Privacy Policy

1. Who We Are

SM Consulting Ltd is a boutique intellectual property law firm established under the legislation of Georgia, providing specialist legal services in Intellectual Property Law.

For the purposes of the Law of Georgia on Personal Data Protection (as amended) and, where applicable, Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), SM Consulting Ltd acts as the data controller in respect of personal data collected and processed in connection with the provision of our services, the operation of our website, and our general business activities.

Data Controller:
SM Consulting Ltd
8 Zurab Avalishvili St., Block B, Apt. 184, 0179 Tbilisi, Georgia
Email: info@mujiri.ge
Website: www.mujiri.ge

We take the privacy and confidentiality of your personal data seriously. This policy explains what data we collect, why we collect it, how we use it, and what rights you have. If you have any questions, please contact us at info@mujiri.ge.

2. Scope of This Policy

This Privacy Policy applies to:

• All visitors to our website (www.mujiri.ge and any subdomains);
• Clients and prospective clients who contact us, instruct us, or receive legal services from us;
• Counterparties, opposing counsel, third parties, and other individuals whose personal data we process in connection with client matters;
• Suppliers, service providers, and professional contacts;
• Job applicants and candidates for employment or collaboration;
• Any other person who provides personal data to SM Consulting Ltd.

This Policy does not apply to third-party websites linked from our website. We encourage you to read the privacy policies of any third-party sites you visit.

3. Personal Data We Collect

3.1 Data You Provide to Us

When you engage with us as a client, contact us with an enquiry, or instruct us on a legal matter, we may collect:

• Identification data: full name, date of birth, nationality, passport or national identity document details;
• Contact data: email address, postal address, telephone number;
• Professional data: company name, company registration details, role, industry;
• Matter data: details of your intellectual property assets, commercial transactions, disputes, and legal requirements that you disclose to us in the course of instruction;
• Financial data: billing information, bank details for fee payments or disbursements (processed securely and not stored beyond the transaction);
• KYC / due diligence data: source of funds information, beneficial ownership information, and other data required for our client due diligence and anti-money laundering obligations;
• Communications: any correspondence, emails, letters, or other communications you send to us.

3.2 Data Collected Automatically (Website)

When you visit our website, our web hosting and analytics infrastructure may automatically collect:

• Technical data: IP address, browser type and version, operating system, device type;
• Usage data: pages visited, time spent, links clicked, referring URL, search terms used to find our website;
• Cookie data: see Section 9 below.

This data is collected to maintain website security, improve user experience, and understand how visitors find and use our website. It is processed in aggregated or pseudonymised form where possible.

3.3 Data Received from Third Parties

In the course of handling client matters, we may receive personal data relating to third parties — including counterparties, inventors, trademark owners, opposing counsel, witnesses, and other individuals — from our clients, official registers (patent and trademark offices), courts, regulatory authorities, and public sources. We process such data only to the extent necessary to provide our services and fulfil our professional obligations.

4. How We Use Your Personal Data

We use personal data for the following purposes:

4.1 Providing Legal Services

The primary purpose for which we process personal data is to provide intellectual property legal services to our clients. This includes advising on IP strategy, filing patent and trademark applications, conducting prior art searches, managing prosecution and litigation, providing licensing advice, and all other services we offer. Processing for this purpose is necessary for the performance of our contract with you.

4.2 Client Due Diligence and Compliance

As a law firm, we are subject to obligations under Georgian anti-money laundering legislation, professional conduct rules, and international sanctions regimes. We process identity and due diligence data to verify client identity, assess risk, screen against sanctions lists, and fulfil our reporting obligations where required by law. Processing for this purpose is based on our legal obligation.

4.3 Billing and Financial Administration

We process billing and payment data to issue invoices, receive payments, manage accounts, and comply with accounting and tax obligations. Processing for this purpose is based on the performance of our contract and our legal obligations under Georgian tax and accounting law.

4.4 Professional Communications

We process contact and communication data to respond to enquiries, manage our client relationship, send updates on your matters, and provide relevant legal alerts and publications where you have expressed interest. Processing for professional communications is based on contract performance; processing for newsletters and publications is based on your consent.

4.5 Improving Our Services

We use aggregated and anonymised data derived from our website and client interactions to improve the quality and relevance of our services, identify areas for development, and understand client needs. This processing is based on our legitimate interests.

4.6 Legal Claims and Regulatory Obligations

We may process personal data to establish, exercise, or defend legal claims, to comply with court orders or regulatory requests, to respond to law enforcement enquiries where legally required, and to fulfil our obligations to professional regulatory bodies. Processing for this purpose is based on our legitimate interests and legal obligations.

