LoginFree Assessment

Privacy Policy

CarRentRight

Effective date: 27-10-2026

1. Introduction

Carentright OÜ, operating as CarRentRight (CRR, we, us or our), is responsible for the personal data described in this notice. It covers visitors, customers and other individuals whose information is relevant to a rental dispute.

This Privacy Policy explains how we collect, use, store, disclose, and protect personal data when you:

  • visit our website;
  • interact with our landing pages and public content;
  • start a case through our platform;
  • submit a car-rental case for assessment;
  • upload documents or other supporting information;
  • communicate with us or with service channels connected to our platform.

We provide administrative case preparation, consumer information and correspondence support. The service includes assessment at no charge and, if you choose to continue, case preparation support, prepared correspondence and agreed resolution support. One car-rental case flow covers financial and non-financial outcomes. We do not take ownership of your claim, hold your recovery or provide legal representation.

This notice explains our processing under the GDPR and other applicable privacy laws. It applies from your first interaction, including before any paid agreement. Reading or acknowledging it does not order the paid service, authorize contact with a rental company or give blanket consent to processing.

2. Data Controller

The data controller responsible for the processing of personal data under this Privacy Policy is:

Carentright OÜ
Registry code: 17481848
Registered address: Harju maakond, Tallinn, Lasnamäe linnaosa, Ruunaoja tn 3, 11415, Estonia
General contact email: support@carentright.com

For privacy-related requests, you may contact us at:

support@carentright.com. We will route your request to the responsible person.

3. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed through:

  • the Carentright website;
  • case intake forms and conversational intake tools;
  • case submission and management workflows;
  • dashboard and account access features;
  • communications sent by or to Carentright in relation to a case;
  • service delivery, payment administration, security and any analytics permitted by your choices and applicable law.

Independent rental companies, banks, payment providers and lawyers may act as separate controllers for their own purposes and publish their own notices. This does not remove CRR's responsibility for the information it discloses to them.

4. Personal Data We Collect

We collect data relevant to the purpose involved, rather than requiring every category for every case. Where information is needed to assess your request, provide the agreed service or meet a legal obligation, we explain that at collection. Without essential information, we may be unable to assess or continue the case. Optional information and optional consent are not conditions of purchase.

4.1 Website and Device Data

Website and account operations may generate the following technical records. Optional tracking is explained separately below:

  • IP address;
  • browser type and version;
  • device type;
  • operating system;
  • language settings;
  • referring URL;
  • pages visited;
  • date and time of access;
  • session and navigation data;
  • security and diagnostic logs.

Cookies and similar technologies support essential functions such as authentication and security. Optional analytics or advertising technologies require a separate choice where the law requires consent; acknowledging this notice does not give that consent.

The Cookie Policy and Cookie Settings explain the technologies in use, their purposes and how to change your choices.

4.2 Identity, Contact and Billing Data

When you interact with our platform, create an account, or contact us, we may collect:

  • first name and last name;
  • email address;
  • phone number;
  • postal address;
  • country of residence and relevant billing or tax details;
  • account identifiers and login/authentication records.

4.3 Case Data

If you start or submit a car-rental case, we may collect:

  • company name;
  • country, city, airport, or rental branch details;
  • rental dates;
  • reservation or contract number;
  • narrative description of what happened;
  • prior actions taken with the company;
  • monetary amount requested and currency, where relevant;
  • desired outcome;
  • case classification data;
  • issue categories and related case metadata.

We also create case summaries, assessments, evidence indexes, draft messages, human-review records and outcome notes. These may contain personal data and may need correction if the source information or an AI-assisted summary is inaccurate.

4.4 Evidence and Supporting Documents

You may provide supporting materials such as:

  • booking confirmations;
  • rental agreements;
  • invoices and receipts;
  • payment proofs;
  • charge notices;
  • screenshots;
  • emails or messages;
  • photos, screenshots and other evidence submitted through supported channels;
  • damage reports;
  • other documents related to the case.

We store the files you upload and their original file names, which may contain personal information.

4.5 Communications Data

We may process communications between:

  • you and Carentright;
  • you and companies, where shared with us;
  • communications retained for existing cases under their original instructions and terms;
  • CRR and an independent lawyer or adviser, where a specific referral or disclosure has been requested and appropriately authorized.

