Privacy policy

Who is responsible

The data controller is AVI Estates, 115 Davit Aghmashenebeli Avenue, Tbilisi, Georgia, info@avi.ge, +995 501 113 200. Questions about personal data go to the same address.

Which law applies

We process personal data under the Law of Georgia on Personal Data Protection (adopted 14 June 2023, in force since 1 March 2024). If you are in the European Union or the European Economic Area, Regulation (EU) 2016/679 (GDPR) also applies to our processing of your data. Where the two differ, we apply the rule that protects you more.

What we collect and why

How the forms work

The forms on avi.ge do not send data to a server of ours. When you press send, your browser opens WhatsApp with the message you typed, and you send it yourself from your WhatsApp account. The message then travels through WhatsApp (Meta Platforms Ireland Limited / Meta Platforms, Inc.) under WhatsApp's own terms and privacy policy. If you prefer not to use WhatsApp, email us instead.

Cookies, local storage and third parties

• No tracking cookies set by us. The site does not set cookies for advertising or profiling.
• Local storage. Your browser keeps a few preferences on your own device only: your chosen language, whether you closed the language suggestion bar, and the boxes you ticked in a checklist. This data never leaves your device and you can clear it in your browser settings.
• Fonts. Pages load fonts from Google Fonts. When they load, your browser sends your IP address to Google. Google's privacy policy applies to that request.
• Maps links. Links to Google Maps open Google's site; nothing is loaded from Google Maps until you click.
• Analytics. At the date of this policy no analytics service is installed. If we add one, this section will name it, say what it collects and, where required, ask for your consent first.
• Hosting. The site is served by a hosting provider that processes server logs (IP address, time, page requested) to deliver the pages and to protect against abuse.

Who receives your data

Inside AVI Estates, only the people who work on your request. Outside, only as needed for the service you asked for and on your instruction: the partner lawyer, a notary, a certified translator, an accredited valuer, the Public Registry, the Public Service Hall, a bank, a property management contractor or an insurer. We do not sell personal data and we do not share it with developers for marketing.

Transfers outside Georgia

Email, WhatsApp, hosting and fonts are provided by companies that may process data outside Georgia, including in the European Union and the United States. Where the Law of Georgia on Personal Data Protection requires it, we rely on the recipient country's adequate level of protection or on contractual safeguards. If you are in the EU/EEA, transfers to Georgia and other countries are made under the GDPR's rules on international transfers.

How long we keep data

• Enquiries that do not become a contract: until the conversation ends and for a reasonable period afterwards, then deleted.
• Client files: for the duration of the contract and afterwards for as long as Georgian law requires for accounting, tax and anti-money-laundering records.
• Newsletter: until you unsubscribe.
• Error reports: until the correction is made and logged; your name stays in the change log only if you agreed.

Your rights

Under the Law of Georgia on Personal Data Protection and, where it applies, the GDPR, you can ask us to:

• tell you what data we hold about you and give you a copy (access);
• correct inaccurate or incomplete data (rectification);
• delete your data where there is no legal reason to keep it (erasure);
• stop or limit processing (restriction and objection), including stopping any marketing at any time;
• receive data you gave us in a machine-readable format (portability);
• withdraw consent, which does not affect processing that happened before.

Write to info@avi.ge. We answer within the time limits set by law and may ask you to confirm your identity first. You also have the right to lodge a complaint with the supervisory authority for personal data protection in Georgia and, if you are in the EU/EEA, with your local data protection authority.

Security

Client documents are stored in access-controlled systems and shared with third parties only through the channels needed for the service. Staff and partners who see client data are bound by confidentiality. No method of transmission over the internet is completely secure; if a breach affects your data, we notify you and the supervisory authority as the law requires.

Children

Our services are for adults. We do not knowingly collect data from children under 18 except as part of a family residence permit application made by a parent or guardian.

Changes to this policy

When we change this policy, the new version is published here with a new "Last checked" date and a line in the change log below. Material changes are announced in the newsletter.

This policy in plain words

The site itself collects almost nothing: no accounts, no tracking cookies, no analytics at the date of this policy, and forms that open WhatsApp on your own device instead of sending anything to us. The agency, when you become a client, collects what a property purchase in Georgia needs: your identity documents, your bank details, the documents about the property, and the powers of attorney if you buy remotely, because a notary, a bank and the Public Registry will ask for them. We use that information for your purchase and for the legal duties that come with it, we share it only with the people who have to see it to do their part, and we keep it only as long as the law requires. You can ask what we hold, have it corrected or deleted, and complain to the supervisory authority if you think we got it wrong. The sections above are the precise version; this one is the summary a reader should be able to rely on.

