Privacy policy

This privacy policy explains how MRKFLOW ("MRKFLOW", "we"), based in Tbilisi, Georgia, processes personal data collected through the website mrkflow.ge (the "Site").

We process personal data in accordance with the Law of Georgia on Personal Data Protection of June 14, 2023 (the "Law") and, where it applies to visitors from the European Economic Area, the EU General Data Protection Regulation (GDPR). In the Law's terms, MRKFLOW is the controller of this data, and the service providers named in section 4 are processors acting on our behalf.

1. What data we collect

We collect only the data needed to operate the Site and respond to you:

• Data you submit through a form: on the contact form, your name, email address, organization, the service you are interested in and your message; on the free audit form, your name, email address, phone number, organization, website address and what you would like the audit to focus on. Each form also sends the address and language of the page you send it from. The fields marked required must be filled in (on the contact form your name and email address; on the free audit form your name, email address, phone number and website address; on both, the checkbox): without them the form is not sent and we cannot answer you. The other fields are optional.
• How you reached the Site: the campaign tags of the link you arrived through (utm parameters), the address of the page you came from without its query string, and the first page you opened. The page you arrive on reads them and keeps them in its memory only, so a form sent from that page carries them. Only if you accepted analytics does your browser also keep them in this tab's session storage until you close the tab, so that a form sent from a later page carries them too; without that consent, a form sent from any other page carries none of them. The click ID that Google or Meta ads add to a link (gclid or fbclid) is kept and sent only if you chose "Accept analytics and ads".
• Google Analytics data: only if you choose "Accept analytics". Google Analytics then measures your visit, as described in the cookie policy. Until you accept, and after "Reject", the Site sends no data about your visit to Google. If you withdraw consent while Google's tag is already running on a page, section 2 of the cookie policy explains when it stops.
• Advertising data: the Site can use advertising pixels from Meta, TikTok and Google Ads. While one is switched on, the cookie dialog also offers "Accept analytics and ads", and the pixel loads only after that choice. It then sends data about your visit to its network (the pages you view, your clicks on the Site's contact, audit, phone and email links, and that you sent an inquiry) so that the network can measure our ads and show them to you on other sites (remarketing).
• Technical data: server logs generated automatically when you visit the Site (IP address, browser type, pages requested, times), and our server's activity log (section 3).
• Page speed: a page view sends our own server one speed measurement (Core Web Vitals: how fast the page loads, how quickly it responds to what you do, and how much its layout shifts) with the page's address, when you leave or hide the page; a page you return to with the browser's Back or Forward button counts as a new page view. It sets no cookie and stores nothing in your browser. Our server keeps only daily totals per page, without your IP address or browser, and deletes them after 90 days; it uses the IP address only briefly, in memory, to limit abuse.
• Cloudflare Web Analytics: Cloudflare, which delivers and protects the Site (section 4), adds a small script to our pages that records each page view, with the page's address, the page you came from, the country you connect from, your browser, operating system and device type, and measures how fast the page loads (Core Web Vitals). It runs without consent and stores nothing in your browser (no cookies, no local storage, no session storage). Cloudflare states that it discards your IP address at its nearest data center and does not fingerprint visitors.

We do not knowingly collect data from minors, and we ask you not to send special categories of personal data through our forms.

2. Why we process it and on what basis

• Answering your inquiry or audit request (the data you submit through a form and the page you sent it from): we process it to review the request you sent us (Law, Article 5(1)(j)) and, if you ask us to prepare an agreement, to take the steps toward it that you ask for (Law, Article 5(1)(b)); for visitors from the EEA, GDPR Article 6(1)(b). The checkbox on the form confirms that you have read this policy; it is not the basis for answering you.
• Measuring how the Site is used (Google Analytics): only with your consent, given with "Accept analytics" (Law, Article 5(1)(a); GDPR Article 6(1)(a)). You can withdraw it at any time with Cookie settings at the bottom of every page.
• Advertising (only while a pixel is switched on): only with your consent, given with "Accept analytics and ads" (Law, Article 5(1)(a); GDPR Article 6(1)(a)). The same consent covers the ad click ID kept with an inquiry.
• Knowing where inquiries come from (the campaign tags, the page you came from and the first page, when they are sent with a form): to see which of our channels and campaigns bring inquiries. Based on our significant legitimate interest in knowing what in our marketing works (Law, Article 5(1)(i); GDPR Article 6(1)(f)). You can ask us to stop this processing and delete these details from your inquiry (Law, Article 16).
• Operating and securing the Site (server logs, the activity log, the daily page speed totals and Cloudflare Web Analytics): based on our significant legitimate interest in keeping the Site available, fast and secure, and in knowing how many people visit it and where they come from (Law, Article 5(1)(i); GDPR Article 6(1)(f)).
• Legal obligations: where the law requires us to keep or disclose data (Law, Article 5(1)(c) and (d); GDPR Article 6(1)(c)).

