Privacy policy

Version of 9 November 2026. If this translation differs from the Ukrainian version, the Ukrainian version prevails.

1. Who processes your data

1.1. The controller is the individual entrepreneur (ФОП) Danylo Dmytrovych Shuvalov, taxpayer number 3712502834, address: Ukraine, 65058, Odesa region, Odesa, Prymorskyi district, Marshala Hovorova St., bldg. 11, block B, apt. 401, email: hello@carentos.com, phone: +380 63 439 01 42 ("we").

1.2. This Policy explains how we process the personal data of visitors to https://carentos.com, people who send us requests, and Carentos customers and their representatives. We follow the Law of Ukraine "On Personal Data Protection" and, for people in the EU, Regulation (EU) 2016/679 (GDPR).

1.3. This Policy does not cover the data of customers of rental companies that use websites built on Carentos. For that data the rental company is the controller and we only process it on its behalf (section 8 of the Public Offer Agreement). Contact the rental company about such data.

2. Data we process

Site requests: name, company, city or country, phone or Telegram, email, comment, request type, consent given, date and time of the request.
Correspondence: messages by email, Telegram, notes from phone calls.
Customer and back-office user data: name, email, role and permissions, login data (passwords are stored only as hashes), activity log, IP addresses and sessions, two-factor authentication settings.
Payment data: amount, date, status, payment ID, masked card number, received from the bank. We do not receive the full card number, CVV or expiry date.
Accounting data: company name and registration number, billing details, invoices, acceptance certificates.
Technical data and cookies: IP address, device and browser type, pages viewed, referrer, on-site events. Statistics and marketing cookies are set only after your consent (see the Cookie Policy).

3. Purposes and legal bases

Reply to a request, give demo access, prepare an offer — Data: request, correspondence; Legal basis: your consent in the form; steps before a contract at your request (Art. 11 of the Ukrainian Law; GDPR Art. 6(1)(a), (b))
Provide the Service, support, service messages — Data: customer and user data; Legal basis: performance of a contract (GDPR Art. 6(1)(b))
Take payments, keep accounts and file reports — Data: payment and accounting data; Legal basis: legal obligation (GDPR Art. 6(1)(c))
Protect the site and the Service, prevent abuse — Data: technical data, logs; Legal basis: legitimate interest (GDPR Art. 6(1)(f))
Analyse traffic and improve the site — Data: statistics cookies; Legal basis: consent (GDPR Art. 6(1)(a))
Measure advertising — Data: marketing cookies; Legal basis: consent (GDPR Art. 6(1)(a))

We do not send marketing emails without your separate consent. We make no automated decisions with legal effects for you.

4. Recipients

We do not sell personal data. Data may be received by:

Cloudflare, Inc. (USA) — site hosting, form handling, databases and file storage, attack protection. Databases are located in the EU.
Telegram (Telegram Messenger Inc. / Telegram FZ-LLC) — delivery of new-request notifications to our work chat.
Resend, Inc. (USA) — sending back-office emails (invitations, password reset, notifications).
Google Ireland Limited / Google LLC — Google Analytics 4 and Google Tag Manager (only with consent).
Meta Platforms Ireland Limited / Meta Platforms, Inc. — Meta Pixel (only with consent).
Microsoft Ireland Operations Limited / Microsoft Corporation — Microsoft Clarity (only with consent).
JSC "Universal Bank" (monobank), Ukraine — card payment processing.
Our accountant, tax and other public authorities — where and to the extent required by law.

5. International transfers

5.1. We operate in Ukraine, so data you give us is processed in Ukraine. Some providers (Cloudflare, Resend, Google, Meta, Microsoft, Telegram) may process data in the EU, the USA and other countries.

5.2. Transfers follow Article 29 of the Law of Ukraine "On Personal Data Protection": to countries with adequate protection, or on the basis of a contract or your consent. For transfers from the EU, providers rely on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

6. Retention

Requests that do not lead to a contract — 12 months after the last contact, then deleted.
Customer and user data — for the term of the contract and 1095 days after it ends, for tax purposes.
Payment and accounting records — for the periods required by tax law.
Analytics — per each service's settings: Google Analytics 14 months; Clarity and Meta under their own rules.
Backups — up to 30 days.

7. Security

Encrypted connections (TLS), least-privilege access, two-factor authentication for administrators, Cloudflare infrastructure protection, backups.

8. Your rights

8.1. You have the right (Art. 8 of the Law of Ukraine "On Personal Data Protection", GDPR Arts. 15–22) to: know what data about you is processed and why; get a copy; correct inaccurate data; request erasure or restriction; object to processing based on legitimate interest; receive your data in a machine-readable format; withdraw consent at any time (this does not affect processing before withdrawal).

8.2. To exercise your rights, write to hello@carentos.com. We reply within 30 calendar days and may ask you to confirm your identity.

8.3. You may complain to the Ukrainian Parliament Commissioner for Human Rights (https://ombudsman.gov.ua) or, if you are in the EU, to the data protection authority of your country.

9. Children

The site and the Service are for businesses. We do not knowingly collect data from people under 18.

10. Changes

We publish new versions on this page with their date. We notify customers of material changes by email.