Data in a typical purchase, step by step

1. First contact

   Your name, a contact detail, your language and what you wrote. Used to reply and to prepare a consultation. Kept in the chat or mailbox for as long as the enquiry is open.

2. Brief and quote

   Your purpose, budget, timing, citizenship and country of residence, because the service depends on them. Written into the brief and the quote, which you receive and approve.

3. Legal check

   The property's documents, which are about the seller and the property rather than about you, and your instruction to order the extract. The partner lawyer receives them to do the check.

4. Purchase and registration

   Your passport data, address and, if you buy remotely, the power of attorney; your bank details for the transfer. Shared with the notary, the bank and the Public Registry because each of them requires them by law to do their part.

5. Residence permit

   Your passport and family documents, the registry extract, the appraiser's report and photographs, assembled into the file submitted to the Public Service Hall on your instruction.

6. After the keys

   For rental management, the lease, the tenant's details and the statements; for tax, the documents the accountant needs for your declaration. Kept for the duration of the service and for the statutory record-keeping period afterwards.

At each step you see the document before it goes anywhere, and the recipient is one you asked us to deal with. Nothing in this sequence is used for marketing, and nothing is passed to a developer or another agent.

What we never do with your data

• Sell it, rent it or trade it with anyone, for any purpose.
• Give your contact details to a developer, a seller or another agency, including when you decide not to buy a property they offered.
• Add you to the newsletter because you wrote to us or became a client; the newsletter has its own consent.
• Use what you told us as a client to send you sales messages after the service ends.
• Keep your documents longer than the service and the statutory record-keeping period require.
• Publish anything about your purchase, with or without your name, unless you asked us to in writing.
• Build a profile of your browsing on this site; there is no mechanism on the site to do so.

How to exercise your rights, in practice

Write to the email address above, in any of the five languages, saying which right you are using: access, correction, deletion, restriction, objection, portability or withdrawal of consent. We may ask you to confirm your identity, because we must not hand a client's file to someone who is not the client; a reply from the email address or WhatsApp number we already have for you is usually enough, and for a full copy of a client file we may ask for more. You then receive either what you asked for, or an explanation of why part of it cannot be done, for example because Georgian accounting or anti-money-laundering law requires us to keep a record for a set period even after you ask for deletion. There is no charge for a first request. If you are not satisfied with the answer, the section on your rights names the supervisory authorities you can turn to, and we would prefer to hear from you first so that we can put it right.

WhatsApp, email and what we can and cannot control

Most of our conversations with clients happen on WhatsApp because it works across the countries our clients live in. WhatsApp is run by Meta, and messages pass through its systems under its own terms, which we do not control; what we control is what we send and keep. We do not use WhatsApp's business tools to profile contacts, we do not share chat contents with anyone outside the team except as the service requires, and we delete the chat when you ask us to after an enquiry that did not become a contract. Email passes through the mail provider's systems in the same way. If you would rather not use either for sensitive documents, say so, and we agree a different way to exchange them, such as a shared folder with access limited to you and your contact person.

If you only read the site

A reader who never writes to us leaves almost no trace. The hosting provider's server logs record the request, which includes an IP address, for the time needed to deliver pages and to protect the site against abuse; we do not combine those logs with anything else and we do not use them to identify readers. Google receives a font request with your IP address when a page loads, which you can prevent with a content blocker as the cookie policy explains. The on-site search runs in your browser against a file downloaded from the site; your search terms are not sent to us. The tools run in your browser; your inputs are not sent to us. The preferences stored in your browser are listed in the cookie policy and never leave your device.

Terms used in this policy

Personal data	Any information about an identified or identifiable person: a name, a passport number, a phone number, an email address, an IP address.
Processing	Anything done with personal data: collecting, storing, reading, sharing, deleting.
Controller	The organisation that decides why and how personal data is processed. For this site and the agency's services, AVI Estates.
Processor	A company that processes data on the controller's behalf and instructions, such as a hosting provider.
Legal basis	The reason the law allows a particular processing: your consent, a contract with you, a legal obligation, or a legitimate interest that does not override your rights.
Supervisory authority	The public body that oversees data protection and hears complaints; in Georgia, the body named in the section on your rights once the lawyer has confirmed it.

Change log

• 11 October 2026 - Draft published for lawyer review.