Privacy and Personal Data Protection Policy

April 20, 2026; Website: https://sushiwoki.ge/

Data Controller: JSC "Sushimania" (I/N: 405252471)

Legal Address: N 19, Corner of Mitskevich and Kutuzov Streets, Tbilisi

1. General Provisions This Privacy Policy (the "Policy") defines how JSC "Sushimania" (hereinafter - the "Company" or "We") collects, processes, stores, and protects the personal data of its users (hereinafter - "You" or the "Data Subject"). We respect your private space and ensure the processing of your data in strict compliance with the requirements of the Law of Georgia "On Personal Data Protection."

2. What Personal Data Do We Collect? We collect only the data necessary to provide our services fully and for the functioning of the website. Data categories include:

• Identification and contact information: First name, last name, mobile phone number, email address.

• Order and delivery details: Physical delivery address (street, building, apartment), order history, special requests/comments on the order.

• Financial information: Payment method, transaction time, and status (Note: When paying by bank card on the website, your full card details are not stored on our server. Payment is carried out on the secure page of the partner bank/payment provider).

• Technical data and Cookies: IP address, device type, browser version, time of visit to the website, duration, and navigation history.

3. Purposes and Legal Grounds for Data Processing Your data is processed only for specific, predefined purposes and based on the relevant legal grounds:

Purpose: Receiving, processing, preparing your order, handing it over to the courier, and delivering it to the indicated address. Providing customer support (e.g., contacting to clarify the address).

Legal ground: Data processing is necessary to perform the transaction (service agreement) concluded with you.

Purpose: Administration of payments, generation of receipts/invoices, and reporting provided by the tax legislation of Georgia.

Legal ground: Performance of a legal obligation (Article 5, subparagraph "c" of the Law).

Purpose: Eliminating system bugs, improving website design, analyzing user preferences, and providing personalized content.

Legal ground: Your voluntary and unambiguous consent (Law of Georgia "On Personal Data Protection", Article 5, subparagraph "a"), which you grant when accepting the cookie policy on the website.

4. Direct Marketing (SMS, Email, and Special Offers) We use direct marketing so that you are the first to know about our news, discounts, new menus, and special promotions.

• 4.1. Consent to marketing: Your phone number and email will be processed for direct marketing purposes only based on your prior, voluntary, and unambiguous consent (for example, by checking the corresponding box (so-called check-box) during registration on the website or when placing an order).

• 4.2. Right to opt-out (withdrawal): You have the right at any time, without any fee or explanation of the reason, to refuse to receive advertising messages.

• 4.3. How do I turn off advertising messages? You can opt-out of marketing simply, in the same form in which you received the message:

In case of SMS: Send the opt-out code indicated in the message text (e.g.: SMS OFF) to the indicated number.

In case of email: Click the "Unsubscribe" button at the bottom of the letter.

Alternative way: Contact us at info@sushi24.ge or call us at 0322050505. The delivery of messages will be stopped no later than 7 working days after receiving the opt-out request.

• 4.4. Google Analytics, Meta Pixel: We may analyze your order history, preferences, and navigation behavior on the website (so-called profiling) to offer you products tailored to your taste, personalized discounts, and improve service quality. This process may be carried out through automated systems (algorithms). You have the right to object at any time to the processing of your data for profiling purposes and, in relevant cases, to request human intervention in the automated decision-making process. To exercise this right, please contact us through the contact channels indicated in this policy.

Automated Decision-Making and Profiling We use profiling technologies to analyze your preferences (for example: order history, frequency of purchases, and behavior on the website).

• Logic and automated decisions: Based on the collected data, our systems can automatically (without human intervention) segment the audience and form individual offers. However, the company does not exclusively use automated decisions that may cause legal consequences for you or otherwise significantly affect your rights (for example, algorithms are not used for hidden or discriminatory price changes).

• Consequences for the user: The only result of profiling is that you receive more relevant content: personalized discounts, recommendations from the menu tailored to your taste (for example, offering vegetarian dishes if you order them more often), and targeted advertising.

• Your rights and human participation: You have the right at any time to object to the processing of your personal data for profiling for direct marketing purposes. In addition, you have the right to contest any automated decision, express your opinion, and request the intervention of a person (an employee of the company) in the decision-making process. To exercise these rights, contact us through the contact channels indicated in this policy.

5. Data Transfer to Third Parties (Authorized Persons) The company will never sell your data. Transfer of your data to third parties occurs only to ensure service continuity and with strict legal guarantees. To provide our services, we use "Data Processors," such as:

• Courier and delivery service providers.

• IT hosting and server service providers.

• SMS and email mailing services.

Cross-Border Data Transfer We use analytical and advertising tools such as Google Analytics and Meta Pixel, the operation of which may involve the transfer and storage of part of your personal data on servers located outside of Georgia.