4.6 Agreement, Permission and Audit Records

We keep records needed to distinguish notice acknowledgement, agreement acceptance, optional consent and any authority retained for existing cases, including:

  • the action taken and its date and time;
  • relevant account or session identifiers;
  • the document version and case-specific service summary;
  • the accepted price, early-start request and related acknowledgements, where applicable;
  • sending authorizations and revocations for existing cases, withdrawal/refund requests and proportionate audit records.

These records distinguish the purposes of each confirmation. A privacy acknowledgement is not the paid agreement, and payment is not consent to optional data use. For new pilot cases, you review and send the prepared correspondence yourself. Records for existing cases remain subject to their original instructions and terms.

4.7 Payment and Refund Data

Payments may be made by card or bank transfer, depending on the options offered in your payment instructions. The card-checkout description below applies to card payments. For bank transfers, CRR processes payer and transaction information to confirm payment, match it to your case, maintain accounting records and administer any service-fee refund.

Payment for CRR's service is made through a payment link to the payment provider. You enter your payment-card details directly with that provider. CRR does not store your full card number, card security code or online-banking credentials.

CRR keeps the limited service-administration records needed to identify your case, record the agreed fee and applicable VAT, confirm payment, and handle receipts, refunds or disputes. These records are separate from your payment-card details. The payment provider's privacy notice explains its checkout processing. A one-time payment does not authorize a subscription or later automatic charges. Please redact unrelated entries and unnecessary card or account details from evidence of the disputed rental payment.

4.8 Sensitive and Third-Party Information

Evidence may mention another driver, passenger, rental employee or other person. Share only relevant information you are entitled to provide and redact unnecessary identifiers. You cannot give blanket consent for another adult. We remain responsible for identifying our lawful basis and any applicable notice obligations.

Do not upload identity documents unless specifically requested and necessary. Contact us before uploading health information or other highly sensitive material so that appropriate handling can be explained. Special-category data requires both an ordinary legal basis and an additional GDPR condition, for example necessity for legal claims where that exception applies, or valid explicit consent where appropriate. We assess that condition before use; the service contract alone is insufficient. Criminal-conviction or offence data requires separate legal authority under Article 10. If no lawful condition is available, we do not use it and arrange deletion or restriction as appropriate.

5. Sources of Personal Data

We obtain personal data:

  • directly from you;
  • from documents and information you upload;
  • from communications you provide;
  • from public-facing website usage;
  • from third parties where you instruct or authorize sharing;
  • payment providers and other service providers for transaction or service records, and independent advisers where a lawful referral has been arranged.

Where your information comes from someone else's case submission, it may include your identity, business contact details, correspondence and alleged involvement in the events. We assess necessity and provide the required information within the applicable time limits unless a specific legal exception applies. Publishing this policy alone does not automatically meet every indirect-collection notice obligation.

6. Purposes and Legal Bases

The following bases apply to the specified purposes. We do not treat them as interchangeable permissions. Information about someone who is not our customer needs its own applicable basis; the customer's contract does not automatically cover every other person's data.

6.1 Consent

Consent (Article 6(1)(a)) is used only for a specific optional purpose for which it is freely given, informed and recorded. Examples, where offered, include:

  • optional analytics or advertising technologies that require consent;
  • optional promotional messages where consent is required;
  • publication of an identifiable customer story under a separate, specific permission;
  • another clearly described optional use, with a separate choice. You may withdraw consent at any time without affecting earlier lawful processing. Acknowledging this policy or voluntarily uploading a document is not, by itself, consent to all uses.

6.2 Performance of a Contract or Pre-Contractual Steps

Contract or requested pre-contractual steps (Article 6(1)(b)) covers processing of your information that is necessary to:

  • receive your request and assess the case at no charge before you decide whether to continue;
  • prepare and provide the case-specific offer and record your acceptance;
  • provide the account and dashboard functions needed for your requested service;
  • prepare the Case Builder, correspondence and included resolution support under the accepted agreement;
  • communicate about delivery and support, administer payment and refunds, and manage the agreed work. No paid agreement is required merely to request the initial assessment.

6.3 Legitimate Interests

Legitimate interests (Article 6(1)(f)) may support the limited purposes below where necessary and proportionate, after considering the impact on your rights and reasonable expectations:

  • protecting platform availability, accounts and case files;
  • detecting and investigating misuse, fraud or security incidents;
  • keeping proportionate evidence of instructions, authorizations, delivery and disputes;
  • limited internal quality checks on our own service, with access and data minimization controls;
  • handling relevant third-party information in case evidence, such as a rental employee's business contact details;
  • establishing, exercising or defending legal claims. These purposes do not authorize unrelated advertising, public disclosure or general AI training; you may object as explained in section 14.

