CARCHECK.GE

1. Introduction

CarCheck ("we", "us", or "our") operates the carcheck.ge website and related services (collectively, the "Platform"). This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our Platform.

We are committed to protecting your privacy and handling your personal data in accordance with the Law of Georgia on Personal Data Protection (adopted June 14, 2023, effective March 1, 2024) and international data protection standards.

Please read this Privacy Policy carefully. By using our Platform, you consent to the collection and processing of your personal data as described herein.

1.1 Data Controller

CarCheck is the data controller responsible for your personal data. If you have questions about this Privacy Policy or our data practices, please contact us:

Email: [email protected]

Address: Tbilisi, Georgia

1.2 Scope

This Privacy Policy applies to all personal data collected through:

• Our website at carcheck.ge.
• Our mobile applications.
• Email, phone, or direct communications with us.
• Third-party platforms where we operate.

2. Legal Basis for Processing

In accordance with Georgian data protection law, we process your personal data based on the following legal grounds:

2.1 Contract Performance

Processing necessary for the performance of a contract with you, including:

• Providing vehicle inspection services.
• Processing payments.
• Delivering VIN data and reports.
• Managing your subscription.

2.2 Consent

Where you have given explicit consent for specific processing activities:

• Marketing communications.
• Cookies and tracking technologies.
• Sharing data with third-party partners.

2.3 Legitimate Interests

Where processing is necessary for our legitimate interests:

• Improving our services.
• Fraud prevention and security.
• Business analytics.

2.4 Legal Obligations

Where processing is required by Georgian law:

• Tax and accounting requirements.
• Responding to legal requests.
• Regulatory compliance.

3. Data We Collect

3.1 Information You Provide

We collect information you directly provide to us:

Account Information:

• Full name.
• Email address.
• Phone number.
• Password (encrypted).
• Language preference.

Business Account Information (additional):

• Company name.
• Tax identification number (TIN).
• Business address.

Vehicle Information:

• VIN (Vehicle Identification Number).
• License plate number.
• Vehicle make, model, and year.
• Vehicle location for inspections.

Payment Information:

• Payment method details (processed by Flitt payment gateway).
• Billing address.
• Transaction history.

Note: CarCheck does not store complete credit card numbers. Payment processing is handled by our PCI DSS Level 1 compliant payment partner.

Communication Data:

• Support ticket contents.
• Chat messages.
• Email correspondence.

3.2 Information Collected Automatically

When you use our Platform, we automatically collect:

Technical Data:

• IP address.
• Browser type and version.
• Device type and operating system.
• Time zone and location.
• Pages visited and navigation patterns.

Usage Data:

• Features used.
• Search queries (VINs searched).
• Interaction with content.
• Service usage patterns.

3.3 Information from Third Parties

We may receive information from:

• Payment processors (transaction status).
• Vehicle data providers (auction history, vehicle reports).
• Georgian PTI.ge (technical inspection dates).
• Social media platforms (if you connect your account).

3.4 Special Categories of Data

We do not intentionally collect special categories of personal data (such as health data, political opinions, religious beliefs, or biometric data). If such data is inadvertently collected, it will be deleted promptly.

4. How We Use Your Data

4.1 Service Delivery

We use your data to:

• Create and manage your account.
• Process and fulfill inspection bookings.
• Provide VIN data and vehicle history reports.
• Manage subscriptions and billing.
• Generate and deliver inspection reports.
• Communicate about your bookings and account.

4.2 Service Improvement

We analyze data to:

• Improve Platform functionality and user experience.
• Develop new features and services.
• Optimize inspection processes.
• Train and improve AI-powered features.

4.3 Communications

We may contact you regarding:

• Booking confirmations and reminders.
• Account security notifications.
• Service updates and changes.
• Marketing communications (with consent).
• Customer support responses.

4.4 Security and Fraud Prevention

We process data to:

• Detect and prevent fraudulent activity.
• Secure accounts and systems.
• Investigate suspicious activity.
• Comply with legal obligations.

5. Data Sharing and Disclosure

5.1 Service Providers

We share data with trusted service providers who assist in operating our Platform:

• Flitt Payment Gateway: Payment processing.
• Firebase (Google): Hosting, authentication, database services.
• Email service providers: Transactional emails.
• Analytics providers: Platform analytics.

All service providers are bound by data processing agreements and may only use data as instructed by us.

5.2 Vehicle Data Providers

To provide VIN data services, we share VINs with:

• auctionsapi.com: US auction history data.
• Vehicle history report providers: Vehicle history reports.

