Privacy Policy
Last updated: September 2, 2026
1. Introduction
"CARENT GEORGIA" LLC (ID: 405841905) ("CARENT," "we," "our," or "us") respects your privacy and is committed to protecting the personal data of everyone who uses our peer-to-peer car rental marketplace at carent.ge and our related mobile applications (together, the "Platform"). This Privacy Policy explains what personal data we collect, why we collect it, the legal grounds we rely on, who we share it with, how long we keep it, and the rights available to you under Georgian law.
This Policy applies to all Hosts, Renters, and visitors to the Platform. It should be read together with our Terms of Service. By creating an account or otherwise using the Platform, you acknowledge that your personal data will be processed as described in this Policy.
2. Who We Are — Data Controller
"CARENT GEORGIA" LLC is a limited liability company organised under the legislation of Georgia, with its registered address at Apt N5, N13 Dimitri Arakishvili st., Tbilisi, Georgia. For the purposes of the Data Protection Law, CARENT acts as the data controller for personal data processed through the Platform — that is, CARENT determines the purposes and means of processing your personal data, except where we identify a service provider as acting in a different capacity (see Section 7).
Controller Information
• Controller — "CARENT GEORGIA" LLC
• Registered address — Apt N5, N13 Dimitri Arakishvili st., Tbilisi, Georgia
• Contact for data protection matters — support@carent.ge
• Supervisory authority — Personal Data Protection Service of Georgia (personaldata.ge)
Where CARENT processes a large volume of data subjects' data (at least 3% of the population of Georgia) or engages in systematic large-scale monitoring, or otherwise falls within a category designated by the Data Protection Law, we will appoint a Data Protection Officer ("DPO") and publish their contact details in this section. Where no such threshold is met, data protection enquiries should be directed to support@carent.ge.
3. Scope and Key Definitions
This Policy applies to personal data processed in connection with the Platform, regardless of the device or channel used to access it. It does not apply to third-party websites or services that CARENT does not control, even where linked from the Platform.
• Personal data — Any information relating to an identified or identifiable natural person (a data subject).
• Special category data — Data revealing racial or ethnic origin, biometric or genetic data used for identification, health data, and similar categories requiring heightened protection under Article 6 of the Data Protection Law.
• Processing — Any operation performed on personal data, including collection, recording, storage, use, disclosure, and destruction.
• Controller — The person who determines the purposes and means of processing personal data (CARENT, in most cases described here).
• Processor — A person who processes personal data on behalf of, and under the instructions of, a controller (for example, our verification and payment providers).
• Data subject — The individual to whom personal data relates — i.e., you.
4. What Personal Data We Collect
4.1 Account and Registration Data
• Full name
• Email address
• Phone number
• Date of birth
• Password (stored in encrypted/hashed form)
4.2 Identity Verification Data (Special Category Data)
To comply with our verification-first policy and to keep the Platform safe, we collect and process:
• A copy of a government-issued ID document (national ID card or passport);
• A driving licence (for Renters, and for Hosts who intend to drive listed vehicles);
• Facial biometric data captured during a liveness check, used solely to match your face to your ID document and confirm you are a real, present individual.
Because facial biometric data used for identification purposes is a special category of data under Article 6 of the Data Protection Law, we collect it only with your explicit, written (including electronic) consent, obtained before verification begins, and we do not use it for any purpose beyond identity verification and fraud prevention. Identity verification is mandatory before you can book or list a vehicle; if you do not wish to provide this data, you will not be able to access those specific features, though you may still browse the Platform. Verification data is processed on our behalf by Sumsub, acting as our data processor, under a data processing agreement and in accordance with Sumsub's own privacy policy.
We never disclose your ID document images, driving licence images, or biometric data to another User of the Platform. See Section 7.2 for what we may disclose between Users.
4.3 Vehicle and Listing Data (Hosts)
• Vehicle make, model, year, and licence plate number;
• Vehicle registration certificate;
• Vehicle photographs uploaded to the Listing by the Host;
• Pricing, availability, and Security Deposit information displayed on the Listing;
• Information concerning the status and validity of the vehicle's technical inspection;
• Information obtained or verified from official, authorised, or other legally permissible sources for the purpose of verifying the vehicle's eligibility for listing.
