Privacy Policy

This Privacy Policy explains how personal data is processed when you use the Kari website at kari.rent and its subdomains (the Service). It is the information we provide to data subjects under Articles 24 and 25 of the Law of Georgia "On Personal Data Protection" of 14 June 2023 (the Law).

The English version of this Policy prevails. The Russian and Georgian versions are translations provided for convenience.

1. Who is responsible for your data

The controller of your personal data is Pavel Ilin, an individual entrepreneur registered in Georgia, identification number 345667655, address: Tamar Mefe Avenue 22a, flat 143, Batumi, Georgia (Kari, we, us).

For any question about your personal data, or to exercise your rights, write to support@kari.rent. At the date of this Policy we are not required to appoint a personal data protection officer under Article 33 of the Law. If we appoint one, their contact details will be published here.

2. What data we process, why, and on what basis

2.1. Visiting the Service. When you open any page, our hosting provider records technical data in server logs: IP address, browser and device type, the page requested, the date and time, and the response. We use it to deliver the website, keep it secure and fix errors. Legal basis: our legitimate interest in operating a secure website (Article 5(1)(i) of the Law). Server logs are kept for no longer than 30 days.

When a page shows a map, your browser loads map images directly from Esri (ArcGIS). Photos of some sample listings are loaded directly from Unsplash. These providers receive your IP address and browser data and process them under their own privacy policies. We do not use analytics, advertising or tracking tools.

2.2. Account. You sign in with Google or Apple through Google Firebase Authentication. We receive and store your name, email address (for Apple, this may be a relay address if you chose to hide your email), profile photo link, the sign-in method, your Firebase user identifier and the dates you signed up and last signed in. We also record which version of the Terms of Use you accepted and when. We use this data to create and maintain your account and to link your applications, listings and requests to you. Legal basis: performance of the contract with you, i.e. the Terms of Use (Article 5(1)(b)). We do not receive your Google or Apple password.

2.3. Profile. To request a viewing or to list a property you fill in a profile.

• For everyone: languages you speak, preferred ways to contact you and the contact details you enter (phone, messengers, email), and an optional short text about yourself.
• For tenants: citizenship, number of adults, number and ages of children, pets (kind and, for dogs, size), whether you smoke, occupation, residency status, desired move-in date, rental term, and whether you need a registered lease.
• For owners: where you live, who handles day-to-day issues, preferred payment method and currency, contract preferences, and the hours when you are available to be contacted.

We use the profile so that owners and tenants can understand each other before a viewing, and to warn you when a listing's conditions (children, pets) do not match your profile. Legal basis: performance of the contract (Article 5(1)(b)). Fields marked as required are needed to use these features; without them you cannot request a viewing or list a property. Please do not include in free-text fields information about health, religion, ethnic origin or other special categories of data: we do not need it.

2.4. Viewing requests. When you request a viewing we process your name, the contact you provide, the preferred date, the rental term, your message, the request status and a link to your account and profile. We pass this information, together with your tenant profile, to the owner of the listing (or to the person managing it under a power of attorney) so they can contact you. Legal basis: performance of the contract (Article 5(1)(b)).

2.5. Listing a property and owner verification. To publish a listing as a verified owner, we process:

• identity data: full name, personal number (or, if you do not have a Georgian personal number, the passport number under which you are recorded in the Public Registry), phone, email and your role (owner or representative acting under a power of attorney);
• property data: the cadastral code and data from the Public Registry for it (owners' names and personal numbers, area, co-ownership, mortgages, seizures and other encumbrances), and any registry extract or power of attorney you upload;
• the result of the automatic comparison of your data with the registry data, and notes made by our moderators;
• listing content: title, description, address (street, district, city and map location), number of rooms, area, floor, price, rental conditions (children, pets, payment scheme, deposit) and photos.

We use this data to confirm that the person listing the property is its owner or is authorised by the owner, to prevent fraudulent listings and to publish the listing. Legal bases: performance of the contract (Article 5(1)(b)); our legitimate interest, and that of tenants, in preventing fraud on the platform (Article 5(1)(i)); and, for Public Registry data, the fact that it is publicly available (Article 5(1)(e)).

Once a listing is published, the following is visible to everyone: your first name and the initial of your surname; if you act under a power of attorney, also the owner's name as it appears in the registry; the listing content and photos; the verification mark and its date; and your owner profile except your contact details. We re-encode uploaded photos and remove their metadata, including GPS location.

2.6. Identity verification with Sumsub (biometric data). Before a listing can be published as verified, we ask you to verify your identity. The check is carried out by Sumsub (see section 4) in a window embedded in our website. During the check Sumsub processes images of your identity document and the data printed on it, a selfie or short video to confirm that you are physically present and match the document (facial images processed to identify you are biometric data, a special category of data under Article 3 of the Law), and technical data about your device and connection.

We do not receive or store your document images, selfie or biometric data. We receive only the result of the check: its status (approved, rejected or resubmission needed), the reasons for rejection, the name, document type and issuing country as read from the document, whether the personal number matches the one you entered, and the Sumsub applicant identifier.