5.3 Legal Requirements

We may disclose data when required by law or to:

• Comply with legal obligations.
• Respond to court orders or legal processes.
• Cooperate with law enforcement.
• Protect our rights, safety, or property.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the new entity. We will notify you of any such transfer.

5.5 With Your Consent

We may share data with third parties when you explicitly consent to such sharing.

5.6 No Sale of Data

CarCheck does not sell your personal data to third parties.

6. Data Retention

6.1 Retention Periods

We retain personal data only as long as necessary for the purposes described in this Privacy Policy:

• Account data: Until account deletion plus 3 years for legal compliance.
• Transaction records: 7 years (Georgian tax law requirement).
• Inspection reports: Indefinitely in our database for historical reference.
• Support communications: 3 years.
• Marketing preferences: Until consent is withdrawn.
• Technical logs: 12 months.

6.2 Anonymized Data

We may retain anonymized or aggregated data indefinitely for statistical and analytical purposes. This data cannot be used to identify individuals.

7. Data Security

7.1 Security Measures

We implement comprehensive security measures including:

Technical Measures:

• TLS/SSL encryption for all data transmission.
• Encryption at rest for sensitive data.
• Secure Firebase infrastructure with EU data residency.
• Regular security audits and updates.
• Access controls and authentication.

Organizational Measures:

• Staff training on data protection.
• Access limited to authorized personnel only.
• Data processing agreements with all vendors.
• Incident response procedures.

7.2 Data Breach Notification

In accordance with Georgian law (Article 28 of the PDPL 2023), in the event of a personal data breach that poses a significant threat to your rights:

• We will notify the Personal Data Protection Service (PDPS) within 72 hours.
• We will notify affected individuals without undue delay.
• We will document all breaches and remediation actions.

8. Your Rights

Under the Law of Georgia on Personal Data Protection, you have the following rights:

8.1 Right to Access

You have the right to request a copy of the personal data we hold about you. We will respond to your request within 10 calendar days.

8.2 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data.

8.3 Right to Erasure

You have the right to request deletion of your personal data when:

• The data is no longer necessary for its original purpose.
• You withdraw consent (where consent was the legal basis).
• The data was processed unlawfully.

Note: We may retain certain data where required by law or legitimate business needs.

8.4 Right to Restriction

You have the right to request restriction of processing in certain circumstances.

8.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format.

8.6 Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes.

8.7 Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond within 10 calendar days as required by Georgian law. You may also file a complaint with the Personal Data Protection Service of Georgia (PDPS).

9. Cookies and Tracking Technologies

9.1 What Are Cookies

Cookies are small text files stored on your device when you visit our Platform. They help us provide and improve our services.

9.2 Types of Cookies We Use

Strictly Necessary Cookies:

Required for the Platform to function (e.g., authentication, security). Cannot be disabled.

Functional Cookies:

Remember your preferences (e.g., language, theme).

Analytics Cookies:

Help us understand how visitors use our Platform (e.g., Firebase Analytics).

Marketing Cookies:

Used for targeted advertising (only with your consent).

9.3 Managing Cookies

You can manage cookie preferences through:

• Our cookie consent banner.
• Your browser settings.
• Our account settings (for logged-in users).

10. International Data Transfers

10.1 Data Location

Your personal data is primarily stored on Firebase servers in the EU (europe-west3, Frankfurt), which provides adequate protection under Georgian law.

10.2 Third-Country Transfers

Some data may be transferred to countries outside Georgia for processing by our service providers (e.g., US-based vehicle data providers). Such transfers are made in compliance with Georgian law, ensuring adequate protection through:

• Standard contractual clauses.
• Privacy Shield certification (where applicable).
• Adequacy decisions.

11. Children's Privacy

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we discover that we have collected data from a child, we will delete it promptly.

12. Marketing Communications

12.1 Marketing Consent

In accordance with Georgian law, we only send marketing communications with your explicit consent. Consent is obtained separately from service agreements.

12.2 Opting Out

You can opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email.
• Updating your preferences in account settings.
• Contacting us at [email protected].

Note: You will continue to receive transactional communications related to your account and bookings.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes:

• We will post the updated policy on our Platform.
• We will update the "Last Updated" date.
• We will notify you by email for significant changes.

Your continued use of our Services after changes constitutes acceptance of the updated Privacy Policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

14.1 Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

15. Acknowledgment

BY USING CARCHECK SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ THIS PRIVACY POLICY, UNDERSTAND HOW WE COLLECT AND PROCESS YOUR PERSONAL DATA, AND CONSENT TO SUCH PROCESSING AS DESCRIBED HEREIN.