CarBid Privacy and Personal Data Processing Policy (carbid.com.ge)
Version of [dd.mm.yyyy]. Effective from [dd.mm.yyyy]. The website is available in Georgian, Russian and English. In case of discrepancy, the [Georgian] version prevails.
1. About this document
1.1. This Policy explains how personal data of visitors and clients of carbid.com.ge (the "Website") are processed: what we collect, why, on what legal ground, to whom and to which countries data are transferred, how long they are kept and what rights you have.
1.2. The Policy is prepared under the Law of Georgia on Personal Data Protection of 14 June 2023 No. 3144 (in force since 1 March 2024, as amended; the "Law") and provides the information required by Articles 24 and 25 of the Law.
1.3. Since 2 March 2026, compliance with data protection law in Georgia is supervised by the State Audit Office of Georgia (sao.ge), which took over the functions of the abolished Personal Data Protection Service.
2. Who is responsible for your data
2.1. Controller:
| Name | LLC "Georgian Auto Shipping 2025" |
| Identification code | 415119008 |
| Legal address | 101 Davitaia Street, Poti, Georgia |
| Data protection e-mail | g.a.shiping@gmail.com |
| Phone | [phone in Georgia] |
| Personal data protection officer (if appointed) | [name / position and contacts — or delete this row] |
2.2. Website maintenance, server hosting and certain processing operations are carried out on the controller's behalf by International Auto Shipping LLC («Интернейшнл Авто Шиппинг», Vitebsk, Republic of Belarus, UNP 391866860) acting as processor under agreement [date and number of the data processing agreement]. The Website server is located in the Republic of Belarus — see Section 9.
3. Key terms
We use the terms of the Law: data (personal data) — any information relating to an identified or identifiable natural person; processing — any operation performed on data; controller — the person who determines the purposes and means of processing; processor — a person processing data on the controller's behalf; direct marketing — offers sent directly to you by phone, post, e-mail or other channels.
A vehicle VIN does not by itself point to a specific person; when linked to your contact details, we protect it with the same care as personal data.
4. Our approach
- We process data lawfully, fairly and transparently.
- We collect only what a specific feature needs. We do not ask for information unrelated to buying and shipping a car and do not process special categories of data.
- We do not use data for purposes incompatible with the original ones.
- We keep data accurate and delete them when the retention period ends.
- We do not sell data or share them for third-party advertising.
- The lot catalogue and calculator can be used without registration.
5. Data, purposes and legal grounds
Legal grounds refer to Article 5(1) of the Law.
| Process | Data | Purpose | Ground |
|---|---|---|---|
| Registration and account | e-mail, phone (Georgian, Belarusian or Russian format), password hash, name (optional), language, favourites and watchlist, login dates | account management, e-mail verification, password reset, favourites | (b) — contract (user terms) at your request |
| Requests: buy a lot / maximum bid, callback, door-to-door price | name, phone, e-mail, comment, lot, bid, delivery city | handling the request, price calculation, preparing a contract | (j) — reviewing your application; (b) — preparing a contract |
| Vehicle history report order | name, phone, e-mail, VIN, payment details | buying the report from a third-party supplier on your behalf and delivering it to you; only the VIN is sent to the supplier | (b) |
| Bid deposit (guarantee payment) | payer's full name, contacts, amount [GEL/USD], date, payment method, refund details | recording, offsetting and refunding the deposit | (b); (c) and (d) — Georgian tax and accounting requirements |
| Deal and shipping support | purchased vehicle details, shipping stages (auction — US port — ocean freight — Poti port — delivery), photos of the vehicle, consignee details for documents | contract performance, updates in your account | (b) |
| Reviews | name or nickname, city, text, photos | publication on the Website | (a) — separate consent |
| Direct marketing (newsletters) | name, e-mail, phone | lot selections, news, offers | separate optional consent (Art. 5(1)(a), Art. 12) |
| Security | IP address, user agent, request times, login events, anti-bot results, rate-limit counters | protection against intrusion, spam and abuse; data security (Art. 27) | (i) — legitimate interest in Website security; (d) |
| Web analytics | cookie identifiers, pages viewed, referrer, device | statistics and Website improvement | (a) — consent via the cookie banner |
| Data subject requests | data in the request and correspondence | responding | (c), (d) |
5.2. Direct marketing. Consent to newsletters is given by a separate tick box and is not a condition for registration or for handling a request. You can opt out via the link in every message, in your account or by writing to us; we stop within 7 working days at the latest. The fact and date of consent and of its withdrawal are kept for the duration of the marketing and for 1 year after it ends (Art. 12 of the Law).
5.3. Service messages (verification code, password reset, request and shipping status) are not direct marketing.
5.4. Concluding a contract may require additional information (e.g. identity document details for customs clearance). It is defined by the contract and the law and is not collected through the Website's public forms.
5.5. We do not make automated decisions, including profiling, that produce legal effects for you.
6. Sources of data
You provide data yourself (forms, account, correspondence, calls); technical data are generated automatically; shipping statuses and photos come from logistics partners. If you provide another person's data (e.g. a consignee), make sure you are entitled to do so and that the person has read this Policy.
7. Recipients
7.1. Processors (acting on our instructions under contract, Art. 36):
| Processor | Function | Country |
|---|---|---|
| International Auto Shipping LLC | Website development and support, administration, request handling [specify scope] | Republic of Belarus |
| Hosting provider | server, database and backups | Republic of Belarus |
| E-mail service [mail provider] | service e-mails and newsletters | [country] |
| Web analytics service [name] | statistics (only with consent) | [country] |
7.2. Other recipients — only to the extent necessary for the service:
- auction agents and brokers in the USA;
- freight forwarders, ocean carriers, port and terminal operators (including Poti port and, where needed, ports in Lithuania);
- customs brokers and carriers in Georgia;
- banks and payment services;
- vehicle history report supplier — VIN only.
7.3. Staff receive notifications of new requests via Telegram with minimal content: request number, lot, name and phone [or only the request number and a link to the admin panel — see notes].
7.4. Data are disclosed to public authorities only where required by Georgian law.
8. Cookies
| Category | Purpose | Consent | Lifetime |
|---|---|---|---|
| Strictly necessary | session, authentication, form protection, language, selected domain, remembering your banner choice | not required | session — [12] months |
| Analytics [service name] | visit statistics | required | up to [24] months |
On your first visit you can accept or reject analytics cookies; rejecting them does not limit access to the Website. You can change your choice via "Cookie settings" in the footer or in your browser.
9. International transfers
9.1. Data may be transferred outside Georgia under Article 37 of the Law: to states on the list of states with adequate data protection safeguards (approved by a normative act of the Auditor General of Georgia), or where an additional ground applies.
9.2. Where and why:
| Country | Recipient | Purpose | Ground |
|---|---|---|---|
| Republic of Belarus | processor (International Auto Shipping LLC) and hosting provider | Website database, support, request handling | your written (including electronic) consent after being informed of the lack of adequate safeguards (Art. 37(2)(d)) [or: safeguards agreement and State Audit Office permit (Art. 37(2)(b), 37(3)) — permit no. and date] |
| USA | auction agents, brokers, logistics companies | buying the lot and shipping the vehicle | same [check whether the USA is on the current list] |
| Republic of Lithuania (shipping via Klaipėda) | forwarders, port operators | transshipment | listed state with adequate safeguards (Art. 37(1)) |
| [country of Telegram / mail / analytics service] | the relevant service | notifications, e-mails, statistics | consent under Art. 37(2)(d) or listed state — [confirm] |
9.3. Risks. As of this version, Belarus, the USA and certain other states are not on the list of states with adequate safeguards. There may be no independent data protection authority there, your rights may be protected to a lesser extent, and data may become accessible to local authorities on grounds different from those in Georgia. We limit the data transferred, conclude agreements with recipients and apply technical safeguards (Art. 37(4)).
9.4. Without consent to the transfer to Belarus the Website cannot technically process registrations and requests, because its server is located there. As an alternative, you may contact us by phone [phone in Georgia] or at our office at 101 Davitaia Street, Poti, Georgia.
10. Retention
| Data | Period |
|---|---|
| Account, favourites | until the account is deleted; inactive accounts (no login for [3 years]) are deleted after notice |
| Requests without a contract | [3 years] after last contact |
| Report orders | [3 years] |
| Contracts, deposits, payments | as required by Georgian tax and accounting law [check — usually at least 6 years] |
| Shipping statuses and photos | while the account exists, but no longer than [1 year] after delivery; then as part of deal records |
| Reviews | until consent is withdrawn |
| Direct marketing consent and withdrawal records | marketing period + 1 year (Art. 12) |
| Telegram notifications | no more than [30 days] |
| Security logs | [12 months] |
| Anti-bot / rate-limit counters | up to [24 hours] |
| Verification and password reset links | up to [24 hours] |
| Data subject requests | [3 years] |
| Backups | daily, rotated, each copy kept no more than [30 days] |
When the period ends, data are deleted, destroyed or anonymised.
11. Security
We apply organisational and technical measures under Article 27: encrypted connections (HTTPS); passwords stored only as hashes; two-factor authentication and role-based access for staff; protection against brute force and automated attacks; logging of operations on data; daily backups with restricted access; confidentiality agreements with processors; staff training. We notify the State Audit Office of incidents likely to cause significant harm within 72 hours of detection and, where required, inform you (Arts. 29, 30).
12. Your rights
| Right (Article) | What it means | Deadline |
|---|---|---|
| Information (Art. 13) | confirmation of processing, which data, purposes, source, periods, recipients, international transfers | up to 10 working days (extendable by 10 with notice) |
| Access and copies (Art. 14) | see your data and get a copy, normally free of charge | up to 10 working days (+10) |
| Rectification and completion (Art. 15) | correct inaccurate, update and complete incomplete data | up to 10 working days |
| Termination of processing, erasure, destruction (Art. 16) | unless another legal ground applies | up to 10 working days |
| Blocking (Art. 17) | e.g. while accuracy is being checked | decision within 3 working days |
| Portability (Art. 18) | receive data you provided in a machine-readable format or have them sent to another controller | reasonable time |
| Automated decisions (Art. 19) | we do not make such decisions | — |
| Withdrawal of consent (Art. 20) | at any time, without explanation, in the same form in which it was given | up to 10 working days; newsletters — up to 7 working days |
| Appeal (Art. 22) | to the State Audit Office of Georgia or a court | — |
Withdrawal does not affect the lawfulness of processing before it. Before withdrawing, you may ask us about its consequences.
13. How to contact us
13.1. Send your request by any convenient means: to g.a.shiping@gmail.com, by post to 101 Davitaia Street, Poti, Georgia or in person at our office. Consents can also be withdrawn via the "Unsubscribe" link, your account settings or "Cookie settings" in the footer.
13.2. To avoid disclosing data to the wrong person, we may ask you to confirm your identity (e.g. reply from the e-mail registered in your account). We do not ask for unnecessary documents.
13.3. We reply in the form you choose or, if none is specified, in the form in which the request was received.
13.4. You may lodge a complaint with the State Audit Office of Georgia (sao.ge) or a court. We would appreciate the chance to resolve the matter first.
14. Minors
The Website is intended for persons over 18. We do not knowingly collect minors' data and delete such data if received.
15. Changes
The current version is always published on the Website with its effective date. If a change requires new consent, we will ask for it separately.
16. Contacts
LLC "Georgian Auto Shipping 2025", 101 Davitaia Street, Poti, Georgia, g.a.shiping@gmail.com, [phone in Georgia].