Privacy Policy

CarRentRight

Last updated: 22-04-2026

1. Introduction

Carentright OÜ, operating the Carentright / CarRentRight / CRR platform (“Carentright”, “CarRentRight”, “CRR”, “we”, “our”, or “us”), respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose, and protect personal data when you:

visit our website;
interact with our landing pages and public content;
start a case through our platform;
submit a complaint or claim;
upload documents or other supporting information;
communicate with us or with service channels connected to our platform.

Carentright operates a structured consumer-enforcement platform that supports claims and complaints through intake, evaluation, mediation, and, where appropriate, referral to independent legal partners. Personal data is processed in line with that operational model.

We process personal data in accordance with applicable data protection law, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable privacy and electronic communications laws.

2. Data Controller

The data controller responsible for the processing of personal data under this Privacy Policy is:

Carentright OÜ
Registry code: 17481848
Registered address: Harju maakond, Tallinn, Lasnamäe linnaosa, Ruunaoja tn 3, 11415, Estonia
General contact email: support@carentright.com

For privacy-related requests, you may contact us at:

privacy@carentright.com

3. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed through:

the Carentright website;
case intake forms and conversational intake tools;
complaint and claim submission workflows;
dashboard and account access features;
communications sent by or to Carentright in relation to a case;
analytics, security, and service-improvement processes connected to the platform.

This Privacy Policy does not govern the privacy practices of independent third-party websites, law firms, payment providers, or other third parties that may be linked to or interact with the platform.

4. Personal Data We Collect

We may collect and process the following categories of personal data.

4.1 Website and Device Data

When you visit our website, we may automatically collect technical and usage data such as:

IP address;
browser type and version;
device type;
operating system;
language settings;
referring URL;
pages visited;
date and time of access;
session and navigation data;
security and diagnostic logs.

4.2 Identity and Contact Data

When you interact with our platform, create an account, or contact us, we may collect:

first name and last name;
email address;
phone number;
postal address;
account identifiers;
login and authentication data.

4.3 Case Data

If you start a case, submit a complaint, or submit a claim, we may collect:

company name;
country, city, airport, or rental branch details;
rental dates;
reservation or contract number;
narrative description of what happened;
prior actions taken with the company;
claimed amount and currency, where relevant;
desired outcome;
case classification data;
issue categories and related case metadata.

This reflects the platform’s structured intake and evaluation model.

4.4 Evidence and Supporting Documents

You may provide supporting materials such as:

booking confirmations;
rental agreements;
invoices and receipts;
payment proofs;
charge notices;
screenshots;
emails or messages;
photos or videos;
damage reports;
other documents related to the case.

4.5 Communications Data

We may process communications between:

you and Carentright;
you and companies, where shared with us;
Carentright and companies on your behalf where authorized;
Carentright and legal partners where escalation is separately authorized.

4.6 Consent and Legal-Log Data

Where acceptance, mandate, or acknowledgment is required, we may store:

consent timestamp;
IP address;
user or session identifier;
document version accepted;
related audit and logging metadata.

CRR’s product architecture requires consent logging and auditability at key stages of case intake and legal authorization.

5. Sources of Personal Data

We obtain personal data:

directly from you;
from documents and information you upload;
from communications you provide;
from public-facing website usage;
from third parties where you instruct or authorize sharing;
from legal or operational partners where relevant and lawful.

6. Legal Bases for Processing

We process personal data on one or more of the following legal bases.

6.1 Consent

We process certain personal data on the basis of your consent, including where you:

accept the Privacy Policy or other legal notices;
submit information voluntarily;
authorize case intake or complaint publication uses;
consent to optional communications or specific disclosures.

6.2 Performance of a Contract or Pre-Contractual Steps

We process personal data where necessary to:

allow you to start a case;
structure and evaluate your submission;
manage your account;
provide services requested by you;
communicate regarding your case or requested service.

6.3 Legitimate Interests

We may process data where necessary for our legitimate interests, including to:

operate, secure, and improve the platform;
prevent misuse, fraud, or abuse;
maintain auditability and legal defensibility of actions taken;
analyze platform performance and service quality;
structure complaints and claims efficiently;
maintain records relevant to disputes, claims, or complaints.

6.4 Compliance with Legal Obligations

We may process and disclose personal data where necessary to comply with legal, regulatory, tax, accounting, or court-related obligations.

7. How We Use Personal Data

We may use personal data to:

operate and maintain the website and platform;
allow users to start and manage cases;
structure, classify, and evaluate complaints and claims;
request additional information or documents;
communicate with companies where authorized;
coordinate mediation-related actions;
maintain user dashboards and outcome records;
provide customer support;
improve our products, workflows, and documentation;
comply with legal obligations;
protect our legal rights and those of users or third parties.

8. AI-Assisted Processing

Carentright uses automated tools, including artificial intelligence, to help structure user-submitted case information.

These tools may be used to:

organize free-text narratives into structured case summaries;
identify missing information;
classify case type and issue type;
support evidence mapping and case-readiness checks;
improve workflow efficiency.

CRR’s documented AI architecture makes clear that the AI assists intake and structuring, but does not provide legal advice, does not make final decisions, and does not guarantee outcomes.

Automated tools are used to support operations and human review. They do not independently decide whether you will receive compensation, succeed in mediation, or proceed to legal escalation.

9. Complaint Publication, Reporting, and Platform Transparency

Carentright may use complaint-related and outcome-related data to support transparency and accountability functions of the platform.

Depending on the service and permissions involved, this may include:

anonymized or aggregated complaint statistics;
company-level patterns and reporting;
public rankings, summaries, or transparency indicators;
internal reporting and pattern detection;
aggregated complaint or outcome metrics.

CRR’s platform design and complaints-service logic rely on pattern detection, clustering, and structured outcome logging to improve accountability and public awareness.

Where content is used for publication, reporting, or ranking purposes, we take steps to avoid public disclosure of personal identifying information unless a lawful and explicit basis exists.

10. Data Sharing

We may share personal data where necessary and lawful with:

10.1 Service Providers

Providers assisting with:

hosting and infrastructure;
document storage;
analytics;
security monitoring;
email or communication services;
customer support tools;
authentication and account services.

10.2 Companies Involved in a Case

Where you have authorized us to act in relation to a claim or complaint, relevant information may be shared with the company involved for evaluation, communication, mediation, or resolution purposes.

10.3 Legal Partners

Where separate authorization exists and escalation is appropriate, data may be shared with independent legal partners or law firms.

10.4 Authorities and Courts

We may disclose data where required by law, court order, or lawful request from competent authorities.

We do not sell personal data.

11. International Data Transfers

Your personal data may be processed in countries outside your country of residence, including outside the European Economic Area where relevant service providers are involved.

Where such transfers occur, we will take appropriate safeguards, which may include:

European Commission adequacy decisions;
Standard Contractual Clauses;
contractual, technical, and organizational protections.

12. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, including to operate the platform, provide requested services, maintain records, and comply with legal obligations.

Retention periods may vary by category of data. For example:

website and technical logs may be retained for security, diagnostics, and operational integrity;
account data may be retained while the account remains active and for a reasonable period thereafter;
case files, uploaded evidence, communications, and outcome records may be retained for longer periods where necessary for dispute handling, legal defense, compliance, audit, or pattern analysis;
abandoned or incomplete case-intake data may be retained where needed to defend against disputes, ensure auditability, and support operational recordkeeping.

CRR’s legal architecture explicitly relies on retaining intake and consent records so incomplete or abandoned claims can be documented and defended against later disputes.

13. Data Security

We implement appropriate technical and organizational measures to protect personal data, including measures such as:

access controls;
encrypted transmission where appropriate;
secure storage systems;
audit logging;
restricted internal access;
monitoring for abuse, misuse, and unauthorized access.

No method of transmission or storage is completely secure. However, we take reasonable steps appropriate to the nature of the data and the platform.

14. Your Rights

Subject to applicable law, you may have the right to:

request access to your personal data;
request rectification of inaccurate data;
request deletion of personal data;
request restriction of processing;
object to certain processing;
request data portability;
withdraw consent where processing is based on consent.

To exercise these rights, contact:

privacy@carentright.com

You may also have the right to lodge a complaint with a competent data protection authority.

15. Children

The platform is not intended for children, and we do not knowingly collect personal data from children in connection with our services. If we become aware that personal data from a child has been collected inappropriately, we will take reasonable steps to delete it.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, operational, or product changes.

When significant changes are made, the updated version will be posted on this page with a revised “Last updated” date.

17. Contact

For general questions, you may contact:

Carentright OÜ
Harju maakond, Tallinn, Lasnamäe linnaosa, Ruunaoja tn 3, 11415, Estonia
support@carentright.com