Privacy Policy

Effective Date 1 July 2026

Overview of the Privacy Policy’s Coverage

Your privacy is our priority. At 4Turns Web Solutions IE ("4Turns," "we," "us," or "our"), we are committed to protecting your personal data ("Personal Data," as defined below). This Privacy Policy explains how we collect, use, store, and protect your Personal Data when you access our platform, which includes any websites or mobile applications we own and operate (collectively, the "Platform"). It also outlines your rights as a data subject and the legal protections available to you under the Law of Georgia on Personal Data Protection (the "Law").

By using our Platform, you consent to the collection and use of your Personal Data as described in this Policy. If you do not agree, please refrain from using our services.

Accordingly, this Privacy Policy outlines the following:

• Who We Are
• Data Protection Officer (DPO)
• Categories of Personal Data We Process
• How and Why We Use Your Personal Data
• Data Sharing and Transfers
• Data Retention
• Data Subject Rights
• Security Measures
• Cookies and Tracking Technologies
• Our Policy on Minors
• Amendments to This Policy
• Third Party Links
• Contact Information

We may revise this Privacy Policy from time to time, with or without notice to you. If that happens, the new version of this Privacy Policy will be made available on this page.

This Privacy Policy may be published in different languages. If that is the case and there are any inconsistencies between versions, the English language version will prevail.

1. Who We Are

4Turns Web Solutions IE is a registered business in the Republic of Georgia and acts as the data controller for the Personal Data processed through the Platform. We own and operate the website www.grek.ge and its associated applications (collectively, the "Platform").

Our address is Krtsanisi District, Nino and IIia Nakashidze St. #1; Tbilisi, Republic of Georgia

2. Data Protection Officer (DPO)

We have appointed a data protection officer to monitor the protection of your personal data. If you have a question about this data protection declaration or generally about data protection for classified ads, you can contact our data protection officer at any time by email at privacy@grek.ge

3. Categories of Personal Data We Process

"Personal Data" refers to any information relating to an individual that either directly identifies them or can be used to identify them. This definition excludes anonymised data, where the individual’s identity has been irreversibly removed. However, it includes pseudonymised data, which does not identify an individual on its own but could lead to identification when combined with other available information.

The categories of Personal Data we collect directly from you are described below.

3.1. Types of Data Collected

• Identity Data
  • First name, last name, username or similar identifier
  • Profile or store photo (if provided by user)
  • Location (manual entry)
• Contact Data
  • Email address
  • Telephone number(s) (required for account verification and fraud prevention)
• Listings Data
  • Details of ads posted (including images, descriptions, and pricing)
  • Viewed listings and offers made on other users' ads
• Store Data
  • Company details such as, company name, legal form, category, phone number, email, identification number, legal address, contact name (if provided by user for store creation)
• Marketing Data
  • Your consent in receiving marketing messages from us.
• Technical Data
  • IP address
  • Browser type and version
  • Device information (operating system, platform, time zone)
  • Platform usage data (pages visited, session duration)
• Behavioural Data (aggregated and anonymized where possible)
  • User activity patterns
  • Inferred interests based on platform interactions
• Payment and Financial Data (For paid ads only)
  • Payment method details (processed securely by third-party gateways; we do not store full card numbers — only masked card details such as the last 4 digits are retained for reference).
  • Transaction records (e.g., payment amounts, timestamps, invoice details).

Aggregated Data Usage

Our platform collects, processes, and utilizes aggregated statistical or demographic information derived from user data. This aggregated data, which does not directly or indirectly identify individuals, serves various analytical and operational purposes. Examples include calculating percentage-based usage metrics of specific platform features from behavioural patterns. Should aggregated data be combined with personal information in a manner that could potentially identify an individual, the resulting combined dataset will be treated and protected as personal data under the terms of this Privacy Policy, subject to all applicable data protection obligations. The processing of all such information remains governed by this Policy's provisions regarding personal data handling.

Special Categories of Data

Our platform is not designed to process sensitive personal data, including but not limited to information revealing racial or ethnic origin, religious or philosophical beliefs, political opinions, health status, genetic or biometric data, or details regarding criminal offenses and convictions. We expressly prohibit users from disclosing such information through any platform features, including support communications or user-to-user interactions.

Notwithstanding this prohibition, any voluntary disclosure of sensitive personal data by users through platform functions shall constitute explicit consent to process such information in accordance with this Privacy Policy. We emphasize that users assume full responsibility for any sensitive data they elect to share, understanding that such disclosures occur at their own discretion and risk.

This processing remains subject to applicable data protection laws, and we maintain appropriate safeguards for any sensitive data incidentally collected through user interactions. Users are strongly cautioned against including sensitive information in advertisements, communications, or other platform activities.