4.4 Booking and Transaction Data
• Booking details (dates, vehicle, duration, pick-up/drop-off location);
• Payment information, processed securely through our payment service provider — CARENT does not store full card numbers;
• Transaction history, invoices, and payout records for amounts processed through the Payment System.
Vehicle hand-over and return are conducted directly between the Host and the Renter, and Security Deposits and other amounts arising from a Trip are settled directly between them, as described in the Terms of Service and the Rental Terms & Conditions. We therefore do not collect or hold hand-over or return records, vehicle condition reports, Security Deposit records, or records of any payment made directly between a Host and a Renter.
4.5 Usage and Technical Data
• IP address and approximate location;
• Browser type, device type, and operating system;
• Pages visited and actions taken on the Platform;
• Session duration and frequency of use;
• Cookies and similar tracking technologies (see Section 13).
4.6 Communications Data
• Messages exchanged between Hosts and Renters through the Platform's messaging system;
• Support requests and correspondence with CARENT;
• Ratings and reviews submitted on the Platform.
5. Why We Process Your Data
• Account creation and management
• Identity verification
• Booking and transaction processing
• Payment processing
• Platform safety and fraud prevention
• Customer support
• Legal compliance
• Platform improvement
• Communications
• Vehicle eligibility and technical inspection verification
• Providing a Host or a Renter with the Booking records they need to establish, exercise, or defend a legal claim against the other party, or to support an insurance claim, a police report, or legal proceedings (see Section 7.2)
6. Legal Basis for Processing
Article 4 and Article 5 of the Data Protection Law require every processing activity to rest on an identified legal basis. We rely on the following:
• Contract performance — processing necessary to create your account, manage a Booking, or otherwise perform the Terms of Service to which you are a party. This includes processing vehicle and Listing information necessary to determine whether a Host and the listed vehicle satisfy the requirements for creating and maintaining a Listing.
• Legal obligation — processing required to comply with Georgian legislation, including tax, accounting, anti-money-laundering, and consumer-protection rules. This may include processing vehicle and technical inspection information where necessary to comply with applicable legal and regulatory requirements, and disclosing data in response to a valid request from a competent authority.
• Legitimate interests — processing that serves CARENT's legitimate business interests, or those of another party, where those interests are not overridden by your rights and freedoms as a data subject. This includes platform safety, fraud prevention, and service improvement, and the disclosure described in Section 7.2, which serves the legitimate interest of a Host or a Renter in establishing, exercising, or defending a legal claim arising from a Trip, and CARENT's own legitimate interest in a Platform on which such claims can be resolved lawfully.
• Consent — relied upon for specific, optional processing activities such as marketing communications, non-essential cookies, and the collection of biometric data described in Section 4.2, and which you may withdraw at any time as described in Section 10.
Where we process special category data (Section 4.2), we additionally rely on, and are able to demonstrate, your explicit written consent as required by Article 6 of the Data Protection Law.
7. How We Share Your Data
We do not sell your personal data. We share personal data only as described below, and, where a recipient acts as our processor, under a written data processing agreement that requires the recipient to process data only on our documented instructions and to apply appropriate security measures.
7.1 Other Platform Users
Limited profile information (such as first name, profile photo, and ratings) is visible to other Users to facilitate trust and safe transactions. Once a Booking is confirmed, the Host and the Renter are given the contact details necessary to arrange hand-over and return, and may exchange further details between themselves as needed to complete the Booking.
7.2 Disclosure Between a Host and a Renter in Connection with a Dispute or Claim
Vehicle hand-over and return, Security Deposits, and claims for damage, cleaning, fuel, mileage, fines, and similar amounts are settled directly between the Host and the Renter, as described in the Terms of Service and the Rental Terms & Conditions. CARENT is not a party to those arrangements and does not adjudicate them.
Where a dispute arises between a Host and a Renter concerning a Trip, or where one of them requires information to support an insurance claim, a report to the Patrol Police of Georgia, or legal proceedings, we may disclose to the requesting party the records we hold in relation to the relevant Booking. Depending on the request, these may include:
• Confirmation that a Booking was made, and its status, dates, and times;
• Confirmation that the other party completed identity verification, and the date on which it was completed;
• The other party's full name, and their identification and contact details;
• The Listing and vehicle details as supplied by the Host, including the registration plate and the Security Deposit amount displayed at the time of Booking;
• The technical inspection verification status recorded by CARENT for the vehicle at the relevant time, and the source of that verification;
• Photographs and other Listing content uploaded by the Host;
• Messages exchanged between the parties through the Platform;
• Records of amounts processed through the Payment System in connection with the Booking.
