Version of 12 November 2026. Effective: on the day the cenaly.ge service opens for sign-up and data intake; until then the Service on cenaly.ge does not accept businesses' personal data.
This Data Processing Agreement (the "Agreement") is concluded between the business that has registered an account on cenaly.ge (the "Business", the controller) and Individual Entrepreneur ANDREI VERBITSKII (Identification Number 305573448, Georgia) ("We", the processor) pursuant to Article 36 of the Law of Georgia "On Personal Data Protection" of 14 June 2023, No. 3144 (the "Law"). The Agreement forms part of the Terms of Service and is accepted together with them when a cenaly.ge account is registered; in case of conflict with the Terms on matters of personal data processing, this Agreement prevails. Terms have the meaning given to them by the Law.
1.1. The Business instructs us to process the personal data that it or its users enter, upload or receive through the Service ("Business Data") to the extent necessary to provide the Service. The Business is the controller; we are the processor.
1.2. The bases and purposes of processing, the categories of data and data subjects, and the duration of processing are set out in Annex 1 (Article 36(1) of the Law).
1.3. The Business is responsible for having a legal basis for processing Business Data (Articles 5–6 of the Law), for informing data subjects (Articles 24–25 of the Law), for warning about call recording (Article 11 of the Law) and for the lawfulness of transferring the data to us.
2.1. We process Business Data only on the written instructions of the Business (Article 36(2)(a) of the Law). Instructions are this Agreement, the Terms of Service, the settings and actions of the Business and its users in the Service, and written instructions sent to info@meni.ge.
2.2. We do not process Business Data for other purposes, including our own advertising or training AI models (Article 36(4) of the Law).
2.3. If, in our opinion, an instruction infringes the Law, we will inform the Business and may refrain from executing it until it is clarified.
3.1. The persons on our side directly involved in processing are bound by a duty of confidentiality (Article 36(2)(b) of the Law).
3.2. We apply the organisational and technical security measures described in Annex 3 (Articles 27, 36(2)(c) and 36(5) of the Law).
4.1. By accepting this Agreement, the Business gives its prior written consent (Article 36(7) of the Law) to the engagement of the processors listed in Annex 2.
4.2. We notify the Business of an intended addition or replacement of a processor at least 30 days in advance — by e-mail to the account owner or in the interface. The Business may object in writing within that period; if we cannot accommodate the objection, the Business may terminate the contract and receive a refund of prepaid fees for the unused period.
4.3. We conclude with each processor a written agreement imposing obligations no less protective than this Agreement. Engaging a processor does not release us from our obligations and liability.
4.4. Apart from AI providers (clause 5.3) and push notification services (clause 5.4), we engage only processors that process Business Data in Germany or in another country on the list of countries with appropriate safeguards (Order No. 007 of the Auditor General of the State Audit Office of 14 April 2026).
5.1. Business Data is stored and processed in the AWS eu-central-1 region (Frankfurt, Germany). Germany is on the list of countries with appropriate safeguards; the transfer is based on Article 37(1) of the Law.
5.2. Except as provided in clauses 5.3 and 5.4, we do not transfer Business Data to the United States or to other countries outside the list. Should another such transfer become necessary, we will not start it without the written consent of the Business and a basis under Article 37 of the Law (including a permission of the State Audit Office where required).
5.3. AI features. Business Data is transferred to AI providers outside the list (Annex 2, Part B) only for the AI features the Business has enabled, to the minimum extent, and only after written consent under Article 37(2)(d) of the Law given in the Service using the text "Consent to the transfer of data for AI processing" (cenaly.ge/legal/ai-consent): by the owner or administrator — for the account, by a staff member — for their own data, by a guest — for their own messages to the AI assistant. Enabling an AI feature after such consent is an instruction of the Business under clause 2.1. If a feature processes data of other people (the other party's voice, customer details in documents), the Business ensures the basis for transferring it, including their written consent where required; without it the Business does not use the feature for such data. Withdrawal of consent switches off the relevant features, and no new data is transferred to providers outside the list.
5.4. Push notifications. Notifications about events (calls, orders, bookings, tasks, messages) to the apps and browsers of the Business's users, and browser notifications to visitors of the Business's website, can only be delivered through the notification service of the device or browser maker (Annex 2, Part C), located outside the list. Data is transferred to such a service only to the minimum extent (the push address of the device, the event type, technical identifiers and, for a visible notification, a short title and text) and only after written consent under Article 37(2)(d) of the Law given using the text "Consent to the delivery of push notifications" (cenaly.ge/legal/push-consent) by the person on whose device or browser notifications are enabled. We compose notification texts without personal data of the Business's customers, guests and callers wherever the event allows it. For browser notifications to visitors of its website the Business, as controller, is responsible for the subscription window and its text; the Service provides the text. Switching notifications off on a device or in a browser withdraws the consent for it.
