Scope and purposes
JSC ISBANK GEORGIA (the Bank, ISBANK Georgia or we) uses cookies and similar technologies to operate and protect this website, remember selected preferences and, only with your prior consent, measure website use. This Policy covers the public website; separately governed banking channels and staff workspaces follow their own notices. Cookies are small files stored on your device; local storage and session storage are separate browser-storage technologies covered by this Policy.
The Bank is the data controller for its own website processing. General information about the Bank, applicable processing grounds, your rights and the Personal Data Protection Officer is available in our Personal Data Protection Policy and Protection of personal data information. Optional analytics is based on your consent. Necessary operation and security processing relies on the applicable legal basis, including the Bank’s legitimate interests in a secure and functional website where those interests are not overridden by your rights and freedoms.
Your choices
You can accept optional analytics, choose necessary technologies only, or subsequently withdraw analytics consent through Cookie preferences. Refusal or withdrawal does not prevent access to the public website. Optional analytics acceptance is unavailable while collection is disabled. Merely visiting the website, submitting an enquiry or using the internet-banking link is not consent to optional analytics.
Your choice applies to this website and browser. It does not automatically change settings on other devices, websites or banking channels. Browser controls may block or remove storage; this may reset preferences or affect security verification. Withdrawal does not affect the lawfulness of processing already performed on the basis of consent.
Optional analytics and campaigns
Only after acceptance, we record page visits, selected clicks, scroll milestones, estimated active time and approximate city/country. Records can include pseudonymous browser and session identifiers, recognised campaign/source identifiers, page paths, timestamps and navigation events. The random identifier recognises a browser without containing the visitor’s name; pseudonymous identifiers can still be personal data. Our custom analytics does not collect form text, passwords, keystrokes, screen recordings or full IP addresses.
A bank-created campaign identifier in a shared URL can associate a consented entry visit with subsequent pages and observed transitions. The latest explicit campaign entry can be associated with recognised returns for 30 fixed days. Ordinary returns do not extend that period. A source label describes the shared link, not proof that the visitor used the named social platform. We do not use browser fingerprinting for this analytics.
Where you submit an enquiry with analytics accepted, a temporary receipt/visit association supports counts of accepted enquiries and acceptance by the mail provider. Names, email addresses and enquiry text are not copied into analytics events. We also measure a selected click to internet banking; that click does not give this public website access to banking activity inside the separate channel. Refusal or withdrawal prevents further optional campaign tracking.
Website cookies and browser storage
| Name and technology | Purpose and category | Lifetime |
|---|---|---|
| isbank_analytics cookie | Value off remembers rejection only. With consent, an opaque identifier supports optional analytics. | Fixed 90 days; ordinary visits do not renew accepted consent. |
| isbank_analytics_session cookie | Groups consented activity into a visit; optional analytics. | 30 minutes of inactivity. |
| isbank_analytics_visit in sessionStorage | Maintains the consented visit in the current tab; optional analytics. | Until the tab closes; the server visit ends after 30 minutes of inactivity. |
| isbank-accessibility-v1 in localStorage | Remembers accessibility settings you select; functional preference. | Until you reset or clear the settings, or they are replaced. |
| launch_animation_seen in localStorage | Remembers that the launch welcome animation has been shown; used only for that animation, independently of analytics. | Valid until the seven-day launch campaign ends; removed on a subsequent page visit. |
Infrastructure and security technologies
Cloudflare provides website delivery and security services. Infrastructure services may process IP addresses, browser/request information and security signals needed to deliver the site and mitigate abuse. The statement about full IP addresses above concerns our custom analytics, not every infrastructure service.
Cloudflare security storage depends on the controls applied to a visit; the following cookies are conditional, not a statement that every visitor receives both:
| Name | Purpose | Lifetime |
|---|---|---|
| __cf_bm, when the applicable bot protection is active | Bot detection and mitigation; necessary security. | 30 minutes of continuous inactivity. |
| cf_clearance, when a security challenge is used | Records challenge clearance; necessary security. | The challenge-passage period configured for that challenge, reflected in the cookie’s expiry. |
The enquiry form uses Cloudflare Turnstile. Its single-use verification token expires after five minutes; it is not an analytics cookie. Security verification does not require analytics acceptance. Additional technical handling is described in Cloudflare’s cookie information and Turnstile privacy information.
Technology providers may process information on the Bank’s behalf subject to applicable contractual, confidentiality and data-protection requirements. Processing can involve locations outside Georgia; the applicable safeguards and further rights information are addressed in the Bank’s Personal Data Protection Policy. Optional analytics rejection does not disable necessary delivery or security processing.
Retention and withdrawal
We retain cookie-related information only for the relevant purposes. Detailed browsing events and session records are subject to a 30-day retention period; minimal browser recognition expires within 90 days. Campaign-linked detail and browser associations expire after 30 days. Expired records are removed through scheduled cleanup. Withdrawal stops optional collection and removes associated detailed analytics records through the application’s deletion process.
Daily/hourly and campaign statistical summaries remain for up to five years and contain no browser identifiers. Captured annual statistical reports have no automatic expiry and contain no browser identifiers. Previously produced aggregate reports are not recalculated by a browser withdrawal action. These periods concern the website analytics system, not all banking records, security-provider records, enquiries or copies of email correspondence. An additional purpose requiring consent must not be introduced under an earlier, narrower analytics permission.
Website launch animation
During the seven-day website launch, a local-storage flag can prevent the welcome animation replaying in the same browser. The flag contains the campaign end time, not a visitor identifier, and is used only for the animation. It ceases to be effective when the campaign ends and is cleared on a subsequent visit. You may skip the animation and remove the flag by clearing this website’s browser data.
Contact and changes
For data-protection questions and rights requests, contact dpo@isbank.ge. General assistance: info@isbank.ge, +995 32 244 22 44. Applicable rights and remedies are explained in the Personal Data Protection Policy; using cookie controls does not restrict them.
We may update this Policy to reflect changes in technology, processing or law. The current version is published here. Where renewed consent is required, the updated optional processing will not rely on an earlier permission. Version: 7 November 2026; effective upon publication.