6.4 Compliance with Legal Obligations

Legal obligations (Article 6(1)(c)) cover processing required by applicable law, such as accounting and tax records, consumer-law records, responding to valid rights requests and binding legal demands. We identify the relevant obligation and retain only the information it requires.

7. How We Use Personal Data

We may use personal data to:

  • operate and maintain the website and platform;
  • allow users to start and manage cases;
  • assess the case and organize relevant facts and evidence;
  • request additional information or documents;
  • prepare correspondence for you to review and send;
  • provide included reply and resolution support for correspondence you review and send yourself;
  • record agreement acceptance, delivery, payment, cancellation, refunds and relevant outcomes;
  • provide customer support;
  • review service quality within the limits in sections 6, 8 and 9;
  • comply with legal obligations;
  • protect our legal rights and those of users or third parties.

8. AI-Assisted Processing

CRR uses AI assistance for intake, summaries, evidence organisation and draft preparation, subject to human review. Our online assessment chat uses Claude, provided by Anthropic, to help collect information and organise your case. The text you type or paste into the chat is sent to Anthropic for processing, including any case details or extracts from documents you include. The current chat integration does not send uploaded files to Anthropic. Uploaded files are stored separately for CRR’s review. We limit inputs to the information needed for each task.

These tools may be used to:

  • organize free-text narratives into structured case summaries;
  • identify missing information;
  • identify the rental issue type and organize the case;
  • support evidence mapping and case-readiness checks;
  • prepare draft assessments, Case Builder material and correspondence for review.

AI output can contain errors. You can ask us to correct case information and request a person to review an assessment or message. A human reviews CRR's customer-facing assessment and case-preparation work; AI does not independently authorize payment, dispatch messages or determine an entitlement to compensation.

Our service model does not use solely automated decisions producing legal or similarly significant effects about you. Using case information to carry out your requested task is distinct from reusing it to train a general model or for unrelated product development.

9. Publication, Statistics and Service Improvement

Your case is handled as confidential service information. Submission, payment and acceptance of the agreement do not authorize publication of your identity, case documents or correspondence.

Within the limits of this notice, reporting may include:

  • internal case and workload statistics;
  • internal service-quality and outcome analysis;
  • non-identifying company-level trends, where lawful;
  • anonymous summaries from which individuals cannot reasonably be identified;
  • an identifiable story only under a separate lawful basis and specific publication permission.

Removing a name or replacing it with a case number does not necessarily make information anonymous. We consider indirect identifiers and re-identification risk; identifiable and pseudonymized information remains protected personal data.

The €35 service does not include permission to sell identifiable case data, publish your case or build a public ranking from it. Any future public reporting or data product needs a separate review, appropriate notice and lawful basis before it starts. We do not sell personal data.

10. Data Sharing

We may share personal data where necessary and lawful with:

10.1 Service Providers

Depending on the task, relevant service-provider categories are:

  • Amazon Web Services (AWS) for cloud hosting, infrastructure and storage of uploaded files;
  • Anthropic (Claude) for processing the text you type or paste into the online assessment chat; uploaded files are not sent through this integration, as described in section 8;
  • analytics where lawfully enabled;
  • security monitoring;
  • email or communication services;
  • customer support tools;
  • authentication, payment processing and accounting. Processors act under appropriate data-processing agreements; providers carrying out their own regulated activities may be separate controllers.

10.2 Companies Involved in a Case

For new pilot cases, you review and send the prepared correspondence yourself. CRR does not contact or negotiate with the rental company on your behalf. Any processing for existing cases remains governed by their original instructions and terms. We may make disclosures separately required by law.

10.3 Legal Partners

An independent lawyer or adviser receives information only where the proposed referral or disclosure has a lawful basis and the specific authorization required for that route. We explain the recipient and purpose. A lawyer's own engagement and privacy responsibilities are separate from CRR's administrative service.

10.4 Authorities and Courts

We may disclose data where required by law, court order, or lawful request from competent authorities.

Access within CRR and its service providers is limited by role and purpose. Sharing must be necessary for the stated task; the fact that a recipient is listed here does not authorize unrestricted disclosure.