5.5. If the Business itself connects an external service in the Service (a telecom operator, messenger, payment service, integration), data is transferred to that service on the instructions of the Business, and the Business ensures the lawfulness of that transfer.
6.1. When this Agreement ends or the account is closed, we, at the Business's choice, return Business Data in a machine-readable format or delete it, including copies, unless storage is required by Georgian legislation (Articles 36(2)(d) and 36(9) of the Law). If the Business has not made a choice within 30 days of closing the account, Business Data is deleted; it disappears from backups at the end of their rotation cycle.
6.2. If a dispute related to data processing arises between us and the Business, we immediately stop processing the relevant Business Data and hand over to the Business the data in our possession, unless Georgian legislation provides otherwise (Article 36(8) of the Law).
7.1. We help the Business, through the tools available in the Service (search, export, correction, deletion, blocking of records) and on request, to fulfil its obligations regarding data subject requests (Article 36(10) of the Law). A data subject request received by us directly is forwarded to the Business without delay if it concerns Business Data.
7.2. We provide the Business with the information necessary to demonstrate compliance with the Law and support its monitoring of the processing (Articles 36(2)(e) and 36(6) of the Law), including answering reasonable written questions and providing information about security measures. An on-site audit is possible by agreement, no more than once a year, unless required by a request of the State Audit Office.
7.3. On request, we provide the Business with the information needed for a data protection impact assessment (Article 31 of the Law).
8.1. When we become aware of an incident affecting Business Data, we notify the Business without delay (Article 29(2) of the Law) and share what is known: circumstances and time, likely categories and volume of affected data, likely consequences, measures taken and proposed, and a contact person.
8.2. Notifying the State Audit Office and data subjects of an incident affecting Business Data is the obligation of the Business as controller (Articles 29–30 of the Law); we assist it.
9.1. This Agreement remains in force while the Business has a cenaly.ge account and thereafter, as regards the obligations under section 6, until they are fulfilled.
9.2. This Agreement is governed by the law of Georgia.
9.3. We notify the Business of changes to this Agreement in advance; changes that extend the processing or change the country of processing require at least 30 days' notice with the Business's right to object and terminate the contract.
| Item | Content |
|---|---|
| Data subjects | Customers, guests and visitors of the Business; staff and other users of the Business's account; counterparties and their representatives; participants of the Business's calls and correspondence |
| Categories of data | Identification and contact data; orders, bookings and appointments; preferences and notes (including allergens, if the Business keeps them); HR and payroll data to the extent kept by the Business; call logs, call recordings, transcripts (if enabled); correspondence and documents; technical identifiers. Special categories — only if kept by the Business and it has ensured a basis under Article 6 of the Law |
| Purposes | Providing the Service: storing and displaying data, performing the features chosen by the Business (orders, bookings, CRM, HR, telephony, knowledge base, AI features), notifications (including push notifications under clause 5.4), support, security and backups |
| Basis | The Business's instruction under this Agreement; the basis for processing vis-à-vis the data subject is ensured by the Business |
| Duration | The lifetime of the account and the time needed to fulfil section 6 |
Part A. Processors in Germany and listed countries
| Processor | Function | Place of processing |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, storage, databases, computing, the API and WebSockets, authentication (Amazon Cognito), e-mail sending (Amazon SES), backups, logs | Germany, eu-central-1 (Frankfurt) |
| Amazon Web Services — Amazon Transcribe, Amazon Bedrock | Transcription and language models, where used | Germany, eu-central-1 (Frankfurt) |
| Amazon CloudFront | Delivery of pages and public files | The delivery network location nearest to the user |
Part B. AI providers outside the list — only under clause 5.3 (consent under Article 37(2)(d) of the Law)
| Provider | Function | Country |
|---|---|---|
| OpenAI, L.L.C. | Speech recognition, call assistant, summaries and suggestions, knowledge base, voice commands | United States |
| Google LLC | Guest AI assistant; speech recognition, if this engine is selected | United States |
| Microsoft Corporation (Azure AI Speech) | Speech recognition, if this engine is selected | United States or another country of the service region |
| polza.ai | Gateway routing the request to the model, if used | Russia |
Part C. Push notification services outside the list — only under clause 5.4 (consent under Article 37(2)(d) of the Law)
| Service | Function | Country |
|---|---|---|
| Apple Inc. (Apple Push Notification service) | Delivery of notifications to apps on iPhone, iPad and Mac and in Safari | United States |
| Google LLC (Firebase Cloud Messaging) | Delivery of notifications to Android apps with Google services and in Chrome-based browsers | United States |
| Microsoft Corporation (Windows Push Notification Services) | Delivery of notifications to Windows apps and in Microsoft Edge | United States |
| Mozilla Corporation (Mozilla push service) | Delivery of browser notifications in Firefox | United States |
| Huawei (Push Kit); VK (RuStore push) | Delivery to Android apps installed from those stores on devices without Google services | The provider's service region, including China or Russia |