Legal
Privacy Policy
How Ulupa collects, uses and protects your personal data.
1General provisions
This Privacy Policy explains how LLC “Ulupa” (ID: 406561135) (the website / web application at www.ulupa.ge, hereinafter “Ulupa”, “we” or the “Platform”) collects, uses, stores and protects the personal data of users of the website and mobile applications.
We process personal data in accordance with the Law of Georgia “On Personal Data Protection” and, where applicable, the principles of the EU General Data Protection Regulation (GDPR).
Please note that by accessing the website / web application you agree to this Privacy Policy. If you do not agree with this Policy, please do not continue using the Platform; otherwise you are deemed to have read and accepted the Policy published on the Platform.
2Who we are (data controller)
The data controller is LLC “Ulupa” (ID: 406561135) — the operator of the ulupa.ge platform, located in Tbilisi, Georgia.
For any questions regarding the processing of your personal data, contact us at support@ulupa.ge.
3What data we collect
We collect only the data necessary to provide the service. Depending on how you use the Platform, this may include:
- Account data: first and last name, email, phone number, profile photo, role (customer or cook).
- Order and delivery data: delivery address, entrance, floor, apartment, district, geolocation coordinates, order comments and history.
- Cook data: information provided during verification — kitchen photos, verification documents, bio, specialization, address and bank settlement details.
- Payment data: processed by our partner (Bank of Georgia). We do not store full card numbers or card data on our servers.
- Technical data: IP address, device and browser information, cookies and analytics data.
4Purposes of processing
We process your personal data in order to:
- create and manage your account and give you access to the Platform;
- process, prepare and deliver orders and connect customers with cooks;
- process payments and, where necessary, carry out the refund process;
- verify cooks and maintain food-safety and quality standards;
- provide customer support and process and respond to your requests;
- send you service notifications (push notifications) about your orders and account;
- analyze and improve the Platform and ensure its security;
- comply with our legal obligations.
5Verification and consents
- Phone-number verification (SMS code) is mandatory at registration. Email verification is optional.
- Consents are requested via separate checkboxes: (a) for this Policy and the Agreement, (b) for marketing. The marketing checkbox is not pre-ticked.
- You may withdraw your consent to marketing communications at any time (in your profile or via the link in the email). After withdrawal, processing for marketing purposes stops within 7 (seven) business days.
6Legal basis for processing
We process personal data on the following grounds provided by the Law of Georgia “On Personal Data Protection”:
- the user’s consent – when you voluntarily provide information, for example at registration or when subscribing to news;
- performance of the contract concluded between you and the Platform;
- compliance with a legal obligation – where processing is necessary to fulfil our obligations under the law (for example, tax or regulatory requirements);
- our legitimate interests – where processing is necessary to improve our services, ensure technical security and prevent fraud, provided that your rights and freedoms are not infringed.
You may withdraw consent at any time; this does not affect the lawfulness of processing carried out before the withdrawal.
7Whom we share data with
To achieve the purposes above, “Ulupa” may transfer your information to its affiliates, to agents of it or its affiliates, and/or to third-party service providers acting for “Ulupa”. Our affiliates, agents and third-party service providers who have access to your personal data obtained through the “Ulupa” website / web application are obliged to maintain confidentiality in accordance with the applicable legislation of Georgia.
We do not sell your personal data. We share it only with the parties necessary for the continuous provision of the service:
- cooks — receive the customer’s name and delivery details needed to prepare and deliver the order;
- payment provider — Bank of Georgia — to process payment and refund information;
- Supabase — database, authentication, storage;
- UBILL, Brevo, Resend — SMS notifications, marketing messages, transactional email;
- delivery (courier) partners — Glovo, Wolt, Yandex and similar couriers — to deliver orders;
- Google Maps — to geocode addresses and calculate delivery distance;
- infrastructure and analytics providers — Supabase, Railway, Vercel and Sentry — for hosting, error monitoring and analytics;
- state authorities — in cases provided by law.
8International data transfer
Some of our providers process data on servers located outside Georgia, including in the EU and the USA. When transferring data internationally, we take measures to ensure an adequate level of protection in accordance with applicable law.
Please note that when we carry out an international transfer of personal data, we make sure we are compliant with applicable laws and regulations — for example, we conclude appropriate agreements with the parties that receive your personal data from us, so that they ensure adequate protection of such data.
9Data retention period
We retain your personal data for as long as your account is active and as long as it is necessary to provide the service.
After the account is deleted, we retain some data only for the period established by law (for example, accounting and tax records), after which it is deleted or anonymized, except for data whose retention is required by law or necessary to resolve disputes.
10Data security
To protect your data we use technical and organizational measures, including encrypted connections, row-level access control in the database, restricted employee access and continuous monitoring.
Please be aware that, by common understanding, the internet is not a secure environment, and information sent over the internet (for example, via a website or an electronic messaging system) may be accessed by unauthorized third parties, which may result in disclosure of information, alteration of the material containing the information and/or other technical error.
Please note that we are not responsible for the security of any information collected about you while that information is in transit to “Ulupa” over the internet. To protect the confidentiality of your data, we remind you that you may choose the method you consider appropriate for communicating with “Ulupa”.
11Our policy on retaining electronic communications
The system automatically stores all electronic communications sent by and to “Ulupa” (SMS, email and others) in a dedicated electronic log system that has the force of legal evidence. “Ulupa” protects them using reasonable technical and appropriate organizational measures, and access to them is allowed only in defined cases, only by authorized persons in strict compliance with applicable laws and regulations.
Data is stored only for the period necessary to achieve the purpose, or for the period defined by law.
12Cookies and analytics
We use cookies and similar technologies to maintain your session, remember your settings and understand how the Platform is used.
For analytics we use privacy-oriented tools (e.g. Vercel Web Analytics and Speed Insights). You can manage cookies in your browser settings.
13Your rights
In accordance with the Law of Georgia “On Personal Data Protection”, you have the right to:
- receive information about the processing of your data;
- request a copy of your personal data held by us;
- request correction, update or deletion of your data;
- request restriction of processing or object to it;
- withdraw your consent at any time;
- lodge a complaint with the Personal Data Protection Service of Georgia (personaldata.ge).
To exercise these rights, contact us at support@ulupa.ge.
14Children’s privacy
Please note that “Ulupa” is intended for users aged 18 and over. Accordingly, we do not knowingly collect children’s personal data. In accordance with applicable law, before transferring personal data through “Ulupa”, persons under 18 must obtain permission from their parents or legal representatives. If you believe that a child has provided us with data, contact us so that we can delete it.
15Changes to the Policy
We may update this Privacy Policy from time to time. The current version is always available on this page with a “Last updated” date. We will notify you of significant changes through the Platform.
16Contact
If you have questions about this Privacy Policy or the processing of your data, contact us at support@ulupa.ge or via the Platform’s support chat.
Operator details
- Operator:
- შპს ულუფა
- ID code:
- 406561135
- Address:
- ქ. თბილისი, ქინძმარაულის II შეს., #15
- Contact:
- support@ulupa.ge