5. Legal Basis for Processing

We process personal data only where we have a lawful basis to do so under the Law of Georgia on Personal Data Protection and, where applicable, the GDPR. The lawful bases we rely upon are:

• Performance of a contract: processing necessary to perform our legal services agreement with you, or to take pre-contractual steps at your request.
• Legal obligation: processing necessary to comply with our obligations under Georgian law, including anti-money laundering legislation, tax and accounting law, and professional regulatory requirements.
• Legitimate interests: processing necessary for our legitimate business interests, including maintaining and improving our services, ensuring network and information security, and managing legal claims — provided those interests are not overridden by your rights and interests.
• Consent: where we send you marketing materials, newsletters, or legal updates, or where we set non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Vital interests or public task: in limited circumstances, where processing is necessary to protect life or is required in the public interest.

6. Professional Confidentiality and Legal Privilege

As a law firm, SM Consulting Ltd is bound by strict professional confidentiality obligations under Georgian bar association rules and general principles of legal professional privilege. All information and personal data disclosed to us by clients in the course of a legal engagement is subject to these obligations.

Professional confidentiality obligations are in addition to, and not limited by, the data protection framework set out in this Policy. Where a conflict arises between a data subject's exercise of data protection rights and our professional obligations — for example, where disclosing data would breach privilege or harm the interests of a third party — we will notify you of the conflict and take such steps as are lawful and appropriate to balance the competing obligations.

Important: Our professional confidentiality obligations mean that certain data protection rights (including the right to erasure and the right to portability) may be limited where exercising them would conflict with our professional duties, our legal obligations to retain records, or our duty to current or former clients.

7. How We Share Personal Data

We do not sell, rent, or trade personal data. We share personal data only in the following circumstances:

7.1 With Affiliated and Partner Firms

Where your matter requires international coverage, we work with a network of partner law firms in other jurisdictions. We share relevant personal data with such partners only to the extent necessary to provide the services you have instructed us on. All partner firms are bound by professional confidentiality obligations and applicable data protection law in their respective jurisdictions.

7.2 With Patent and Trademark Offices and Regulatory Authorities

The filing and prosecution of intellectual property rights necessarily involves submitting personal data (applicant name, address, inventor details) to national and international intellectual property offices (including Sakpatenti, EPO, EUIPO, WIPO, and others). Such submissions are required by law and made in accordance with our instructions from you.

7.3 With Service Providers

We engage trusted service providers to support our operations and website. These include:

Processor	Purpose	Location
Cal.com (Calcom, Inc.)	Consultation scheduling	United States
Resend (Resend, Inc.)	Contact form email delivery	United States
Vercel Inc.	Website hosting and global content delivery	United States / Global edge network
Google LLC	Font delivery (Google Fonts CDN)	United States
Google LLC (Google Analytics 4)	Website analytics and traffic measurement (consent-based only)	United States

All service providers are required to process data only on our instructions and to maintain appropriate security measures.

7.4 Legal Requirements and Law Enforcement

We may disclose personal data where required by law, by court order, or by a competent regulatory or law enforcement authority. We will notify you of any such request where we are legally permitted to do so.

7.5 Professional Regulatory Bodies

We may be required to disclose information to the Georgian Bar Association or equivalent professional regulatory bodies in the context of supervision, complaints, or disciplinary proceedings.

8. International Transfers of Personal Data

The nature of our work as an international intellectual property law firm means that personal data is regularly transferred to and from jurisdictions outside Georgia. In particular:

• Data submitted to international intellectual property offices (WIPO, EPO, EUIPO, USPTO, CNIPA, JPO, and others) is processed in the jurisdiction of each relevant office.
• Partner law firms engaged to handle international matters are located in various countries, including EU member states, the United Kingdom, the United States, and others.
• Our IT infrastructure may involve cloud storage or processing in jurisdictions outside Georgia.

Where personal data is transferred to countries that do not offer an equivalent level of data protection to Georgia or the EU, we ensure that appropriate safeguards are in place:

• Vercel Inc. — Standard Contractual Clauses (SCCs) as approved by the European Commission.
• Google LLC — Certified under the EU–US Data Privacy Framework.
• Cal.com — GDPR-compliant Data Processing Agreement; optional EU data residency.
• Resend, Inc. — Standard Contractual Clauses (SCCs).

You may request further information about the specific safeguards in place for any particular transfer by contacting us at info@mujiri.ge.

9. Cookies and Website Technologies

Our website uses cookies and similar tracking technologies to provide a functional and improved user experience. A cookie is a small text file placed on your device when you visit a website.