Purpose: to confirm that the person listing a property is the person shown as its owner in the Public Registry, and so to protect tenants and owners from fraud and impersonation. Remote verification of this kind cannot reliably be achieved by other means (Article 9(1) of the Law). Legal basis: your written consent given in electronic form before the check starts (Article 6(1)(a) of the Law). Before starting this processing we determined in writing its purpose, the data involved, retention periods, storage and destruction rules and the safeguards for your rights, as required by Article 9(2) of the Law.

Giving consent is voluntary. If you do not consent, we cannot verify you and your listing cannot be published with the verification mark. You may withdraw consent at any time by writing to support@kari.rent. Withdrawal does not affect processing carried out before it; after withdrawal we will ask Sumsub to delete your verification data, and the verification mark may be removed from your listings.

Sumsub acts as our processor. For some purposes of its own, such as fraud prevention and improving its service, Sumsub acts as an independent controller, as described in its Notice of Personal Data Processing, which is shown to you before the check.

2.7. Messages to us. When you write to support@kari.rent, we process your email address, the content of your message and our reply to answer you. Legal basis: handling your request (Article 5(1)(j)) and, where the message concerns your account or listing, performance of the contract (Article 5(1)(b)). Email to this address is forwarded by Cloudflare Email Routing to our mailbox hosted by Apple iCloud.

3. How long we keep data

When a retention period ends, we delete the data or make it anonymous.

4. Who receives your data

We do not sell personal data and do not share it for advertising. Your data is received by:

• other users and the public, to the extent described in sections 2.4 and 2.5;
• our processors, which process data only on our instructions under written agreements (Article 36 of the Law);
• public authorities and courts, where we are required to disclose data by the legislation of Georgia;
• our professional advisers (lawyers, accountants) where necessary to protect our rights, bound by confidentiality.

When you choose to sign in with Google or with Apple, Google or Apple also processes your data as an independent controller under its own privacy policy.

5. Transfer of data outside Georgia

Our website and database are hosted in the European Union. Some of the providers listed in section 4 are located in, or may process data in, the United States, the United Kingdom or other countries. We transfer data to another state only on the grounds provided for in Article 37 of the Law: where the recipient state ensures appropriate safeguards for data protection, or, where it does not, on another ground set out in that Article, such as an agreement with the recipient that ensures appropriate safeguards.

Where data is processed in a state that does not ensure an adequate level of protection, public authorities of that state may be able to access it under local law, and you may have fewer means of protecting your rights there. You can ask us for information about the safeguards that apply to a particular transfer.

6. Cookies and browser storage

We use only cookies and browser storage that are needed for the Service to work or to remember your settings. We do not use analytics, advertising or third-party tracking cookies, so we do not ask for cookie consent.

The Sumsub verification window and the sign-in windows of Google and Apple may set their own cookies or storage; these are governed by the providers' policies.

7. Your rights

Under Articles 13 to 22 of the Law you have the right to:

• receive information about the processing of your data (Article 13);
• access your data and receive a copy of it free of charge, except in the cases provided for by the Law (Article 14);
• have inaccurate or incomplete data corrected or completed (Article 15);
• request that processing stop and that your data be deleted or destroyed (Article 16);
• request that your data be blocked (Article 17);
• receive the data you provided in a structured, commonly used, machine-readable format and have it transmitted to another controller, where processing is based on consent or a contract and is automated (Article 18);
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects for you (Article 19). The automatic comparison with registry data in our verification can lead to a negative result; you can always ask for a moderator to review it, and refusals to publish are made by a person;
• withdraw your consent at any time without giving reasons, in the same form in which you gave it, and before doing so ask us about the possible consequences of withdrawal (Article 20).

To exercise a right, write to support@kari.rent from the email address linked to your account, or otherwise give us enough information to identify you. We will answer within 10 working days. In exceptional cases, where the Law allows, this period may be extended by up to 10 more working days, and we will tell you the reason. We may refuse a request in the cases provided for by the Law, for example where we must keep data to comply with a legal obligation or to establish or defend legal claims; we will explain the reason.

If you believe that your rights have been violated, you may file a complaint with the State Audit Office of Georgia, which supervises personal data protection (sao.ge), or with a court (Article 22 of the Law).

8. Security

We protect personal data with organisational and technical measures appropriate to the risks: encrypted connections (HTTPS), signed session cookies, restricted access to verification data for moderators only, uploaded documents that are never publicly accessible, removal of photo metadata, and collection of only the data we need. If a data breach occurs, we will register it and notify the State Audit Office of Georgia and, where there is a high risk to you, notify you, in accordance with Articles 29 and 30 of the Law.

9. Age

The Service is intended for persons aged 18 and over. We do not knowingly collect data of persons under 18. A tenant profile may contain the ages of children who will live in the property; we do not ask for their names or other data about them.

10. Marketing

We do not send marketing messages. If we decide to, we will do so only with your prior consent and in accordance with Article 12 of the Law, and you will be able to withdraw that consent free of charge at any time. Service messages about your account, listings and requests are not marketing.

11. Changes to this Policy

We may update this Policy. The current version and its effective date are always published on this page. We will notify you of material changes at least 14 days before they take effect, by email or by a notice on the Service. Where a change requires your consent, we will ask for it.

Version 1.0, effective 9 November 2026.

12. Contact

Pavel Ilin, identification number 345667655, Tamar Mefe Avenue 22a, flat 143, Batumi, Georgia. Email: support@kari.rent.