Privacy policy

This privacy policy explains what personal data SRM receives through the srm.ge website, what it uses the data for, who it shares the data with and how long it keeps it. It applies to the English, Georgian and Russian versions of the site. We process data in accordance with the Law of Georgia on Personal Data Protection, adopted on 14 June 2023. Its main provisions have been in force since 1 March 2024.

Who processes the data

The data is processed by SRM, Batumi, Georgia. We decide why and how data from the site is processed, and we are accountable to you for this. The company's full legal name and identification code are given in the contract, and before signing you can ask the manager for them. If you have questions about your data, contact us directly as described in the section on contacting us.

What data we receive

Through the forms on the site we receive:

Your name, as you entered it
Contact details: a phone number or a username in a messaging app
Your chosen contact method: WhatsApp or a phone call, and a convenient time to call, if you gave one
The text of your request and your answers to the questions in the form, such as the type and condition of the property, its area, the address or district, and the timing
Files you attached: photos, plans, documents
The address of the page from which the request was sent
Advertising campaign tags and the address of the website you came from, if you reached us through a link
An IP address fingerprint: the request database stores a hash of the address, and the address itself is not saved
Browser data: the name, version and operating system that your browser reports to the site

In the forms we do not ask for passport details, bank details or other information that we don't need in order to reply. If they are needed for a contract, we will ask for them separately when we prepare it. If you write to us on WhatsApp, we receive what you send in the chat and your phone number or username in that app.

Why we process data and on what legal basis

We need the data from your request to reply to you in the way you prefer, to prepare an estimate and a contract, and to stay in touch with you during the project. The IP address fingerprint and browser data help us filter out spam and automated form submissions, and the campaign tags show which adverts bring in requests. We do not use this data for mailings or for any other purposes unrelated to your enquiry.

We rely on two legal grounds under Article 5 of the Law: your consent, which you give by ticking the box when you submit a form, and the preparation of a contract at your request and, once it is signed, its performance. You can withdraw your consent at any time.

To run the site and process requests, data is received by the following services:

The hosting provider whose servers run the site and store the request database
The site protection service, which checks, when a form is submitted, that a person filled it in, and which receives the IP address and technical browser data
The messaging app through which the manager is notified of a new request: the notification includes the name, contact details, the text and form answers, the page it was sent from and the campaign tags, but not the files
The email service through which a copy of the notification reaches the manager's mailbox

The servers of these services may be located outside Georgia. If your project requires a notary, our partner lawyer or a government body, such as the Public Registry in a transaction, we pass on to them only what is needed for that action, and only within the scope of our contract with you. Data may be disclosed to Georgian government bodies where the law requires it. We do not sell personal data or pass it on for advertising.

How long we keep data

A request is kept in the site database for 12 months. After that it is automatically depersonalised: the name, contact details, request text and form answers, the manager's notes, browser data and attached files are deleted. Only information without a name or contact details remains: the date, the type of form, the page it was sent from, the chosen contact method and the campaign tags. The IP address fingerprint is deleted at this point as well.

If a contract is signed following the request, the data needed for it moves into the project documents. We keep these for as long as the contract and the warranty are in force, and after that for as long as the law requires contract and accounting documents to be kept.

Files from requests are stored on the server in a restricted folder. They cannot be opened through a direct link from the internet and can only be accessed through the restricted area of the site.

Cookies and analytics

The site uses technically necessary cookies and similar entries stored in your browser. For example, the browser remembers that you have closed the prompt about the version of the site in another language.

In addition, the site sets its own cookie with the campaign tags and the address of the page you came from. It is kept in your browser for up to 90 days and reaches us only if you submit a request.

An analytics service runs only if one is connected to the site. In that case it collects depersonalised visit statistics: which pages are opened, from which devices and where visitors come from. These statistics do not tell us who exactly visited the site.

The map and videos load from third-party services only after you click on them. From that moment the service receives your IP address and browser data and processes them under its own rules. You can delete or block cookies in your browser settings, and the forms will keep working.

Your rights

Under the Law, you can:

Find out what data of yours we process, why, and where we obtained it
Get access to your data and a copy of it
Ask us to correct, update or complete your data
Ask us to stop processing your data, or to delete or destroy it
Ask us to block your data, for example while we are considering your request
Withdraw your consent at any time without giving reasons, in the same way you gave it, for example with a message through the form on the site
Appeal against our actions to the State Audit Office of Georgia or to a court

We reply to a request within 10 working days at the latest. In exceptional cases, the Law allows the deadline for replying to a request for information or for access to data to be extended by a further 10 working days, and if that happens, we will tell you straight away. Withdrawing consent does not make processing carried out before the withdrawal unlawful, and we will continue to process the data needed to perform a current contract, with that contract as the legal basis.

On 2 March 2026, the powers of the Personal Data Protection Service of Georgia were transferred to the State Audit Office of Georgia. Complaints about the processing of personal data are now considered by the State Audit Office.

How to contact us about your data

Write to us through the form on the site or in the messaging app shown on the "Contact us" page, and mention that your question concerns personal data. So that we don't disclose your data to someone else, we may ask you to confirm that the request really comes from you, for example by replying from the same number you gave in your request.

If nobody has replied to your request, message us in the messaging app. Requests that look automated, for example those sent too quickly or too often from one address, are marked as spam by the system and are not forwarded to the manager.

Changes to this policy

If the way we process data changes, for example if there are new purposes or recipients, we will describe this here before we start working that way and will update the version date. This version is dated 16 October 2026.