We apply the following safeguards to any such disclosure:
• We disclose only the data that is necessary and proportionate for the stated purpose, and we ask the requesting party to explain that purpose;
• We do not disclose ID document images, driving licence images, biometric data, payment card data, or bank account details to another User;
• We may decline a request that is unlawful, disproportionate, abusive, or unsupported, or where disclosure would breach the Data Protection Law or another applicable law;
• Where practicable and where not prohibited by law, we will inform you that your data has been disclosed under this Section;
• Data disclosed under this Section may be used by the recipient only for the purpose for which it was provided. The recipient becomes an independent controller of that data and is responsible for its lawful handling;
• Your rights under Section 10 continue to apply, including the right to object to processing carried out on the basis of legitimate interests.
This Section describes disclosure between Users. It does not limit our separate obligation to disclose data to competent authorities under Section 7.5.
7.3 Verification Provider — Sumsub
We use Sumsub to perform identity and document verification, including the biometric liveness check described in Section 4.2. Sumsub acts as our data processor and processes your data under a data processing agreement and its own privacy policy, which we encourage you to review.
7.4 Payment Service Provider
Payment data is processed by our licensed payment service provider. CARENT does not store full card details; relevant transaction data is shared with the payment provider only as necessary to execute, record, and reconcile transactions.
7.5 Legal and Regulatory Authorities
We may disclose personal data to the Personal Data Protection Service of Georgia, courts, law enforcement, tax authorities, or other competent Georgian authorities where required by law, in response to a valid legal request, or where necessary to protect the safety, rights, or property of a User or the Platform.
7.6 Other Service Providers
We engage service providers for functions such as cloud hosting, analytics, customer support tooling, and email/SMS delivery. These providers process personal data on our behalf, under a data processing agreement, and are contractually prohibited from using your data for their own purposes.
7.7 Business Transfers
If CARENT is involved in a merger, acquisition, restructuring, or sale of assets, personal data may be transferred to the successor entity, subject to that entity continuing to honour the commitments made in this Policy or providing you with notice of any material change.
8. International Data Transfers
Some of our service providers, including Sumsub and certain cloud infrastructure or analytics providers, may process personal data outside Georgia. Where we transfer personal data internationally, we ensure an adequate level of protection through one or more of the following safeguards, consistent with the cross-border transfer requirements of the Data Protection Law:
• Transferring data to a country recognised as providing an adequate level of data protection;
• Entering into contractual clauses with the recipient that impose data protection obligations equivalent to those under Georgian law; or
• Relying on your explicit consent for the specific transfer, where no other safeguard is available.
You may contact us at support@carent.ge for further information about the safeguards applicable to a specific transfer.
9. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, taking into account legal, accounting, and reporting requirements. Indicative retention periods are:
• Account data — For the duration of your account, and for a reasonable period after closure to handle residual claims or legal requirements
• Identity verification data — For the period required by our verification and anti-money-laundering obligations under Georgian law, after which it is deleted or anonymised
• Transaction and booking data — A minimum of 5 years, to comply with financial and tax record-keeping requirements
• Support and communications data — Up to 3 years after your last interaction with us
• Cookie and analytics data — As set out in our cookie settings, typically no longer than 24 months
Where a Booking is the subject of a dispute, an insurance claim, or legal proceedings of which we are aware, we may retain the related Booking records for as long as necessary for the establishment, exercise, or defence of that claim.
Where data is no longer required for these purposes, we securely delete it.
10. Your Rights as a Data Subject
Under the Data Protection Law, you have the following rights in relation to your personal data:
• Right of access — to request confirmation of whether we process your data and to obtain a copy of it, including information about any disclosure of it;
• Right to rectification — to request correction of inaccurate or incomplete data;
• Right to erasure — to request deletion of your data, subject to our legal retention obligations;
• Right to restriction — to request that we limit how we process your data in specified circumstances, including while a rectification or objection request is being reviewed;
• Right to data portability — to receive personal data you provided to us in a structured, commonly used, machine-readable format, or to have it transmitted to another controller where technically feasible;
• Right to termination of processing — to object to processing carried out on the basis of legitimate interests, including profiling and the disclosure described in Section 7.2, on grounds relating to your particular situation;
• Right to withdraw consent — where processing is based on consent, to withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal;
• Right to request data blocking during an appeal — to request that your data be temporarily blocked from further processing while a complaint about a rights violation is under review;
• Right to lodge a complaint — to file a complaint with the Personal Data Protection Service of Georgia (personaldata.ge), or to apply to a Georgian court, if you consider that your rights have been violated.
