Data Processing Register
Last updated: October 5, 2026
Under Article 28 of the Law of Georgia on Personal Data Protection, this register records the personal data processing carried out by Prixio LLC through the Lotify platform.
Data Controller
Prixio LLC
Identification Code: 405842842
Registered address: Georgia, Tbilisi, Vake-Saburtalo District, Avto Varazi Street No. 107, Block 3, Apt. 36
Email: contact@lotify.ge
Phone: +995 550 05 01 88
We have not appointed a personal data protection officer. Privacy contact: contact@lotify.ge
Processing Activities
| Processing Purpose | Data Categories | Legal Basis | Recipients | Retention Period |
|---|---|---|---|---|
| Registration and sign-in | Email, phone number (+995), full name, username, profile photo, hashed password. With Google sign-in: name, email and profile photo from Google. | Performing the contract (Art. 5.1.b) | Supabase (authentication), Google (only for Google sign-in) | While the account is active, plus 30 days after a deletion request, or longer if a live obligation is open |
| Seller verification | ID photos (front and back), selfie, full name, phone, city, address, postal code | Significant legitimate interest in preventing fraud (Art. 5.1.i) | Platform administrators. Files are kept in Supabase private storage. | 1 year from the review of the application, then deleted automatically. Destroyed at once on a deletion request. |
| Running auctions | Listings (title, description, photos, price), bids, questions, ratings, sale records | Performing the contract (Art. 5.1.b) | Other users (public listings, masked bidder names), administrators | As long as the sale record is needed. On erasure, personal details are removed from bids and the account is anonymised. |
| Card holds, capture and cancellation | Order reference, amount, currency, listing ID, bank transaction number and result code, settlement status. Card details are entered on the bank's own page and never reach us. | Performing the contract (Art. 5.1.b) and a statutory duty of the controller (Art. 5.1.d) | JSC Bank of Georgia, which receives the order reference, amount, currency, listing ID and redirect URLs when the order is created, and the seller's IBAN, the seller's share and a description containing the listing ID at capture | As long as tax and accounting law requires and as long as claims about the sale can still be brought. No automatic deletion is set. |
| Seller IBAN and transfer of the seller's share | IBAN, account holder name, own-account statement, name check result, history of changes, and the IBAN recorded on each captured sale | Performing the contract (Art. 5.1.b) and significant legitimate interest in preventing fraud (Art. 5.1.i) | JSC Bank of Georgia (IBAN and amount at capture), administrators | Current IBAN: until changed or erased. History: IBANs and names removed on erasure. IBAN on a captured sale: kept after erasure as long as tax and accounting law requires and claims can still be brought, with no automatic deletion set. |
| Delivery | Delivery address, recipient name, phone number, tracking number | Performing the contract (Art. 5.1.b) | The seller, who needs the address to send the item. Lotify does not pass addresses to any carrier: the seller books the carrier and records the tracking number here. | As long as claims or card disputes about the sale can still be brought. Kept after erasure, with no automatic deletion set. |
| AI listing help | Up to three listing photos, only if the user chooses this feature and gives the recorded consent | Consent, recorded before first use and withdrawable in Settings (Art. 5.1.a) | Google (Gemini). OpenAI as a standby, only where switched on. | We keep no separate copy for this purpose. The photos stay with the listing if you upload them to it. The provider's copy follows its own terms. |
| Fraud prevention and trust system | IP address and browser details on bids, bid flags, trust score and level, non-payment marks, IMEI and serial number data | Significant legitimate interest (Art. 5.1.i) | Administrators. Short-lived rate counters are kept at Upstash. Trust level and score are public on the profile. | As long as needed to prevent repeated fraud or abuse. Kept after erasure, with no automatic deletion set. |
| Push notifications | Subscription address, device identifier, notification preferences | Consent (Art. 5.1.a) | The browser's push service | Until the subscription is revoked or the account is erased |
| Service email | Email address, recipient name and message content, for example an outbid alert, a payment reminder or a dispute update | Performing the contract (Art. 5.1.b) | Resend (email delivery) | Lotify keeps only the notification record. The provider's delivery logs follow its own schedule. |
| Listing view counts | The listing identifier, your account identifier if you are signed in, and a hash of your IP address. The hash uses a secret key and changes every day. The IP address itself is not stored for views. Search queries are not recorded. | Significant legitimate interest (Art. 5.1.i) | Internal use only | 1 year from the view, then deleted automatically |
| Website and API hosting | IP address, browser and device details, requested pages and addresses, and the server logs these requests generate. Page performance measurements that use no cookies. | Significant legitimate interest in operating and securing the service (Art. 5.1.i) | Vercel (website), Railway (application server) | Under each hosting provider's own log schedule |
| Product analytics | Pages viewed, clicks and other interaction events, browser errors, the page address and the page you came from, browser and device details, and a random identifier in a lotify.ge cookie. Session recording is not switched on. Card details never reach the Lotify website. | Consent, given in the cookie banner (Art. 5.1.a) | PostHog (EU Cloud, Frankfurt). Events go to lotify.ge first and are passed on from our own server. | 1 year in our PostHog EU project, then deleted by PostHog |
