Privacy Policy

Who is responsible for your data

The controller of your personal data is DALEA, Tbilisi, Georgia. For any question about this policy or about your data, write to atelier@dalea.ge.

In this policy, we and DALEA mean DALEA. You means anyone who visits daleaofficial.com, registers for a drop, accepts an invitation, or buys a piece from us.

What we collect

We collect only what the Allocation and a purchase require. Nothing is gathered for its own sake.

• Registration details you give us on the waitlist form: first and last name, email address, phone number (optional), your preferred colour, and an optional message.
• Purchase details, once you have accepted an invitation: delivery address, the payment method you chose, confirmation that payment was received, and the serial number of your piece. We do not store card numbers. Card payments are processed by our payment provider through a secure link, and the card data never reaches our systems.
• Correspondence: the emails, messages and notes of calls exchanged when you contact us or we contact you, including guarantee claims and care appointments.
• Technical data: IP address, device and browser type, approximate location derived from the IP address, and the pages you visit. We collect this only if you consent to analytics cookies. If you choose Only necessary, we do not track your visit; our hosting provider keeps short-lived security logs, which include IP addresses, as every website's host does.

Why we use it

Each piece of data has a job. These are the jobs.

• To run the draw and assign pieces among the registrations received before closure.
• To contact invited clients by phone and email, and to record whether the invitation was confirmed within 48 hours.
• To deliver purchases: to arrange hand-delivery in Tbilisi, courier collection elsewhere in Georgia, or DHL shipment abroad, and to issue the certificate that matches your piece.
• To answer your requests, repair enquiries and guarantee claims, and to keep a record of work done on your piece.
• To send you updates about the drops you registered for and news of future drops. Joining the list is your consent to these updates; every email carries an unsubscribe link and you may withdraw at any time.
• To meet our legal and accounting duties, including tax records, invoicing and obligations under consumer law.
• To detect and remove duplicate or fraudulent registrations so that the draw stays fair.

We do not profile you, we do not make automated decisions about you, and we never sell your data.

Legal bases

Every use of your data rests on one of four legal grounds.

How long we keep it

We keep data for as long as it has a purpose, and no longer.

• Waitlist data: until you ask us to remove it, or 24 months after the last drop you registered for, whichever comes first.
• Purchase records: for as long as tax and accounting law requires. The certificate number and serial of each piece are kept for the life of the guarantee so that we can verify authenticity and honour claims.
• Analytics data: 14 months from collection.
• Correspondence: for as long as the request it relates to remains open, and then under the retention period that applies to the registration or purchase it concerns.

Who we share it with

We share data only with the providers we need to run the site and deliver your piece, and each one receives only what its task requires.

• Hosting: Vercel (United States), which serves the site.
• Database: Supabase, which stores registrations and order records.
• Email delivery: the provider that sends our invitations, confirmations and announcements.
• Couriers: our courier partner within Georgia, and DHL for international parcels. They receive your name, delivery address and phone number.
• Payment provider: the service that processes card payments through a secure link. It receives what is needed to complete and record the transaction.
• Professional advisers and authorities: our accountant, and public bodies where the law requires disclosure.
• Transfers abroad: Vercel and Resend (our email delivery provider, which also carries the internal note of each registration) process data in the United States; Supabase holds the database in a European Union region. Each is bound by a data transfer agreement with appropriate safeguards, as the Law of Georgia on Personal Data Protection requires, and none may use the data for its own purposes.

Some of these providers operate outside Georgia and outside the EU or EEA. Where they do, they are bound by contracts requiring your data to be protected to a standard equivalent to the law described in this policy. We do not sell data. We do not pass it to advertisers, except through the cookies you have consented to, which are described in the Cookie Policy.

Your rights

You hold the following rights under the Law of Georgia on Personal Data Protection. If you are in the EU or EEA, you hold them under the General Data Protection Regulation as well.

• Access: to learn what data we hold about you and receive a copy of it.
• Rectification: to have inaccurate or incomplete data corrected.
• Erasure: to have your data deleted, unless a legal duty requires us to keep it.
• Restriction: to ask us to pause processing while a question about the data is resolved.
• Objection: to object to processing that rests on legitimate interest.
• Withdrawal of consent: to stop announcements or analytics at any time, without affecting earlier processing.
• Portability: to receive the data you gave us in a common machine-readable format.

To exercise any of these rights, write to atelier@dalea.ge. We may ask you to confirm your identity. We reply within 10 working days, as the Law of Georgia on Personal Data Protection requires; in exceptional cases we may extend this once by up to 10 working days and will tell you why. If you are in the EU or EEA we reply in any case within one month. Exercising your rights is free. If you believe we have handled your data unlawfully, you may complain to the Personal Data Protection Service of Georgia at pdps.ge, to the supervisory authority in your country of residence if you are in the EU or EEA, or to a court.

Security

The site is served over HTTPS, so what you type on the registration form is encrypted in transit. Registrations and orders are stored in a database with access limited to the DALEA team, and each team member sees only what their role requires. Payment card details never pass through our systems. If a breach ever affected your data, we would tell you and the authorities as the law requires.

Children

The site and the Allocation are not aimed at anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has registered, write to atelier@dalea.ge and we will remove the entry.

Changes to this policy

We may update this policy as the site, our providers or the law change. The date at the top shows the version in force. If a change materially affects how we use your data, we will tell registered clients by email before it takes effect.

Contact

DALEA, Tbilisi, Georgia. Email atelier@dalea.ge.