What Happens If You Choose Not to Provide Required Personal Data?

You are not obligated to provide your Personal Data to us. However, in instances where the processing of certain Personal Data is necessary—for example, to provide you with access to the Platform or to comply with legal requirements—your refusal to provide such data may prevent us from delivering the requested services.

For instance, we require your email address to create and register your account on the Platform. Without it, we may be unable to complete the registration process.

4. How and Why We Use Your Personal Data

We use your Personal Data solely for the purposes for which it was originally collected, as outlined below. If we determine that it is necessary to use your Personal Data for a different purpose that is compatible with the original purpose, we may do so in accordance with applicable data protection laws.

Should we need to use your Personal Data for a purpose that is materially different or unrelated to the original reason for collection, we will update this Privacy Policy accordingly and explain the legal basis permitting such use (please see the ‘Changes to This Privacy Policy’ section below for more information).

Legal Basis for the Processing of Your Personal Data

Under applicable privacy laws, we are required to identify a valid legal basis for each purpose for which we use your Personal Data. In most cases, our processing will rely on one of the following legal grounds:

• Contractual Necessity – Where the processing of your Personal Data is necessary to fulfil our contractual obligations to you, such as providing access to and functionality on the Platform.
• Compliance with Law – Where we are required to process your Personal Data to comply with a legal or regulatory obligation.
• Consent – Where you have given us explicit consent to process your Personal Data for a specific purpose.

Below, we outline the legal bases on which we rely for processing your Personal Data:

1. Account Creation

• Data Used: Identity Data (name, username), Contact Data (email, phone)
• Purpose: Register and maintain your user account
• Legal Basis: Contractual necessity

2. Account Verification

• Data Used: Identity Data, Contact Data
• Purpose: Verify user identity through optional verification features
• Legal Basis: Contractual necessity

3. Platform Operations

• Data Used: Identity Data, Contact Data, Location Data (if enabled), Listings Data
• Purpose:
  • Enable core platform functionality (e.g., ad posting, user communications)
• Legal Basis: Contractual necessity

4. Analytics & Improvement

• Data Used: Behavioural Data (aggregated usage patterns), Technical Data (device/IP info)
• Purpose:
  • Analyse platform usage trends
  • Optimize user experience through feature enhancements
• Legal Basis: Contractual necessity

5. Marketing Communications

• Data Used: Contact Data, Marketing Preferences
• Purpose: Send promotional offers (only with explicit consent)
• Legal Basis: User consent

6. Platform Security & Fraud Prevention

• Data Used: Identity Data, Contact Data
• Purpose:
  • Detect and prevent fraudulent activities
  • Ensure system integrity
• Legal Basis: Legal compliance

7. Customer Support & Troubleshooting

• Data Used: Technical Data
• Purpose: Resolve technical issues and improve service quality
• Legal Basis: Contractual necessity

5. Data Sharing and Transfers

5.1. Recipients of Data

We require all third parties handling your Personal Data to apply appropriate security measures and comply with our data protection standards. They are only authorized to process your data for specified purposes and in accordance with our instructions, not for their own use.

We may share data with:

• Service Providers: Payment processors, hosting providers, analytics tools (all bound by confidentiality agreements).
• Other Users of the Platform: We need to share some of your Personal Data with other users of the Platform when you wish to transact with them through the Platform. By posting an advertisement or submitting a review or rating on our Platform, the content you provide—along with certain elements of your account profile (such as your username, profile picture)—may become publicly visible to all users of the Platform. This information may also be indexed by third-party search engines (e.g., Google), and could be copied, shared, or redistributed externally. We encourage you to carefully consider the public nature of this information before choosing to submit it via our Platform.
• Professional Advisers: We may grant limited access to your Personal Data to our professional advisors—including lawyers, bankers, auditors, and insurers—when such access is necessary for them to provide legal, financial, insurance, accounting, or consultancy services to us. All such parties are required to maintain the confidentiality and security of your Personal Data in accordance with applicable laws and our contractual agreements.
• Legal Authorities: We may be legally obligated to disclose user data to public authorities in certain circumstances, such as during a police investigation or court orders.
• Acquirer(s): We may disclose your Personal Data to third parties in connection with any actual or potential merger, acquisition, reorganisation, joint venture, sale, transfer, or other disposition of all or part of our business, assets, or shares. This is to enable the relevant acquirer(s) to evaluate or continue operating the Platform. In such cases, we will ensure that any such party handles your Personal Data in a manner consistent with this Privacy Policy.

5.2. International Data Transfers (GDPR Compliance)

In cases where your Personal Data is transferred outside the European Union (EU) or the European Economic Area (EEA), 4Turns will take all necessary steps to ensure that such data is processed in a secure manner and in full compliance with this Privacy Policy and applicable data protection laws.