• Fact of transfer: When using our website, your technical data (e.g., IP address, cookies, information about the browser and navigation) may be transferred to the countries where the providers of these services are located.

• Transfer regions: Primarily, the transfer is carried out to the USA and European Union (EU) countries, where the data processing centers of Google LLC and Meta Platforms, Inc. are located.

The transfer is carried out based on the necessity of ensuring the technical functioning of our website and improving the quality of service.

We ensure the protection of your data by cooperating with providers that use strict security measures, including Standard Contractual Clauses approved by international regulators, as well as data protection mechanisms that ensure a level of security equivalent to the requirements of Georgian legislation.

By providing your data through the website, you confirm your consent to such cross-border data transfer for the above-mentioned purposes.

Legal guarantee: The company has a strict written agreement with each authorized person, which prohibits the use of transferred data (e.g., your phone number or address) for any other purpose (including their own marketing purposes). Providers are obliged to observe the highest security standards and delete your data immediately upon completion of the service. Data is transferred to state or law enforcement agencies only in cases directly provided by law, based on a court warrant or a reasoned request.

6. Data Retention Periods Your data is stored only for the period necessary to achieve the specific processing purpose:

• Registered profile data: Stored until the account is canceled/deleted by you.

• Order and transaction history: Stored for the period established by the tax legislation of Georgia (taking into account the limitation periods).

• Data collected for marketing purposes: Stored until you withdraw your consent (opt-out of marketing). In case of withdrawal of consent, the data will be immediately deleted from the advertising database.

7. Your (Data Subject's) Rights According to Georgian legislation, you enjoy the following rights:

• The right to know what data we process, for what purpose, and to whom it was transferred.

• Request the correction or update of inaccurate, incorrect, or incomplete data.

• Request the deletion of your data from our databases if the legal basis for their storage no longer exists.

• Request temporary suspension of data processing (for example, until inaccurate data is corrected).

• Request the provision of data provided by you in a structured and electronic format, or direct transfer to another company (if technically possible).

• Withdraw the consent granted by you at any time (which will not affect the lawfulness of processing carried out before the withdrawal of consent). To exercise these rights, you can contact us in writing through the contact channels indicated below. We will consider your request and provide an answer within the time established by law (no later than 10 working days).

8. Cookie Policy We use cookies and similar tracking technologies to ensure the reliable operation of our website, analyze traffic, and offer you relevant content and advertising offers.

• 8.1. What are cookies? Cookies are small text files that are stored on your device (computer, smartphone, or tablet) when accessing the website. They allow the site to "remember" your actions and preferences over a certain period.

• 8.2. Classification of used cookies: We use the following categories of cookies:

Strictly Necessary (Mandatory): These files are necessary for the functioning of the website and allow you to move between pages and use basic functions (e.g., access to the cart or protected sections). Service operation is impossible without these files.

Analytical/Statistical: Helps us understand how visitors interact with the site by collecting anonymous information (e.g., pages visited and traffic sources). This allows us to improve the structure and performance of the resource.

Functional: Used to remember your settings (e.g., language or region choice) and provides a more personalized experience.

Marketing and Targeted: These files are used to track visitors across different websites. They allow us to show you advertising announcements that are of interest to you and also limit the number of times an ad is shown.

• 8.3. Third parties and analytical tools: Our site is integrated with third-party services that can set their own cookies:

Google Analytics: Used to analyze visit statistics. Data is transferred to Google for report formation.

Meta Pixel (Facebook): Used to evaluate advertising effectiveness and create audiences for retargeting in social networks.

Payment systems: Third-party payment services may set cookies to ensure transaction security.

Session cookies: Deleted automatically immediately after closing the browser.

Persistent cookies: Stored on your device for a certain period (from several days up to 2 years) or until you delete them manually.

• 8.5. How to manage cookies? You have the right to determine for yourself which cookies to accept.

Browser settings: Most browsers allow you to block or delete cookies from the privacy settings. Note that blocking mandatory files may make it impossible to use the site https://sushiwoki.ge/ (for example, you will not be able to place an order).

Opting out of analytics: You can install the Google Analytics opt-out program to prevent data collection by this service.

Consent banner: During the first visit to the site, you can choose the categories of cookies to whose use you grant consent.

9. Privacy of Minors Our service is not intended for persons under the age of 16. We do not knowingly collect data from children under 16 without the explicit consent of a parent or legal representative. If a parent becomes aware that a child has provided us with data, please contact us, and we will immediately delete this information from our servers.

10. Changes to the Policy We reserve the right to update this policy at any time in case of changes in legislation or our services. We will inform you in advance about significant changes by posting a corresponding notification on the website or by email. Please check this page periodically.

11. Contact Information and Right to Appeal If you have questions regarding this policy or wish to exercise your rights, please contact us:

Email: info@sushi24.ge

Phone: 0322050505

Address: N 19, Corner of Mitskevich and Kutuzov Streets, Tbilisi