3. How long we keep data

Inquiries sent through the forms, and the details sent with them, are deleted automatically 24 months after we receive them; inquiries our spam protection flags (more than ten in an hour from one IP address, or for IPv6 from one /56 network) are deleted after 90 days. If we set a flagged inquiry's status to Contacted, Qualified or Won in our control panel, it is no longer flagged: the 24-month period then applies, counted from receipt, and it is included in the next weekly export described below. These are the default periods. We can set others in our control panel (12 to 120 months, and 30 to 730 days for flagged inquiries), the periods set there are the ones applied, and we update this policy when we change them. A shorter period takes effect 7 days after it is set. If one run would delete more than half of the stored inquiries at once, or the server clock looks wrong, deletion pauses until we have checked it and resumed it in our control panel; until then an inquiry can stay past its period. If a contract follows an inquiry, the data that contract needs is kept under the contract instead. Inquiries past their period are also removed from the automatic restore points on our server, at most once a day; a restore point that is too large or cannot be read is skipped and keeps them until it is replaced (the server keeps its 20 most recent restore points).

Copies that reach our mailbox by email are not changed by anything deleted on our server: the notification sent for each inquiry that is not flagged as spam and an export of the inquiries that no earlier export contained, without those flagged as spam, sent weekly if new inquiries have arrived and on demand from our control panel. Each inquiry not flagged as spam appears in one such export. We delete these emails, notifications and any downloaded panel backups so that no copy is kept longer than the period above, counted from receipt.

Server logs: the server's logs at our hosting provider, Railway, can include IP addresses, browser type and the pages requested. On our Railway plan (Hobby) they are available to us for 7 days; Railway may keep them longer under its own terms.

Activity log: our server records the IP address and the email address or phone number of each inquiry, the IP address of every attempt to sign in to our control panel, including failed and blocked attempts, and our own actions in the panel. When the log grows past 1 MB, it is cut to its newest 4,000 entries. An entry older than the inquiry period (24 months by default; for an inquiry flagged as spam when it arrived, the flagged period, 90 days by default) loses its IP address and other details, and only the action and its time stay. This clean-up pauses under the same checks as the deletion of inquiries.

Your cookie choice is kept in your browser for 12 months, after which the Site asks again.

4. Who can access your data

Your data is accessed only by MRKFLOW team members who need it to respond to you, and by the service providers below. They are our processors: they process the data on our behalf under their data processing terms. Each one's privacy contact page is linked.

• Railway (hosting the Site and its server): a company based in the United States (railway.com/legal/privacy).
• Cloudflare (network delivery and protection, which sees connection data such as IP addresses; also Cloudflare Web Analytics, section 1): a company based in the United States with a global network, which states that it stores data mainly in the United States and the European Economic Area (cloudflare.com/privacypolicy).
• Google: Google Analytics, through Google Tag Manager, only after "Accept analytics"; and Google Workspace, the mailbox that receives our inquiry emails. Google may process data in any country where Google or its subprocessors have facilities, including the United States (policies.google.com/privacy).
• Resend (sending inquiry notifications and a weekly export of new inquiries, without those flagged as spam, to our own mailbox, when email notifications are on): a company based in the United States, which states that it stores account data, including email metadata and logs, in the United States (resend.com/legal/privacy-policy).

Advertising networks receive data only while one of their pixels is switched on and only after "Accept analytics and ads": Meta (Meta Pixel), TikTok (TikTok Pixel) and Google (Google Ads). They are not our processors: they receive data about your visit for measuring our ads and for remarketing, and use it under their own terms.

Transfers outside Georgia: all four providers are companies based in the United States, and your data is processed outside Georgia. Resend stores it in the United States; Cloudflare mainly in the United States and the European Economic Area; Google in the United States and other countries where Google or its subprocessors have facilities. Railway runs our server in one of its regions, none of which is in Georgia (they are in the United States, the Netherlands and Singapore). An advertising network receives data only while its pixel is on (see above); where it processes that data is set out in its own terms.

We do not sell personal data.

5. Your rights

Under the Law you have the right to information about how we process your data (Article 13), to see your data and receive a copy of it (Article 14), to have it corrected, updated or completed (Article 15), to ask us to stop processing it, or to delete or destroy it (Article 16), to have it blocked (Article 17), and to withdraw your consent at any time (Article 20). Where we process data you gave us by automated means on the basis of your consent or an agreement, you can also ask to receive it in a portable form, where this is technically feasible (Article 18). Withdrawing consent does not affect the lawfulness of processing carried out before it.

We answer a request within 10 working days of receiving it (Articles 13 to 16 and 20). For a request for information or to see your data, the Law allows this period to be extended by up to 10 working days in special cases, with reasons, and we tell you straight away if we extend it (Articles 13 and 14). We decide on a request to block data, and tell you, within 3 working days (Article 17).

To exercise these rights, contact us at +995 590 90 11 90 or hello@mrkflow.ge. You can also complain to the State Audit Office of Georgia, which supervises personal data protection (pdp.sao.ge), or apply to a court or a higher administrative body (Law, Article 22). If you live in the EEA, you can also complain to your local supervisory authority.

6. Security

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, alteration or loss, including encrypted transport (HTTPS), access control and minimization of collected data.

7. Changes to this policy

We may update this policy as the Site and our services develop. The date above shows the latest revision; material changes will be highlighted on this page.