor consent records processed through the Service on behalf of a Client, the Client generally acts as controller and ColchisLab acts as processor, subject to the actual purposes and means of processing. Visitors should normally direct requests concerning those records to the website operator. ColchisLab will reasonably assist the Client in responding, in accordance with the applicable DPA and data protection law. ColchisLab acts as controller for personal data it processes for its own account administration and related business operations.

25.5 Client account data and domain verification. To provide and administer the Service, ColchisLab processes Client account email addresses, password hashes, connected domains, banner settings and scan results. Account data is processed to create and manage the account, provide the Service and maintain its security. Where processing is necessary to perform the agreement with the Client, the relevant legal basis may be Article 6(1)(b) GDPR. To confirm that a Client is authorised to connect a domain, the Service checks the Client's website for a verification token generated for the account, placed in a DNS TXT record, in a file or in a meta tag.

25.6 Recipients and service providers. Data may be processed by Hetzner Online GmbH for hosting, with the Service servers located in Germany; by Cloudflare for network delivery, caching and a private storage bucket for backups, which is encrypted at rest by the provider; and by UptimeRobot, which checks the availability of the Service's public addresses and does not receive visitor data. The applicable data processing terms and current sub-processor information form part of the Service's data protection documentation. ColchisLab provides it on request; send requests to info@colchislab.com. ColchisLab does not sell personal data or use visitor consent records for advertising.

25.7 International transfers. The Service's current hosting servers are located in Germany. A dedicated API and consent-log server is planned in the same country. Depending on the services used and the location from which data is accessed, some processing may occur outside the European Economic Area (EEA). Where applicable law requires a transfer mechanism, ColchisLab will use an appropriate mechanism and safeguards for the relevant transfer. Details of applicable transfer arrangements are provided in the Service's data protection documentation.

25.8 Retention. Consent records are automatically deleted 12 months after the visitor's choice on the Free and Basic plans and are retained for up to five years on the Pro and Business plans, according to the applicable plan settings. Server backups are retained for 14 days on the server and 30 days in the off-site bucket. Technical server logs are retained for the periods described in section 25.2.

25.9 Visitor rights. Depending on the applicable law, visitors may have rights to request access to, correction or deletion of their personal data, restriction of processing, objection, data portability and to lodge a complaint with a supervisory authority. Requests concerning consent records should normally be sent to the relevant website operator. A visitor identifier may be needed to locate a particular record; the identifier is stored in the website's colchis_consent cookie. ColchisLab will assist the Client as required under the applicable DPA and law.

25.10 Website scanner. When a Client starts a scan in the dashboard, the Service opens a limited number of pages of the Client's own domain (five by default) in an automated browser, records the cookies and browser-storage entries those pages create and the third-party addresses they contact, and stores the result in the Client's account. For each cookie the Service stores its name, domain, lifetime and technical attributes, but not its value; for browser storage it stores the names of the entries, not their contents. The scan does not use any visitor's personal data.