To exercise any of these rights, please contact us at support@carent.ge. We may need to verify your identity before actioning a request. We aim to respond within the timeframes required by the Data Protection Law (10 working days for access/rectification/erasure/information requests, extendable by 10 more; 3 working days for blocking decisions) and, in any event, without undue delay.
11. Direct Marketing
We will only use your data for direct marketing purposes with your consent. Before requesting that consent, and in every marketing message we send, we will inform you of your right to withdraw consent and provide a simple, accessible way to do so (for example, an "unsubscribe" link). Where you ask us to stop, we will cease processing your data for direct marketing promptly, and in any event within seven working days.
12. Automated Decision-Making
We may use automated tools to support identity verification (for example, matching a selfie to an ID photo) and fraud detection (for example, flagging suspicious booking patterns). Automated outputs that could significantly affect you (such as a verification failure or account suspension) are reviewed by a human before a final decision is taken, and you may contact support@carent.ge to request a manual review or to express your point of view.
13. Cookies and Tracking Technologies
CARENT uses cookies and similar technologies to operate and improve the Platform:
• Essential cookies — required for core functionality such as login sessions and security, and which cannot be switched off;
• Functional cookies — used to remember your preferences and settings;
• Analytics cookies — used to understand how Users interact with the Platform so that we can improve it.
Where analytics or functional cookies are not strictly necessary for the Platform to operate, we will request your consent before placing them, and you may withdraw that consent at any time through your cookie settings or browser controls. Disabling essential cookies may affect Platform functionality.
14. Data Security
We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, or disclosure, including encrypted data transmission (HTTPS/TLS), access controls and role-based permissions, encryption of stored credentials, and regular review of our security practices. No system can be guaranteed entirely secure, and we cannot guarantee absolute security of information transmitted to the Platform.
15. Data Breach Notification
We maintain an internal register of security incidents affecting personal data, regardless of whether external notification is required. Where an incident is likely to cause significant harm or pose a significant threat to the rights and freedoms of data subjects, we will notify the Personal Data Protection Service of Georgia in writing, no later than 72 hours after we become aware of the incident, in accordance with the incident-notification provisions of the Data Protection Law. Where an incident is likely to result in a high risk to your rights and freedoms, we will also inform affected Users directly, describing the nature of the incident, its likely consequences, and the measures taken or proposed to address it, unless direct notification is impractical (in which case we will use public communication) or would compromise state or public security.
16. Children's Data
The Platform is intended for use by individuals who meet the eligibility requirements set out in our Terms of Service (currently, a minimum age of 18). We do not knowingly collect personal data from individuals who do not meet these age requirements. Separately, under Article 7 of the Data Protection Law, the processing of a minor's data on the basis of consent generally requires the minor to be at least 16 years of age, or, where the minor is younger, the consent of a parent or legal representative. If you believe a minor has created an account on CARENT in violation of our eligibility requirements, please contact support@carent.ge and we will take steps to review and, where appropriate, remove the account and associated data.
17. Your Choices
In addition to the rights listed in Section 10, you can manage certain preferences directly: update your account information at any time through your profile settings; control cookie preferences through your browser or our cookie banner; and opt out of non-essential marketing communications using the unsubscribe mechanism included in each message.
18. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, our service providers, or applicable law. When we make a material change, we will update the "Last updated" date at the top of this document and notify you through the Platform or by email where required by law. We encourage you to review this Policy periodically. Continued use of the Platform after a change takes effect constitutes your acknowledgement of the revised Policy.
19. Contact Us and Complaints
If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:
Email: support@carent.ge
Website: carent.ge
If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Service of Georgia:
Website: personaldata.ge
CARENT is committed to handling your personal data with care, transparency, and respect, in accordance with the Law of Georgia on Personal Data Protection.