01Who is responsible?
- Data controller
- Lucky Way LLC
- Identification code
- 406088736
- Contact address
- Tbilisi, 61 Gorgasali St., 0114 / Krtsanisi Modern Business Center / 4th Floor
This notice covers the Lucky Way website, travel enquiries, customer accounts where available, and related service correspondence. The controller is Lucky Way LLC, operating under the Lucky Way brand. For a booking that needs additional traveller information, we will explain the relevant purpose and recipients separately.
03Why we use information
| Purpose | Basis |
|---|
| Responding and preparing travel options | Steps you request before a possible service contract, or consent where that is the appropriate basis. |
|---|
| Accounts and service correspondence | Providing the account or service you request. Your enquiry may be emailed internally to info@luckyway.ge and used for staff reminders. |
|---|
| Preventing abuse and protecting access | Our legitimate interest in operating a secure service, balanced against your rights. |
|---|
| Required records and rights requests | Applicable legal obligations and, where justified, establishing or defending claims. |
|---|
Sending an enquiry does not subscribe you to advertising. Any future promotional subscription will need its own appropriate consent and a withdrawal option.
04Who may receive information?
- Authorized Lucky Way personnel handling your request and the business mailbox info@luckyway.ge.
- Hosting, email and technical support providers, including Proservice when its services are used, to the extent needed to run those services.
- Google or Meta when you actively choose an available social sign-in option; those providers also act under their own notices.
- A competent authority when disclosure is legally required, or an adviser where justified to resolve a specific dispute.
We do not sell enquiry data. If arranging a booking requires disclosure to a hotel, airline or another travel supplier, the relevant booking process must identify what is needed and who receives it; the website form itself does not make an airline or hotel booking.
05Services outside Georgia
A chosen external provider may process information outside Georgia. Any such arrangement needs an applicable transfer basis and appropriate safeguards. Contact us for information about the recipient and safeguards relevant to your request. Merely browsing the website does not enable Google or Facebook sign-in.
External notices: Google Privacy Policy · Meta Privacy Policy.
06How long information remains
| Category | Retention approach |
|---|
| Enquiries and correspondence | Assessed by whether the enquiry is still active, travel planning and follow-up needs, and any applicable record-keeping or dispute obligations. Ask us about the period applicable to your particular record. |
|---|
| Customer accounts | While the requested account is maintained, and afterwards only where a justified purpose or legal obligation remains. Account closure or deletion can be requested by email. |
|---|
| Verification and CAPTCHA | Verification codes are valid for 10 minutes; CAPTCHA codes for 5 minutes. Expired verification context may remain briefly to support resending. Code validity is not a promise that every stored record is erased at expiry. |
|---|
| Security records | Retained according to session expiry, abuse-prevention windows and the need to investigate a specific security issue. Account event history is retained with the account. |
|---|
| Mailbox copies and backups | Separate copies can exist in business email and recovery backups. A deletion request is assessed across these locations, subject to justified retention. |
|---|
Moving an enquiry to the administrative trash hides it from the active list and cancels its pending reminder; it is recoverable and is not permanent erasure. A request to erase personal data must be reviewed separately. We do not claim a fixed automatic deletion period for enquiries that this website does not enforce.
07Cookies and browser storage
The current website uses necessary sign-in storage. Browsing public pages or sending an enquiry does not require a customer account. Advertising trackers and analytics cookies are not enabled in this version.
| Storage | Purpose and duration |
|---|
| lw_customer_session | Customer sign-in: a browser-session cookie with an eight-hour server session, or up to 30 days if “Keep me signed in” is selected. |
|---|
| lw_session | A separate administrator session, up to eight hours. |
|---|
| lw_oauth / lw_oauth_pending | Temporary sign-in checks when social sign-in is chosen, up to 10 minutes. |
|---|
| lw-confirmation (sessionStorage) | Resumes a verification step within the browser tab. It is not an advertising identifier; closing the tab clears this browser storage. |
|---|
You can clear cookies or browser storage in your browser; doing so can sign you out or restart verification. Choosing a language changes the page address. External social links open another service whose own cookie rules apply.
08Security and incident handling
Safeguards include protected administrative access, hashed passwords, separate customer and administrator sessions, server-side validation, CAPTCHA and request limits. Mail sending uses authenticated TLS. The public deployment is configured for an HTTPS origin. No system can guarantee absolute security.
If you suspect account misuse, stop using a shared session, reset your password through the account flow and contact us. We assess suspected incidents, restrict further access and make notifications where required. Never email us your password or a one-time sign-in code.
