The Privacy Policy (hereinafter referred to as the "Policy") published on the official website of the Personal Data Protection Service (www.pdps.ge) describes the processing of users' personal data via the Service's website.

The terms used in this Policy have the meanings defined by the Law of Georgia "On Personal Data Protection" and other normative acts.

1. Purposes and Grounds for Data Processing

The Personal Data Protection Service is an independent state authority established and operating under the Law of Georgia "On Personal Data Protection" (hereinafter referred to as the "Law"). In its activities, the Service is guided by the Constitution of Georgia, international treaties, universally recognized principles and norms of international law, the Law, and other relevant legal acts.

According to Article 49 of the Law, the Service oversees the legality of personal data processing in Georgia. The primary directions of its activities include:

• Providing consultations on data protection issues;

• Reviewing applications/complaints related to data protection;

• Inspecting the legality of data processing;

• Informing the public and raising awareness about the state of data protection in Georgia.

Pursuant to Article 53, Paragraph 2 of the Law, the Service also conducts educational activities on data processing and protection issues.

The Service processes user data via the website for the following purposes:

1. Legality Control: To receive applications/notifications related to personal data protection.

2. Educational Activities: To manage registrations for data protection training sessions.

3. Fulfillment of Obligations: To publish information regarding the appointed Data Protection Officer (DPO) by the data controller and data processor (pursuant to Article 33, Paragraph 8 of the Law).

4. Incident Response: To receive incident notifications via the integrated electronic incident reporting management system.

> Note: Data received through the website may also be processed by the Service for statistical and/or analytical purposes.

2. Data Processed via the Website

The data processed through the website is provided directly by the users. The following data is collected:

• During application/notification submission: User's name, surname, phone number, email address, as well as data specified in the submission and attached documents. All fields in the application form are mandatory. To protect anonymity, only the content field is mandatory in the notification form.

• During training registration: User's name, surname, phone number, email address, and sector (private or public). All specified fields are mandatory.

• During DPO information publication: Name, surname, phone number, and email address of the Data Protection Officer appointed by the data controller or processor.

• During incident notification: Name, surname, position/title, and contact details of the person filling out the form; name, surname, and contact details of the DPO (if applicable); name, surname, position/title, and contact details of any other contact person (if applicable).

3. Sharing of User Data

• For investigating applications/notifications: To comprehensively study circumstances, assess the legality of data processing, and issue corresponding mandatory tasks or recommendations, the Service may share the user's data (including provided information and documentation) with the public/private organization or individual against whom the complaint was filed. Furthermore, within the scope of the investigation, the Service may request information about the user from third parties if necessary.

• For training administration: Data collected during training registration is processed to identify attendees and communicate with them. This data may be used before and after the training to share materials, conduct quality surveys, organize knowledge-assessment activities, issue certificates, and provide information about future educational activities planned by the Service.