Privacy Policy

To process a booking we collect your full name, phone number, email address, the driver's date of birth and driving licence issue date (to check age and driving experience) and booking details (the chosen car, pickup and return dates, price). These details are necessary for a booking: without them we cannot accept it. If you write to our chat assistant on the website or on Telegram, we process the content of your messages and, on Telegram, your Telegram user ID. If you contact us directly through the WhatsApp, Telegram or Instagram buttons on the site, we receive your messages and the account details the app shows us (for example your name, phone number or username, and profile photo). When you use the site, technical data is also processed: your IP address (for security and protection against abuse) and, only with your consent, advertising cookie data (see “Cookies”).

We use your data to process and confirm your booking, to contact you about it, to answer your questions in the chat and in messaging apps (WhatsApp, Telegram, Instagram) and to protect the site against abuse. Only with your consent do we use advertising cookies — to measure how well our ads work and to show our ads to people who have visited the site (see “Cookies”). We do not use your booking details (name, phone number, email) for marketing without your separate consent.

We process your personal data on the following legal bases: to perform the rental contract you request and to take the steps you ask for before it (booking details and your questions in the chat or in messaging apps); to meet our legal and accounting obligations; and for our legitimate interests (protecting the site against fraud and abuse). Advertising cookies are used only with your consent, which you can withdraw at any time through “Cookie settings” at the bottom of every page; withdrawal does not affect the lawfulness of processing carried out before it. These bases correspond to Article 6 of the GDPR, which applies when we offer our services to people in the European Union; at the local level, the Law of Georgia on Personal Data Protection applies.

Your data is stored securely through our database service (Supabase). Access is restricted and limited to authorised personnel only.

We keep your personal data only for as long as necessary to provide the booking and our services. After that, we retain it for the period required by law and accounting rules, including tax and financial obligations. Once those periods expire, the data is deleted or anonymized. Conversations with our chat assistant (bot) on Telegram are deleted automatically 6 months after the last message. Messages you send us directly on WhatsApp, Telegram or Instagram are kept for as long as needed to answer your inquiry and handle your booking, and no longer than 12 months after the last message. We do not store website chat conversations in our database. Cookie lifetimes are listed under “Cookies”.

Our service providers process data on our behalf: Railway (website hosting), Supabase (database), Resend (email), Cloudflare (anti-bot check), Anthropic (the AI chat assistant on the website and on Telegram) and, in the future, TBC (payments). If you write to us on WhatsApp, Instagram or Telegram, that company also processes your messages under its own terms and may store them on servers outside Georgia. With your consent, Google receives advertising cookie data (see “Cookies”). Some of these companies’ servers are located outside Georgia, including in the United States and the European Union. We transfer data only where an adequate level of protection is ensured or appropriate safeguards are in place, such as the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework. Each provider receives only the data needed for its service. You can ask us for information about these safeguards using the contact details below.

We do not sell your data. Our service providers process it on our behalf and only on our instructions (they are listed under “International transfers”). In the future, online payments will be handled by the payment provider TBC, which will receive only the information needed for the payment. If you accept advertising cookies, Google receives data about your visit to the site and uses it as an independent controller under its own privacy policy. We do not pass your booking details (name, phone number, email) to Google. If you write to us on WhatsApp or Instagram (both operated by Meta) or on Telegram, that company also processes your messages as an independent controller under its own privacy policy. We may also disclose data where the law requires it, for example at the request of a court or another public authority.

Essential cookies. The site uses cookies it needs to work: to remember the language and display currency you have chosen, and to remember your cookie choice for 6 months. When enabled, an anti-bot check (Cloudflare Turnstile) is also used. These cookies do not require consent.

Advertising cookies — only with your consent. If you click “Accept” in the cookie banner, the site loads the Google Ads tag. It sets advertising cookies — for example _gcl_au on our domain (kept for 90 days) and Google’s own cookies such as IDE on doubleclick.net (kept for 13 months in the EEA, the UK and Switzerland, and 24 months elsewhere). Through it, Google receives technical data about your visit: the pages you view, your IP address, and information about your browser and device. We use this data to measure how well our ads work and to show our ads to people who have visited the site (remarketing). Google processes this data as an independent controller under its own privacy policy (policies.google.com/privacy). If you click “Reject” or make no choice, the tag is not loaded and no advertising cookies are set.

You can change your choice or withdraw your consent at any time through “Cookie settings” at the bottom of every page. When you withdraw it, we delete the advertising cookies set on our domain; you can delete Google’s own cookies in your browser settings. You can also turn off personalised ads in Google’s My Ad Center (myadcenter.google.com).

You have the right to obtain information about your data and a copy of it; to have it corrected or deleted; to restrict its processing; and to receive the data you gave us in a structured, machine-readable format. Where processing is based on consent, you can withdraw it at any time; for cookies, use “Cookie settings” at the bottom of the page. We do not make decisions about you based solely on automated processing. To exercise your rights, contact us at info@carrentallevano.ge; we will respond without undue delay and within the time limit set by law.

Right to object: you can object at any time to processing based on our legitimate interests. You can object to the use of your data for marketing at any time, without giving reasons.

If you believe that your personal data is being processed in breach of the law, you have the right to lodge a complaint with a supervisory authority. In Georgia this is the Personal Data Protection Service (personaldata.ge). If you are in the European Union, you can also complain to the data protection authority of the country where you live or work, or where the alleged breach took place. You are welcome to contact us first at info@carrentallevano.ge so we can try to resolve the matter quickly.

Data controller: Levano LLC. Email: info@carrentallevano.ge. Phone: +995 555 438 141. Address: 8 Sulkhan Tsintsadze Street, Tbilisi, Georgia.