11. International Data Transfers

Our platform is hosted on Amazon Web Services (AWS) infrastructure in Ireland (eu-west-1). External service providers or authorized personnel may process or access personal data outside Ireland or the European Economic Area (EEA). Hosting in Ireland does not by itself mean that every provider's processing and all remote access take place there.

Where Chapter V GDPR applies, a transfer requires a valid mechanism in addition to an ordinary processing basis. Depending on the verified destination and recipient, this may be:

  • an applicable European Commission adequacy decision;
  • Standard Contractual Clauses with the required assessment and supplementary safeguards;
  • another legally available mechanism for the particular transfer. General security measures alone are not a transfer mechanism. You may contact us for information about the safeguards and a copy, subject to necessary redactions.

12. Data Retention

We retain personal data for the purpose-specific periods needed to provide the requested work, meet identified legal duties and handle relevant claims. The following periods and criteria do not permit indefinite retention.

Please do not upload passports, driving licences or other identity-document copies unless we specifically request information that is necessary for your case. If an unnecessary identity-document copy is uploaded, our handling rule is to delete it when it is identified during review or brought to our attention at support@carentright.com. This is manual handling, not automatic detection or immediate deletion on upload. Any legally necessary retention must have a documented purpose and be limited to the information and period required.

Retention is assessed separately for:

  • technical/security logs: the documented period needed to detect, investigate and resolve incidents, followed by deletion or anonymization;
  • account information: while required for the account and requested services, then only for a documented closure or legal-record purpose;
  • accepted case files: while delivering the agreed work and included support, then the necessary period tied to applicable legal duties and claim/limitation periods;
  • incomplete, declined or abandoned requests: only while assessing or responding to the request and for a justified, limited follow-up or dispute-record period. Declining the paid offer does not authorize indefinite retention.

Invoices, payment/refund records, acceptance and consent records have separate retention requirements; an accounting obligation does not automatically justify retaining every uploaded document. A specific dispute or legal hold may extend retention of relevant material only. When the purpose ends, we delete or irreversibly anonymize the data and address remaining backups through the applicable backup cycle. Closing a case or account is not the same as immediate erasure.

13. Data Security

We apply technical and organizational measures appropriate to the risk. These measures cover:

  • access controls;
  • encrypted transmission where appropriate;
  • secure storage systems;
  • audit logging;
  • restricted internal access;
  • monitoring for abuse, misuse, and unauthorized access.

No system is completely secure. We manage and investigate personal-data incidents and notify the relevant authority and affected individuals where legally required.

14. Your Rights

Depending on the legal basis and circumstances, you may:

  • ask for access to and a copy of your personal data;
  • ask us to correct inaccurate or incomplete information;
  • request deletion of personal data;
  • ask us to restrict processing in the circumstances provided by law;
  • object to processing based on legitimate interests because of your particular situation, and object at any time to direct marketing;
  • receive eligible data in a portable format where processing is automated and based on consent or contract;
  • withdraw optional consent without affecting processing that was lawful before withdrawal. This does not itself cancel the service agreement or erase records we must lawfully keep.

Send requests to:

support@carentright.com. We may request proportionate identity verification. We respond without undue delay and normally within one month. A permitted extension of up to two further months for complexity or number of requests will be explained within the first month. Requests are normally free; any lawful refusal, restriction or fee will be explained.

You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee, info@aki.ee), or another competent supervisory authority, including where you habitually live or work or where the alleged infringement occurred. You do not have to obtain CRR's permission. Mandatory additional rights under applicable local law remain available.

15. Children

The CRR customer service is intended for adults aged 18 or over. A rental dispute may incidentally mention a child, but we do not ask for children's information unless relevant and lawfully necessary. Please redact unnecessary details. If inappropriate children's data is supplied, contact us so we can assess and remove or restrict it as appropriate.

16. Changes to This Privacy Policy

We may update this notice to reflect changes in actual processing or legal requirements. We identify the applicable version and update date.

We provide appropriate notice of material changes and information about a new purpose before the new processing starts. We obtain fresh consent where required. Posting a revised notice does not retrospectively authorize an unrelated use of information already collected.

17. Contact

For privacy requests use the contact in section 14. For general service questions:

Carentright OÜ
Harju maakond, Tallinn, Lasnamäe linnaosa, Ruunaoja tn 3, 11415, Estonia
support@carentright.com