Privacy Policy

TWENTYFIVE is a coworking space in Tbilisi, Georgia, operated by Dobera LLC (identification number 200004878), registered in Georgia (the "Company," "we," "us," or "TWENTYFIVE"). This Privacy Policy explains what personal data we collect, why we collect it, and what rights you have over it. It forms part of our Terms of Use.

We have tried to write this Policy in plain language. If anything is unclear, email us at space@twentyfive.live and we will explain.

This Policy applies to anyone who books a desk, buys a membership, uses our Virtual Address Services, visits the space, or uses our website at twentyfive.live (the "Website").

1. Who We Are

The company responsible for your personal data (the "data controller") is:

• Company: Dobera LLC
• Identification number: 200004878
• Director: Mery Togonidze
• Registered / business address: Lado Asatiani 25, Floor 1, Tbilisi, Georgia
• Email: space@twentyfive.live
• Website: twentyfive.live

2. What Personal Data We Collect

2.1 Booking and Account Data

When you book a desk, buy a membership, or otherwise register with us, we collect your full name, email address, and phone number. If you book as a business, we also collect your company name.

2.2 Payment Data

When you pay through our Website, your payment is processed by our third-party payment provider. When you pay on site, our card terminal processes the payment directly with your bank. In both cases, we do not see or store your full card number, CVV, or other card credentials — we only receive confirmation that payment was made, and a reference number.

2.3 Access Data

To let you into the space, we assign you a personal entry code and share the Wifi password with you. We keep a record of which code belongs to which member, and of entry events at the door, so we can manage access and look into any security issue (for example, a code being shared or misused).

2.4 Video Surveillance

For the safety of members and their belongings, the space is monitored by CCTV cameras covering common and entry areas (not desks facing away from camera range beyond general room coverage). Footage is used only for security purposes — preventing and investigating theft, damage, or unauthorised access — and is not used to monitor your work.

2.5 Virtual Address Services

If you use our Virtual Address Services, we additionally collect:

• Mail Handling: the physical and scanned contents of correspondence addressed to you that we receive at our address, together with the sender information shown on the envelope or package.
• Legal Address (companies and individual entrepreneurs): your company registration details and any information we need to provide a letter of consent for you to register your business at our address, and to correspond with the Public Registry of Georgia on your behalf where relevant.

Correspondence we handle for you may itself contain personal data about you or about other people (for example, a client of yours). We treat all such correspondence as confidential and only use it to provide the Mail Handling and Legal Address services — we do not read, use, or share it for any other purpose.

2.6 Communications

If you contact us by email, messenger, or phone, we collect the content of that communication and your contact details, so we can respond to you.

2.7 Website Data

Our Website may automatically collect basic technical data, such as your IP address, browser type, and pages visited, to keep the Website running securely. Our Website currently uses only essential functionality; if we later add analytics or marketing cookies, we will update this Policy and ask for your consent where required.

3. How We Use Your Personal Data

We use your personal data to:

• create and manage your booking, membership, or Virtual Address account;
• process payments and keep accounting and tax records;
• provide access to the space (entry codes, Wifi) and keep it secure (CCTV, access logs);
• receive, scan, forward, or hold correspondence under Virtual Address Services, and support your company registration where applicable;
• respond to your questions and provide customer support;
• meet our legal obligations, for example under Georgian tax, accounting, and company registration law;
• investigate and prevent misuse of entry codes, fraud, or breaches of our house rules.

Our legal basis for these uses is, depending on the situation: performance of our contract with you (providing the service you booked), our legitimate interest in running a secure and well-functioning space, or compliance with a legal obligation.

4. Sharing Your Personal Data

We only share personal data where necessary, with:

• Payment processors and the bank behind our card terminal, to process your payments.
• Courier or postal services, if you ask us to forward or resend physical mail.
• The National Agency of Public Registry of Georgia and relevant authorities, where needed to support a Legal Address registration or to meet a legal obligation.
• IT and hosting providers, who help us run our Website and store our records securely.
• Accountants and legal advisors, where needed for our own compliance and record-keeping.
• Courts, regulators, or law enforcement, where required by Georgian law.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

5. International Data Transfers

TWENTYFIVE is based in Georgia, and we store and process most personal data on servers and with service providers located in Georgia. That said, some of the tools we rely on to run TWENTYFIVE are provided by companies based outside Georgia, which means your personal data may be transferred to, and processed in, other countries. This currently includes:

• Email: we use Google Workspace (Gmail) to send and receive emails, including booking confirmations, entry instructions, and correspondence handled under our Virtual Address Services.
• Website analytics: if and when we add analytics tools to our Website (see Section 2.7), these are typically provided by companies such as Google, which process data outside Georgia.
• Hosting and IT infrastructure: our website and records may be hosted on servers operated by providers located outside Georgia.

Where we transfer personal data outside Georgia, we take reasonable steps to keep it protected, including:

• using established, reputable providers with strong security and privacy practices;
• relying on the contractual data-protection terms our providers offer, designed to keep your data protected to a standard comparable to what it would receive in Georgia;
• sharing only the personal data each provider needs to do its job.

We do not sell your personal data, and we do not share it with any provider for that provider's own independent marketing purposes.

If you'd like more information about a specific transfer, including a copy of the relevant safeguards, contact us at space@twentyfive.live.

6. How Long We Keep Your Data

We keep personal data only for as long as we need it:

• Booking and account data: for as long as your account is active, plus a reasonable period afterwards to handle any follow-up questions or disputes.
• Payment and accounting records: for the period required by Georgian tax and accounting law.
• Access logs and entry codes: while your booking or membership is active, and for a limited period afterwards for security purposes, after which they are deleted.
• CCTV footage: for a limited period on a rolling basis, unless we need to keep a specific recording longer to investigate or respond to an incident.
• Virtual Address correspondence: for as long as your Virtual Address service is active, plus a reasonable period afterwards, unless you ask us to delete it sooner and we have no legal reason to keep it.

After the relevant period, we delete or anonymise the data.

7. Keeping Your Data Secure

We use reasonable technical and organisational measures to protect your personal data, including restricting who on our team can access booking records, payment references, entry codes, and Virtual Address correspondence, and storing electronic records securely. No system is completely secure, but we take your data seriously and act promptly if something goes wrong.

8. Your Rights

Under the Law of Georgia on Personal Data Protection, you have the right to:

• ask us what personal data we hold about you and get a copy of it;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data, where we are not required to keep it for legal or accounting reasons;
• ask us to restrict how we use your data in certain situations;
• object to certain uses of your data based on our legitimate interest;
• withdraw any consent you have given us, at any time, for the future.

To exercise any of these rights, email us at space@twentyfive.live. You can also complain to the Personal Data Protection Service of Georgia.

9. Children's Privacy

Our Services are only available to people aged 16 or over, in line with our Terms of Use. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, please contact us and we will delete it.

10. Changes to This Policy

We may update this Policy from time to time, for example to reflect new services or legal requirements. We will post the updated Policy on our Website and update the "Last updated" date above. For significant changes, we will also notify active members by email.

11. Contact Us

If you have any questions about this Policy or about your personal data, please contact us:

• Company: Dobera LLC
• Identification number: 200004878
• Director: Mery Togonidze
• Email: space@twentyfive.live
• Website: twentyfive.live