1. Identity of the Data Controller
This Privacy Policy explains how ProximaEOR LLC (ID: 400423341) (“we”, “us”, or “our”) collects, processes, and protects personal data in connection with our website and professional services.
As a registered Georgian legal entity, we process personal data in strict accordance with the Law of Georgia on Personal Data Protection. Where we provide services to clients based in the European Economic Area (EEA), we also align our processing standards with the General Data Protection Regulation (GDPR) where applicable. Depending on the service structure (such as acting as your Employer of Record), we may act as a Data Controller, Joint Controller, or Data Processor.
2. Categories of Personal Data Collected
We distinguish between data collected from general website visitors and the data required to execute our professional services:
A. Website & Inquiry Data
When you contact us via our website to request a consultation or quote, we collect your name, business email address, phone number, company name, and the contents of your inquiry. We may also automatically collect technical data (e.g., IP address, browser type) strictly necessary to maintain website security and functionality.
B. EOR & Payroll Data
To legally employ staff under the Employer of Record model or process local payroll, we are mandated by Georgian law to collect comprehensive data. This includes government-issued identification (passports/ID cards), personal tax identification numbers, residential addresses, bank account details (IBANs), salary figures, and records of statutory leaves.
C. Company Registration Data
To facilitate remote company formations or Individual Entrepreneur setups, we process passport copies, Powers of Attorney, proof of address, and corporate shareholder information required by the National Agency of Public Registry (NAPR) and local financial institutions for KYC/AML purposes.
3. Processing Purposes and Legal Bases
Under the Law of Georgia on Personal Data Protection, we process your personal data relying on the following legal bases:
- Pre-contractual Steps & Performance of a Contract: Processing inquiry data to respond to your requests, draft service agreements, execute employment contracts, and process payroll disbursements.
- Legal Obligation: Fulfilling mandatory statutory requirements, such as remitting the 20% personal income tax and 2% pension contributions to the Revenue Service of Georgia, and submitting corporate data to the public registry.
- Legitimate Interests: Managing our business operations, protecting our IT infrastructure from fraud, and enforcing our legal rights, provided these interests are not overridden by your data protection rights.
- Consent: Used only when explicitly requested (e.g., subscribing to a marketing newsletter). Note that we do not rely on consent to process standard B2B inquiries, relying instead on pre-contractual necessity.
4. Data Recipients and Service Providers
We do not sell your personal data. We disclose data only to the extent necessary to deliver our services, to the following categories of recipients:
- Government Authorities: The Revenue Service of Georgia (RS.ge), the National Agency of Public Registry (NAPR), and the State Employment Agency, strictly for mandated tax, corporate, and labor migration compliance.
- Professional Partners: Our authorized legal counsel (Proxima Legal and Tbilisi Law), accounting partners, and local Georgian commercial banks who assist in service delivery under strict confidentiality agreements.
- Technical Processors: Secure cloud hosting, email service providers, and document signature platforms utilized to operate our business infrastructure.
5. International Data Transfers
As a provider of international corporate services, your data may be transferred to and processed in Georgia, the European Union, or other jurisdictions where our cloud infrastructure providers maintain servers. When transferring personal data outside of Georgia or the EEA, we ensure appropriate safeguards are implemented in accordance with Georgian law and applicable international standards, such as executing standard contractual clauses with our technical processors.
6. Data Retention Criteria
We retain personal data only for as long as is necessary to fulfill the purposes outlined in this policy and to adhere to objective statutory requirements:
- Tax & Payroll Records: Retained for a minimum of 6 years as mandated by the Tax Code of Georgia to satisfy potential audits.
- Employment Contracts: Retained for the duration of the employment relationship plus 3 years following termination, in accordance with labor dispute statute of limitations.
- General Inquiries: Website inquiry data that does not result in a formal commercial engagement is routinely purged after 3 years.
7. Data Subject Rights
Under the Law of Georgia on Personal Data Protection, you possess the following rights regarding your personal data:
- Access: The right to request a copy of the personal data we hold about you.
- Rectification: The right to request correction of inaccurate or incomplete data.
- Erasure: The right to request deletion of your data, provided we are not legally obligated to retain it (e.g., for tax reporting).
- Restriction & Objection: The right to limit or object to our processing of your data based on legitimate interests.
- Data Portability: The right to receive your data in a structured, machine-readable format.
To exercise these rights, please contact us using the details in Section 10. If you believe our processing violates applicable law, you also have the right to lodge a formal complaint with the Personal Data Protection Service of Georgia (personaldata.ge).
8. Cookies and Analytics
Our website is built on a minimalist technical architecture. We currently utilize only strictly essential technical cookies required for the site to function (e.g., maintaining routing states and protecting against CSRF attacks). We do not deploy third-party advertising trackers, invasive analytics scripts, or cross-site commercial cookies.
9. Security Measures
We implement robust technical and organizational security measures, including HTTPS encryption, restricted access controls, and secure cloud storage, designed to protect your personal data against unauthorized access, accidental loss, or unlawful processing. However, no internet-based transmission is completely secure, and we cannot unconditionally guarantee the absolute security of data transmitted to our public endpoints.
10. Contact Information
If you have any questions regarding this Privacy Policy or wish to exercise your data subject rights, please direct your correspondence to our administrative team:
