Privacy Policy · Citty.rent

Privacy Policy

Effective January 1, 2026 · Last updated May 4, 2026

This Privacy Policy explains how LTD City Rent Car (doing business as Citty.rent) collects, uses, and protects the personal information you share with us when you book a car, visit our website, or contact our team.

If you have questions, you can reach our privacy team anytime at privacy@citty.rent.

Who we are

Citty.rent is a car rental company headquartered at Lekh Kachinski 4, Tbilisi, Georgia 0144. We've been renting cars since 2014, and we operate at Tbilisi International Airport (TBS), Kutaisi Airport (KUT), and across Georgia.

For the purposes of GDPR (the EU's General Data Protection Regulation), we're the "data controller" for the information you share with us.

What we collect

When you book a car

  • Your full name, date of birth, and citizenship
  • A copy of your driver's license and passport (we need these to verify you can legally rent)
  • Email, phone number, and your preferred messenger (WhatsApp, Telegram, Viber)
  • Flight number, arrival time, and hotel — so we can meet you on time
  • Payment details — but here's the thing: we don't store your card number. Payments run through PCI DSS-certified processors. We only see the last four digits and the card brand for our records.

When you use our website

  • Your IP address, browser type, and language preference
  • Cookies (more on those in our Cookie Policy)
  • Anonymized analytics through Google Analytics 4 and Yandex Metrika
  • Standard server logs (date, time, page visited, referring site)

Why we collect it

We use your information for these specific purposes:

What we doLegal basis (GDPR Art.6)
Process your booking and rent you a car6(1)(b) — performing a contract
Keep tax and accounting records6(1)(c) — legal obligation
Send you booking confirmations and updates6(1)(b) — contract
Send promotional emails (only if you opted in)6(1)(a) — your consent
Improve the website and customer experience6(1)(f) — legitimate interest
Investigate accidents, damage, or insurance claims6(1)(b) and 6(1)(f)

Who we share it with

We do not sell your personal information. Period. We share it only with parties who help us deliver our service:

  • Payment processors (Stripe, our local Georgian banks) — to charge your card securely
  • Insurance companies — only when there's a claim to file
  • Our hosting provider, Hetzner Online GmbH (based in Germany, EU) — they store our servers, but never see your data in plain form
  • Google — anonymized analytics only
  • Renteon, our customer relationship management software, to keep track of your bookings
  • Government authorities — only if legally required (for example, if there's a serious accident)

All our partners are bound by data processing agreements. They can't use your information for their own purposes.

How long we keep it

  • Active customer records: for the duration of your rental, plus 5 years (for tax and any potential disputes)
  • Marketing preferences: until you unsubscribe or ask us to delete
  • Server logs and analytics: 14 months, then aggregated

Where we store it

Your data lives on servers physically located in Germany (EU), hosted by Hetzner Online GmbH. We don't transfer your data outside the EU unless you initiate it (for instance, by using our service from the US — in that case, your booking confirmation comes back to you).

How we keep it safe

  • HTTPS / TLS 1.3 encryption for every connection
  • AES-256 disk-level encryption on our database
  • Two-factor authentication on every staff account
  • Strict "least privilege" access — only the people who need to see your data can
  • Encrypted backups, run nightly
  • Annual penetration testing by independent security firms

Your rights

Under GDPR (and similar laws like CCPA in California), you have the right to:

  • See what data we hold about you
  • Get a copy of your data in a portable format (CSV or JSON)
  • Correct anything that's wrong
  • Delete your data — the so-called "right to be forgotten"
  • Limit what we do with it
  • Object to certain types of processing (like marketing)
  • Withdraw consent any time
  • File a complaint with a data protection authority in your country

To exercise any of these, just email privacy@citty.rent. We'll respond within 30 days, free of charge.

Contact our DPO

For privacy questions or concerns:

Data Protection Officer
Email: dpo@citty.rent
Address: LTD City Rent Car, Lekh Kachinski 4, Tbilisi, Georgia 0144
Phone: +995 577 415 777

Changes to this policy

If we make significant changes, we'll let you know — by email if you've given us yours, and through a notice on our website — at least 30 days before the new version takes effect.

Related: Cookie Policy · GDPR Rights · Terms & Conditions