| Error tracking, only where switched on | Error details, the address without query string, your account identifier, and browser type, content type and language headers. Emails, phone numbers and tokens are removed first. | Significant legitimate interest in operating the service securely (Art. 5.1.i) | Sentry (Functional Software, Inc.) | Under the provider's own schedule |
| Seller status and disclosure to buyers | Status (private person or trader), date stated, and a trader's business name, address and contact email | Performing the contract (Art. 5.1.b) and a statutory duty of the controller (Art. 5.1.d) | Anyone viewing the seller's listings. The status appears on listings, and a trader's details are published to buyers on listings, in the bid confirmation step and at payment, and are sent to the winner by email. Resend (email delivery). | Until changed or erased. Earlier versions are not kept. Removed on erasure. |
| Acceptance, consent and change-notice records | legal_acceptances: account identifier, document, version, decision, time, language and where the decision was made. legal_change_notices: account identifier, notice version and sending record. No name, email address or IP address. | Significant legitimate interest in being able to show what was accepted or refused (Art. 5.1.i) | Supabase (storage), administrators. Each user can read their own decisions. | As long as needed to show what was accepted or refused and that notice was given. Kept after erasure, with no name or contact details, and with no automatic deletion set. |
Status note: product analytics run only for visitors who accept them in the cookie banner. Session recording is not switched on.
Technical & Organizational Measures
- All traffic is encrypted in transit over HTTPS
- PostgreSQL Row Level Security (RLS) restricts data access at database level
- Role-based access control for administrators with principle of least privilege
- Administrative actions taken on user data are recorded in an audit log
- Encrypted daily backups held by our database provider
- Rate limits on sign-in, registration, bid and upload requests, to limit automated abuse
International Transfers
The recipients below are located outside Georgia, or are companies based outside Georgia. Article 37 of the Law of Georgia on Personal Data Protection governs such transfers. The table states the location and what each transfer rests on. For the USA, no State Audit Service permit is in place. Written consent is requested, recorded with its version and time, and can be withdrawn in Settings. Without it, new bids, new listings and acceptance of second-chance offers are unavailable and optional email stops. The table shows which transfers continue whatever the user decides.
| Recipient | Location | What the transfer rests on |
|---|---|---|
| Supabase Inc. | European Union, Frankfurt (AWS). The company is in the USA. | Country list: the list we checked includes EU member states. The provider's data processing terms also apply. |
| Google LLC | USA | Gemini, Google sign-in, and Cloud Vision where switched on. The USA is not on the list we checked, and no permit is in place. Gemini: only with recorded consent to AI listing help, withdrawable in Settings. Sign-in: only if the user chooses it. Cloud Vision: checks uploaded photos whatever the user decides on the consent to transfers. The provider's data processing terms also apply. |
| Upstash Inc. | The company is in the USA, with global locations. Treated as a transfer to the USA. | The USA is not on the list we checked, and no permit is in place. Written consent is requested, but this infrastructure runs whatever the user decides. The provider's data processing terms also apply. |
| Vercel Inc. | USA, with a global network | The USA is not on the list we checked, and no permit is in place. Written consent is requested, but this infrastructure runs whatever the user decides. The provider's data processing terms also apply. |
| Railway Corp. | The company is in the USA. Treated as a transfer to the USA. | The USA is not on the list we checked, and no permit is in place. Written consent is requested, but this infrastructure runs whatever the user decides. The provider's data processing terms also apply. |
| Resend (Plus Five Five, Inc.) | USA | The USA is not on the list we checked, and no permit is in place. Written consent is requested. Without it optional email stops, but email needed for purchases, sales, disputes, account security and legal notices is still sent. The provider's data processing terms also apply. |
| PostHog Inc. (EU Cloud) | European Union, Frankfurt. The company is in the USA. | Country list: the list we checked includes EU member states. The provider's data processing terms also apply. |
| OpenAI, L.L.C. | USA | Only where switched on. The USA is not on the list we checked, and no permit is in place. Only with recorded consent to AI listing help, withdrawable in Settings. The provider's data processing terms also apply. |
| Functional Software, Inc. (Sentry) | Not yet fixed. Treated as a transfer to the USA. | Only where switched on. The USA is not on the list we checked, and no permit is in place. Written consent is requested, but error reports are sent whatever the user decides. The provider's data processing terms also apply. |
| Browser push services | Chosen by the user's browser, mainly the USA | The user turns this on in the browser and can turn it off there. The USA is not on the list we checked, and no permit is in place. |
JSC Bank of Georgia is in Georgia, so data sent to it is not an international transfer.
For detailed information about your data protection rights, please see our Privacy Policy