Privacy Policy · Citty.rent
Privacy Policy
Effective January 1, 2026 · Last updated May 4, 2026
This Privacy Policy explains how LTD City Rent Car (doing business as Citty.rent) collects, uses, and protects the personal information you share with us when you book a car, visit our website, or contact our team.
If you have questions, you can reach our privacy team anytime at privacy@citty.rent.
Who we are
Citty.rent is a car rental company headquartered at Lekh Kachinski 4, Tbilisi, Georgia 0144. We've been renting cars since 2014, and we operate at Tbilisi International Airport (TBS), Kutaisi Airport (KUT), and across Georgia.
For the purposes of GDPR (the EU's General Data Protection Regulation), we're the "data controller" for the information you share with us.
What we collect
When you book a car
- Your full name, date of birth, and citizenship
- A copy of your driver's license and passport (we need these to verify you can legally rent)
- Email, phone number, and your preferred messenger (WhatsApp, Telegram, Viber)
- Flight number, arrival time, and hotel — so we can meet you on time
- Payment details — but here's the thing: we don't store your card number. Payments run through PCI DSS-certified processors. We only see the last four digits and the card brand for our records.
When you use our website
- Your IP address, browser type, and language preference
- Cookies (more on those in our Cookie Policy)
- Anonymized analytics through Google Analytics 4 and Yandex Metrika
- Standard server logs (date, time, page visited, referring site)
Why we collect it
We use your information for these specific purposes:
| What we do | Legal basis (GDPR Art.6) |
|---|---|
| Process your booking and rent you a car | 6(1)(b) — performing a contract |
| Keep tax and accounting records | 6(1)(c) — legal obligation |
| Send you booking confirmations and updates | 6(1)(b) — contract |
| Send promotional emails (only if you opted in) | 6(1)(a) — your consent |
| Improve the website and customer experience | 6(1)(f) — legitimate interest |
| Investigate accidents, damage, or insurance claims | 6(1)(b) and 6(1)(f) |
Who we share it with
We do not sell your personal information. Period. We share it only with parties who help us deliver our service:
- Payment processors (Stripe, our local Georgian banks) — to charge your card securely
- Insurance companies — only when there's a claim to file
- Our hosting provider, Hetzner Online GmbH (based in Germany, EU) — they store our servers, but never see your data in plain form
- Google — anonymized analytics only
- Renteon, our customer relationship management software, to keep track of your bookings
- Government authorities — only if legally required (for example, if there's a serious accident)
All our partners are bound by data processing agreements. They can't use your information for their own purposes.
How long we keep it
- Active customer records: for the duration of your rental, plus 5 years (for tax and any potential disputes)
- Marketing preferences: until you unsubscribe or ask us to delete
- Server logs and analytics: 14 months, then aggregated
Where we store it
Your data lives on servers physically located in Germany (EU), hosted by Hetzner Online GmbH. We don't transfer your data outside the EU unless you initiate it (for instance, by using our service from the US — in that case, your booking confirmation comes back to you).
How we keep it safe
- HTTPS / TLS 1.3 encryption for every connection
- AES-256 disk-level encryption on our database
- Two-factor authentication on every staff account
- Strict "least privilege" access — only the people who need to see your data can
- Encrypted backups, run nightly
- Annual penetration testing by independent security firms
Your rights
Under GDPR (and similar laws like CCPA in California), you have the right to:
- See what data we hold about you
- Get a copy of your data in a portable format (CSV or JSON)
- Correct anything that's wrong
- Delete your data — the so-called "right to be forgotten"
- Limit what we do with it
- Object to certain types of processing (like marketing)
- Withdraw consent any time
- File a complaint with a data protection authority in your country
To exercise any of these, just email privacy@citty.rent. We'll respond within 30 days, free of charge.
Contact our DPO
For privacy questions or concerns:
Data Protection Officer
Email: dpo@citty.rent
Address: LTD City Rent Car, Lekh Kachinski 4, Tbilisi, Georgia 0144
Phone: +995 577 415 777
Changes to this policy
If we make significant changes, we'll let you know — by email if you've given us yours, and through a notice on our website — at least 30 days before the new version takes effect.
Related: Cookie Policy · GDPR Rights · Terms & Conditions