This policy explains what personal data Gzad collects, why, and what you can do about it. It covers our website, the advertiser portal, the fleet portal, and the advertising screens installed in partner vehicles.
Who is responsible
The data controller is [legal entity name], identification number [ID number], registered at [registered address], Tbilisi, Georgia. Contact us at legal@gzad.ge.
What we collect
Account data. Name, email address, phone number, company name, and role, provided when an account is created.
Advertising content. Images and videos uploaded by advertisers, along with campaign names and schedules.
Vehicle and device data. For fleet partners: vehicle make, model, year, colour, and licence plate, plus the identifier of the screen installed in that vehicle.
Location data. Screens report their GPS position alongside each advertisement they play, roughly every few minutes while the vehicle is operating. Because a screen is assigned to a specific vehicle and a vehicle to a specific fleet partner, this location history is personal data relating to that partner and their drivers.
Playback records. Which advertisement played, on which screen, when, for how long, and where.
Billing records. Balance movements, charges, and the pricing applied to each charge.
Why we use it
To operate the service: deciding which advertisements a screen should show, and keeping accounts and vehicles in order.
To bill accurately: charges are calculated from playback records and the district a screen was in, so location and playback data directly determine what an advertiser pays and what a fleet partner is credited for.
To report to advertisers: aggregate coverage and impression statistics. Advertisers see where and when their own campaigns played; they do not see which vehicle, driver, or fleet partner was involved.
To keep the network secure: detecting tampering with screens and fraudulent playback reporting.
Our legal basis is performance of the contract with advertisers and fleet partners, and our legitimate interest in billing correctly and preventing fraud. [Confirm with counsel whether a separate written consent from drivers is required for continuous vehicle tracking under Georgian law.]
Who can see what
Fleet partners see data for their own vehicles only. Advertisers see statistics for their own campaigns only, never identifying a vehicle or driver. Gzad staff can see all records in order to run the service.
We do not sell personal data. We share it only with the infrastructure providers that run the service on our behalf — Supabase (database, file storage, authentication) and Vercel (application hosting) — and where the law requires disclosure.
Uploaded advertising media is served from a publicly readable address so that screens can fetch it. Do not upload anything to the platform that you would not want to be publicly accessible.
How long we keep it
Playback and location records are retained for [retention period — decide this; 24 months is a common choice for billing disputes]. Billing records are retained for as long as accounting law requires. Account data is kept while the account is open and for a reasonable period afterwards. Advertising media is deleted on request once the campaign has ended.
Your rights
You may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, or a copy in a portable format, and you may object to processing based on legitimate interest. Write to legal@gzad.ge and we will respond within the period the law allows.
If you believe we have handled your data improperly, you may complain to the Personal Data Protection Service of Georgia.
Security
Access to the platform requires authentication, and the database enforces per-account separation so one account cannot read another’s data. Each screen authenticates with its own credential, so a tampered device cannot report on behalf of others. No system is perfectly secure; tell us promptly at legal@gzad.ge if you think an account has been compromised.
Changes
We will update this page when our practices change and revise the date at the top. Material changes will be communicated to account holders directly.