Privacy Policy

1. General Information

This Privacy Policy explains how LLC “Key Call” (hereinafter “K•Call”, “we”, “us”) collects, uses, stores, transfers and protects personal data received through kcall.ge.

The Policy applies to:

• the contact form
• the service/proposal request form
• job application forms
• the technical operation of the website and its administration panel.

This Policy does not cover personal-data processing within K•Call's telephone operations, CRM systems, call recordings, Call Tales or other operational systems. Those processes must be governed separately under the rules applicable to the relevant service.

2. Personal Data We Process

2.1 Contact form

We may process:

• full name
• company name (optional)
• email address
• telephone number
• inquiry subject
• message text
• submission date, time and status.

2.2 Service / proposal request form

We may process:

• full name
• company name
• email address
• telephone number
• requested service
• expected monthly volume
• service languages
• desired timeline
• additional information
• submission date, time and status.

After the expanded proposal form described in this document is implemented, this list must be updated to reflect the fields actually collected, including delivery model, communication channels, service schedule/time zone and integration information.

2.3 Job application form

We may process:

• full name
• telephone number
• email address
• CV/resume
• cover letter
• English and Russian language proficiency
• selected vacancy
• submission date, time and status.

A CV may contain additional information that we did not request directly through the form, including a photograph, date of birth, address, education or employment history. Please do not include information that is not necessary for the relevant vacancy, particularly a personal identification number or special-category personal data unless K•Call specifically requests it for a lawful purpose.

2.4 Technical data

For website security and reliable operation, Vercel technical logs may temporarily process an IP address and request-related technical metadata. Form contents are not intentionally written to technical logs. K•Call does not store IP addresses or device data in its website database.

3. Purposes of Processing

Personal data may be processed to:

• receive, review and respond to an inquiry
• prepare a service proposal and conduct pre-contractual communication
• evaluate a candidate for a specific vacancy and make a recruitment decision
• consider a candidate for future vacancies only where separate voluntary consent has been given
• administer submissions and notify responsible employees
• maintain website security, reliability and technical troubleshooting
• comply with legal obligations and protect K•Call's legitimate interests.

4. Legal Bases for Processing

Personal data is processed in accordance with the Law of Georgia on Personal Data Protection, including where:

• processing is necessary to review a request or application submitted by the data subject
• processing is necessary, at the data subject's request, to take steps before entering into a contract
• processing is necessary for K•Call's significant legitimate interests and those interests are not overridden by the data subject's rights and freedoms
• processing is required by law
• the data subject has given free, specific, informed and unambiguous consent for a defined purpose.

Special-category data included in a job application will be processed only where a lawful basis exists and appropriate safeguards are applied.

5. Recipients and Service Providers

K•Call uses the following technical service providers:

• Vercel Inc.: — website hosting, serverless functions, CDN and technical logs; primary server-side processing takes place in Frankfurt, Germany
• Supabase Inc. / Amazon Web Services: — database, private file storage, administrator authentication and backups; region: Frankfurt, Germany
• Sendinblue SAS (Brevo): — transactional email delivery; France / European Union
• Zoho Corporation: — K•Call corporate email; the exact data-center region must be confirmed
• Telegram FZ-LLC: — operational notifications to authorized responsible persons. A notification may contain the applicant's or sender's name, email, phone number and other information submitted through the relevant form, as well as a link to the protected administration panel. For vacancy submissions, Telegram may show the vacancy title, language levels and cover-letter text. The CV file is not sent through Telegram.

Within K•Call, personal data is accessible only to employees and technical personnel who require it for their relevant work function.

6. International Data Transfers

The website's primary database and files are stored in Germany. Some service providers involved in processing may be established outside Georgia or the European Union.

Data sent through Telegram may be transferred outside Georgia and the European Union, including to Telegram FZ-LLC in Dubai, United Arab Emirates, for the purpose of delivering operational notifications to authorized responsible persons.

International transfers will be carried out only under an applicable legal basis and with appropriate contractual, organizational and technical safeguards, access restrictions and data-security measures as required by Georgian law.

The exact Zoho Mail data-center region must be confirmed before final publication. If data is stored outside Georgia or a jurisdiction providing an appropriate level of protection, the specific legal transfer mechanism must be reflected in the Policy.

7. Retention Periods

• Data received through the Contact and Service/Proposal forms is retained for 24 months from submission unless longer retention is necessary for an ongoing contractual relationship, a legal claim or a legal obligation.
• An application and CV submitted for a specific vacancy is retained for 12 months from submission.
• For consideration for future vacancies, an application and CV is retained for 12 months only on the basis of the candidate's separate voluntary consent.
• Technical logs and backups are retained according to the applicable technical retention periods of the relevant service providers.

After the retention period expires, data will be deleted or destroyed unless another lawful basis for continued retention exists. When a database record is deleted, the related CV file must also be deleted. Data remaining in backups will be removed when the backup retention period expires.

8. Use of Artificial Intelligence

kcall.ge currently does not use artificial-intelligence systems to process personal data submitted through website forms. Website-form data is not transferred to OpenAI, Google Gemini, Anthropic or another AI service. Candidate applications are not automatically scored, filtered, summarized or rejected; decisions are made by authorized employees.

If K•Call introduces AI processing in the future, this Policy will be updated in advance to explain the relevant AI provider, data involved, purpose, legal basis, retention and transfer conditions, human involvement and data-subject rights. Where required, separate voluntary consent will be obtained.

9. Data Security

K•Call applies appropriate technical and organizational safeguards, including:

• HTTPS and HSTS protection
• private CV storage and short-lived signed links
• server-side file-type and file-size validation
• database Row Level Security rules
• authentication and authorized-email controls for the administration panel
• role/function-based access restrictions
• automated database backups
• secure error and notification handling.

10. Cookies

For ordinary website visitors, kcall.ge currently uses only the necessary functional cookie `NEXT_LOCALE`, which remembers the selected language (Georgian/English). It is not used for advertising, analytics or profiling.

For employees authenticated into the administration panel, Supabase uses cookies necessary for authentication. The website currently does not use Google Analytics, Meta Pixel, Hotjar, Microsoft Clarity or another advertising/analytics tracker.

11. Your Rights

Subject to the conditions established by law, you have the right to:

• receive information about processing of your personal data
• access your data and receive a copy
• request correction, update or completion
• request that processing stop or that data be deleted or destroyed
• request blocking of data
• withdraw consent at any time where processing is based on consent
• challenge K•Call's actions in accordance with applicable law.

To exercise your rights, email info@kcall.ge. Requests will be handled within the period prescribed by law. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

You may also contact the Georgian supervisory authority for personal data protection in accordance with applicable law.

12. Changes to This Policy

K•Call may update this Policy to reflect technological, operational or legal changes. The current version and its update date will be published on kcall.ge.

Questions and requests

For any question about your personal data, or to exercise your rights, write to us at info@kcall.ge.