International data transfers will only be carried out in accordance with the legal requirements of the General Data Protection Regulation (GDPR). These transfers may occur under one of the following conditions:

• The recipient country has been recognized by the European Commission as providing an adequate level of data protection; or
• In the absence of an adequacy decision, we will implement appropriate safeguards—such as Standard Contractual Clauses (SCCs) or other legally recognized mechanisms—to ensure your Personal Data is protected.

You may request further details about the safeguards in place for international transfers by contacting us through the communication channels provided in this Privacy Policy.

6. Data Retention

We retain your Personal Data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required by law (e.g., for regulatory compliance). In certain cases, we delete or may anonymize your data so it can no longer be linked to you, in which case we may retain it indefinitely. Our data retention practices are regularly reviewed to ensure compliance with applicable legal and regulatory requirements.

7. Data Subject Rights

Under the Law, you have the right to:

• Access: You have the right to request a copy of the Personal Data we hold about you and to verify that it is being processed lawfully.
• Rectification: You may request that we correct any incomplete or inaccurate Personal Data that we hold about you.
• Erasure: You have the right to request the deletion or removal of your Personal Data where there is no valid reason for us to continue processing it.
• Objection to Processing: You may object to the processing of your Personal Data for specific purposes, such as direct marketing.
• Data Portability: You may request the transfer of your Personal Data to you or to a third party you designate, in a structured, commonly used, and machine-readable format.
• Withdrawal of Consent: Where we rely on your consent to process your Personal Data, you have the right to withdraw that consent at any time. Please note that withdrawing consent may affect your ability to access certain features of the Platform. We will inform you of any such consequences at the time you make your request.

How to Exercise Your Rights

If you wish to exercise any of the rights outlined above, please contact us using the details provided in the Contact section.

To protect your privacy and maintain security, we may need to request specific information from you to verify your identity and confirm your right to access your Personal Data (or to exercise any of your other rights). This verification process ensures that your Personal Data is not disclosed to any individual who does not have the legal right to access it.

We may also reach out to you for additional information to help clarify or expedite your request.

We aim to respond to all legitimate requests within 10 working days of receipt. In special cases where a request is particularly complex or requires additional verification, this period may be extended by up to 10 additional working days. If this occurs, we will immediately notify you with a justification for the delay.

While the exercise of your rights is generally free of charge, we reserve the right to charge a reasonable fee if a request is clearly unfounded, repetitive, or excessive.

8. Security Measures

We implement appropriate security measures to protect your Personal Data from accidental loss, unauthorized access, alteration, or misuse. Access to your data is strictly limited to employees and personnel with a legitimate business need, all of whom are bound by confidentiality obligations. We have established procedures for managing actual or suspected data breaches, including measures to mitigate potential impacts on your privacy and to cooperate with relevant regulatory authorities where required by law.

9. Cookies and Tracking Technologies

We use cookies to enhance user experience. You may adjust browser settings to refuse cookies, but some platform features may not function properly.

Cookie Consent:

We use a cookie banner to obtain user consent for non-essential cookies (e.g., analytics). You may withdraw consent at any time.

10. Our policy on minors

Minors under the age of 18 are strictly prohibited from accessing or using any platforms, websites, or applications operated by 4Turns. We do not knowingly collect or store personal data from individuals under this age and do not actively monitor the age of our users.

The protection of minors’ personal information is a priority for us. If we become aware—or if you inform us—that a minor has accessed or used the Platform in violation of this restriction, we will take appropriate action to delete their personal data from our systems.

By using the platforms, websites, or applications provided by 4Turns, you confirm that you are at least 18 years of age.

11. Amendments to This Policy

We reserve the right to modify or update this Privacy Policy at any time, with or without prior notice.

When changes are made, we will update this page to display the revised Privacy Policy. In certain circumstances, we may also notify you of significant changes, for example, via email or through a notification on the Platform.

Any updates to this Privacy Policy will become effective immediately upon being posted on this page.

12. Third Party Links

This Platform may contain links to third-party websites or applications. By clicking on these links, you may be directed away from our Platform, and third parties may collect or process your personal data.

Please note that we do not control these external websites or applications and are not responsible for their privacy practices or content. We strongly recommend reviewing the privacy policies of any third-party sites or applications you access.

13. Contact Information

For questions or requests regarding this Policy or your data, contact:

4Turns Web Solutions IE

Email: 4turns@grek.ge

Address: Krtsanisi District, Nino and IIia Nakashidze St. #1, building 3, Apt. 3; Tbilisi, Republic of Georgia

Data Protection Officer (DPO): privacy@grek.ge