9.1 Types of Cookies We Use

Name	Type	Purpose	Duration
cookie-consent	Local storage (preference)	Records your cookie consent choice (accepted / declined)	Until browser data is cleared
_ga	Analytics cookie (Google Analytics 4)	Distinguishes unique users for traffic analysis	2 years
_ga_*	Analytics cookie (Google Analytics 4)	Maintains session state for analytics reporting	2 years

Analytics cookies (_ga, _ga_*) are set by Google Analytics 4 and are only activated if you click Accept on our cookie banner. If you decline, no analytics cookies are placed and no tracking occurs. You may withdraw consent at any time by clearing your browser's local storage or cookies.

9.2 Managing Cookies

You can control and manage cookies through your browser settings. You may set your browser to refuse all or some cookies, or to alert you when websites set or access cookies. Please note that disabling strictly necessary cookies will affect the functionality of our website. More information about managing cookies is available at www.allaboutcookies.org.

10. Data Security

SM Consulting Ltd takes the security of personal data seriously and implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. Our security measures include:

• Encrypted transmission of data (TLS/SSL) across our website and communication systems;
• Access controls limiting data access to authorised personnel on a need-to-know basis;
• Secure storage of matter files and client documentation with appropriate access restrictions;
• Regular review of our security practices in line with evolving best practices;
• Staff training on data protection and information security obligations;
• Pseudonymisation and anonymisation of data where appropriate.

No method of electronic transmission or storage is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with our obligations under applicable law.

11. How Long We Keep Your Data

We retain personal data only for as long as is necessary for the purposes for which it was collected, taking into account our legal and regulatory obligations, professional responsibilities, and limitation periods for legal claims.

Category	Retention Period
Client matter files and legal records	10 years from matter close, or as required by professional regulations
Booking and consultation records	3 years from last interaction
Email and contact form correspondence	2 years from last interaction
Financial and billing records	As required by Georgian tax and accounting law (minimum 5 years)
KYC / due diligence records	5 years from end of client relationship, or longer if required by AML law
Server logs (Vercel)	Up to 30 days
Consent preference (local storage)	Until you clear your browser data

After the applicable retention period expires, personal data is securely deleted or anonymised. Where data cannot be deleted due to technical constraints, it is isolated from active processing.

12. Your Data Protection Rights

Under the Law of Georgia on Personal Data Protection and, where applicable, the GDPR, you have the following rights in respect of your personal data:

Your Right	What It Means
Right of Access	You may request a copy of the personal data we hold about you.
Right to Rectification	You may request correction of inaccurate or incomplete personal data.
Right to Erasure	You may request deletion of your personal data where there is no lawful basis for us to continue processing it. Note: legal professional obligations and regulatory retention requirements may override this right.
Right to Restriction	You may request that we restrict processing of your data in certain circumstances, for example while a dispute is being resolved.
Right to Portability	Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, machine-readable format.
Right to Object	You may object to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.
Right to Withdraw Consent	Where processing is based on your consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Right to Lodge a Complaint	You have the right to lodge a complaint with the Personal Data Protection Service of Georgia (www.pdps.gov.ge) or, if you are an EU data subject, with your national data protection authority.

To exercise any of these rights, please contact us at info@mujiri.ge. We will respond to your request within 30 days. We may need to verify your identity before processing your request. We do not charge a fee for handling data subject requests unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee.

13. Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data about a child, please contact us at info@mujiri.ge and we will delete it promptly.

14. Third-Party Websites and Services

Our website may contain links to third-party websites, resources, and services — including intellectual property office portals, legal databases, and professional association websites. This Privacy Policy applies only to SM Consulting Ltd's website and services. We are not responsible for the privacy practices of third-party sites and encourage you to review their privacy policies before providing any personal data.

15. Marketing and Professional Communications

We may send you legal updates, newsletters, alerts on IP law developments, event invitations, and other professional communications where you have given your consent or where we have a legitimate interest in doing so based on our existing professional relationship.

You may opt out of marketing communications at any time by clicking the "unsubscribe" link in any email we send you, or by contacting us directly at info@mujiri.ge. Opting out of marketing communications will not affect the receipt of communications necessary for the conduct of your legal matter.

16. Automated Decision-Making and Profiling

SM Consulting Ltd does not engage in automated decision-making or profiling that produces legal effects or similarly significant effects on individuals. Our professional services involve human assessment and advice in all cases.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or regulatory guidance. When we make material changes, we will update the effective date at the top of this Policy and, where appropriate, notify you by email or by a prominent notice on our website.

We encourage you to review this Policy periodically. Continued use of our services after an updated Policy is posted constitutes your acceptance of the changes.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your personal data, please contact us:

SM Consulting Ltd
8 Zurab Avalishvili St., Block B, Apt. 184, 0179 Tbilisi, Georgia
info@mujiri.ge
www.mujiri.ge

We aim to respond to all data protection enquiries within 30 days. For complex or high-volume requests, we may extend this period by a further 60 days and will notify you accordingly.