LLC “Pharmax” (ID 204975090)

Privacy Policy

LLC “Pharmax” (hereinafter – the “Holding”)
Phone number: (+995) 599 987 686
Address: Georgia, Tbilisi, L. Charkviani N8
E-mail: imardaleishvili@mmc.ge

Data Protection Officer: LLC “G E M Corp” (ID 404728041)
Officer’s contact details:
Phone – (+995) 593 45 30 30
E-mail – tamuna.tkeshelashvili@geosafety.ge

Please contact us immediately if you believe your rights are being violated, or if you have any questions and/or need consultation regarding the processing of your personal data.

You may contact us via the hotline or the email listed above.
Additionally, regarding personal data processing matters, you may contact the Data Protection Officer via the email listed above.

Purpose of This Policy

Your trust and the protection of your personal data are important to us.
We want to clearly explain what information we collect, why we collect it, and how we use it.

This privacy policy applies to the processing of personal data by LLC “Pharmax,” carried out within the legal and financial operations of the Holding.

Our goal is transparent and understandable communication for all data subjects.

How We Obtain Your Data

Personal data may be obtained through:

  • Information provided by the data subject when signing an employment or civil contract

  • Information provided by job candidates during the recruitment process

  • Contact and identification details provided by service providers and partner organizations

  • Data obtained from state-managed registries or other legally permitted sources

  • Employment online platforms

  • Any legally permitted sources when required by law

What Personal Data We Process

Identification Data:

  • Name, surname, personal ID number, date of birth, gender

Contact Information:

  • Legal and actual address, phone/mobile number, email

Other processed data include:

  • Employment process and HR administration

  • Contract signing, financial operations, accounting

  • Compliance with legal obligations

  • Internal communication and administration

  • Data and information system security

  • Any information required for service provision or defined by regulatory acts

  • Any other information identifying the data subject

Purposes of Data Processing

Personal data is processed for the following purposes:

  • Fulfillment of obligations under contracts with counterparties

  • Compliance with legal obligations

  • Legitimate interests of the Holding (e.g., security, financial reporting)

  • Archiving and administration of documentation

  • Responding to claims or legal complaints

  • Smooth operation of work processes

  • Recruitment of qualified job applicants

  • Document management and control

  • Protection of property and physical safety of employees

  • Providing information required by supervising authorities

  • Preparing contracts and transferring them to legal/financial departments

  • Any other duty required by law

Legal Grounds for Data Processing

Personal data is processed based on:

  • Consent of the data subject for one or more specific purposes

  • Necessity to fulfill contractual obligations or to execute a contract at the data subject’s request

  • Legal obligations under Georgian legislation

  • Legal basis defined by law

  • Publicly available data or data made publicly available by the subject

  • Protection of vital interests of the data subject or another person

  • Protection of legitimate interests of the controller or a third party (unless overridden by data subject’s rights)

Special category (sensitive) data is processed based on:

  • Written consent of the data subject

  • Direct regulation by Georgian law

  • Necessity within employment relationships

  • Public interest

Who We Share Data With

With a valid legal basis, data may be shared with:

  • Law enforcement agencies

  • Courts

  • Personal Data Protection Service

  • Other legally authorized bodies

Additionally, data may be shared with:

  • Contractors or service providers as required for service delivery or legal compliance

  • Authorized data processors, within contract-defined access

  • Banks and tax authorities

Data Retention Period

We store personal data only for the time necessary to achieve the purposes listed above and to fulfill legal obligations.

Retention is determined according to:

  • Order N72 of the Minister of Justice of Georgia: “List of Typical Administrative Documents Created Within Institutions (with retention periods)”

Authorized Data Processors

  • The Holding employs authorized processors who handle data only for Holding’s purposes

  • Contracts with processors include detailed data protection obligations

  • The Holding monitors compliance and security measures

  • Information about processors is provided upon request

  • Processors are not data controllers; they act only according to Holding’s instructions

  • They are responsible only for the security of data they process and only for the relevant period

Your Rights

According to Chapter III of the Law of Georgia “On Personal Data Protection,” data subjects have the right to:

  • Receive information about the processing of their personal data

  • Receive information about processors and co-processors

  • Obtain information on purposes, legal grounds, and data categories

  • Obtain information on recipients to whom data has been or will be shared

  • Obtain information on data retention period or criteria

  • Receive information about data sources (if data was not collected directly)

  • Request access and copies of personal data

  • Request correction, update, transfer, or completion of inaccurate or incomplete data

  • Request termination, deletion, or destruction of data by withdrawing consent

  • Request temporary data blocking if:

    • accuracy is disputed

    • processing is unlawful but deletion is not desired

    • data is no longer needed, but required for claim/complaint

    • deletion is requested and review is ongoing

    • data is needed as evidence

  • Use the right to appeal to the Personal Data Protection Service or court in case of violation

Requests must be submitted to the data controller or authorized processor if the data is stored with them.

The Holding must respond within 10 business days, extendable by an additional 10 days with justification.

The data subject may withdraw consent at any time without explanation. If processing has no other legal basis, data is deleted within 7 business days.

Rights may be restricted only in cases defined by Georgian law.

If fulfilling a request requires actions performed by other government bodies (Revenue Service, Audit Service, Emergency Management Service, etc.), the Holding may provide written explanation to the subject.

Changes

This policy may be updated periodically.
The updated version enters into force upon publication.