09Your choices and rights
Subject to applicable conditions, you can request information and a copy, correction, erasure, restriction, portability where applicable, or withdraw consent. Other justified obligations may limit erasure. Information and copy requests are generally answered within 10 working days; a justified extension is communicated where the law permits.
info@luckyway.ge — send a privacy request
Include the contact used for your enquiry or account, an available request reference and the action you seek. We may ask for proportionate identity confirmation; do not send an identity-document scan unless we explain why it is necessary.
You may complain to Georgia’s State Audit Office or seek judicial protection. See the current law for the applicable procedures and exceptions.
10Children and sensitive traveller information
Initial trip planning should normally use an adult contact and only the minimum information about accompanying children, such as their number or age when relevant. Where a child’s data or sensitive information is needed for a particular service, the appropriate representative, basis and protected collection method must be established separately.
11Reminders, advertising and automation
Scheduled reminders are internal follow-up emails to info@luckyway.ge. They do not make bookings, charge payments or make decisions with significant effects on customers. An enquiry is reviewed by the team. This website currently has no connected AI travel assistant, live supplier booking API or card-payment checkout. Any future processing through these features will require an updated notice.
12Updates and official information
This notice is dated 28 October 2026. Material changes will be reflected in its date and text; additional notice or consent will be used when required. Contact info@luckyway.ge if the notice does not answer a question about your information.
Official references: Law of Georgia on Personal Data Protection · State Audit Office of Georgia.
13Additional GDPR information
This section supplements the notice where the EU General Data Protection Regulation (GDPR) applies, including relevant activities offering services to people in the EU/EEA or monitoring their behaviour there. Location, targeting and the processing activity matter; citizenship alone does not determine its application. Lucky Way is established in Georgia. This notice is not a certification of GDPR compliance.
For GDPR purposes, responding to a requested quote and providing an agreed account or travel service rely on Article 6(1)(b). Necessary statutory records rely on Article 6(1)(c). Proportionate fraud prevention, access protection and justified claims rely on Article 6(1)(f), with the interests described above balanced against your rights. Only genuinely optional processing based on your freely given choice relies on Article 6(1)(a). A form acknowledgement is not blanket consent for unrelated processing. A new purpose or special-category data requires its own applicable basis and information before use.
Providing initial enquiry details is voluntary, but a name, a usable contact and sufficient trip information are needed to respond. Without them we may be unable to prepare an offer; an account is optional. We receive information from you, from an identity provider you select, and from connection/security events as described above. If information comes from another person arranging a trip, we provide the required source and processing information within the applicable Article 14 period unless a lawful exception applies.
You may request access, rectification, erasure or restriction under the applicable conditions. Portability covers data you provided where automated processing is based on consent or contract, in a structured, commonly used, machine-readable format. You may object on grounds relating to your situation to processing based on legitimate interests; we must stop unless the applicable compelling grounds or legal-claims exception is established. Objection to direct marketing stops that use. You may withdraw consent at any time by contacting us, without affecting processing lawfully carried out before withdrawal.
GDPR rights requests are normally free and answered without undue delay, within one month of receipt. Complexity or the number of requests may justify up to two additional months; within the first month we explain the extension and reasons. Any refusal is explained with complaint and court options. A reasonable fee or refusal is limited to legally permitted manifestly unfounded or excessive requests. A shorter applicable Georgian deadline remains relevant; the GDPR period does not replace it.
You may complain directly to a competent EU/EEA supervisory authority, particularly where you habitually live or work or where the alleged infringement occurred, and seek judicial remedies. You do not have to complain to Lucky Way first. Use our privacy email above for rights requests; it is not presented as an appointed Data Protection Officer or EU representative.
Processing may take place in Georgia and in the locations used by the providers described above. Where a disclosure is a restricted international transfer under GDPR Chapter V, the relevant transfer must have a valid mechanism, such as an applicable adequacy decision or appropriate safeguards including suitable standard contractual clauses and any required supplementary measures. We do not claim that every provider or country is covered by adequacy or signed clauses. Ask our privacy contact for the relevant destinations, mechanism and a copy of applicable safeguards, with necessary confidential details redacted. Routine transfers cannot be justified merely by accepting this notice.
Where GDPR applies to a personal data breach, we assess and document the risk. Unless it is unlikely to risk individuals’ rights and freedoms, notification to the competent authority is required without undue delay and, where feasible, within 72 hours of awareness. A high-risk breach also requires communication to affected people without undue delay, subject to lawful exceptions. These are incident-response duties, not a claim that notifications are automated.
Official GDPR references: Regulation (EU) 2016/679 · EU/EEA supervisory authorities.
