Learn more about the history of the car

In providing its services, Javic LLC (hereinafter — the Provider) (Reg. No. 402174222) acts in compliance with the legislation of Georgia and with the norms and requirements provided by best international practices.

It is important for the Provider to ensure the protection and security of its users' data in order to deliver a high quality of service.

The purpose of this Personal Data Protection Policy (hereinafter — the Policy) is to define the rights and obligations of Javic LLC as the data controller and of the Provider's users as data subjects, and to explain the grounds and purposes for processing personal data.

The processing of the user's personal data (including biometric data) is an integral part of using the Provider's website/application and the services and products offered by the Provider;

By accessing the Provider's website/application and using its services and products, the user expresses consent that they have read this Policy, that the conditions defined by the Policy are clear and understandable to them, and that they agree the Provider may process their personal data in accordance with the legislation of Georgia and this Policy;

Upon registration in the Provider's system and use of the services/products, this Policy becomes an annex to the general service agreement;

The Provider is entitled to amend the Policy at any time, of which the user will be notified through the use of the updated version on the website/application and/or by a notice sent via a means of communication;

This Policy is approved by the Provider's director and enters into force from the date of their signature;

When processing data, the Provider ensures:

• processing data fairly and lawfully, without violating the dignity of the data subject;
• processing data only for specific, clearly defined, lawful purposes;
• storing data only for the period necessary to achieve the purpose of processing;

For direct marketing purposes, the Provider is entitled to process the following data: name(s), address, telephone number, email address;

Biometric data may be processed in the course of activities for the purposes of security and protection of property, as well as to prevent the disclosure of confidential information;

The Provider may carry out data processing itself directly (through authorized employees) and/or through persons in a business relationship with it (hired persons).

When processing data, appropriate organizational and technical measures are taken to protect the data;

The Provider is not responsible for the protection of users' personal data on third-party websites;

• there is consent of the data subject;
• data processing is provided for by law;
• data processing is necessary for the data controller to fulfill an obligation imposed on it by law;
• according to law, the data is publicly available and/or the data subject has made it available;
• data processing is necessary to review the data subject's application (to provide them with a service);

Data processing is necessary for the purposes of the services to be provided to the user and the user's use of the Provider's products;

Javic LLC, as a service provider, is a person subject to regulation, which — for the purposes of providing services — must identify the user, request additional information if necessary, assess it, and store it for the period established by law;

The Provider ensures the processing of personal data in accordance with legislative requirements.

• establishing/verifying/confirming the user's identity;
• concluding, executing, and/or carrying out subsequent actions on a service or other type of agreement with the user;
• open communication with the user (providing information);
• direct marketing;
• statistical analysis;
• ensuring compliance with other legislative requirements undertaken by the Provider;

To fulfill the purposes listed above, the Provider processes and stores the following data about the user:

• first and last name;
• personal/identification number;
• date of birth;
• email address;
• mobile/contact number;
• vehicle registration number;
• vehicle technical passport data.

Data is collected, processed, and stored for at least 1 year from the termination of the business relationship with the user, unless otherwise provided by law;

The source of data collection may be the user directly, public bodies and institutions, persons authorized to represent the user, and other persons.

Data may be transferred to the following persons: other organizations with a legitimate interest, and other persons on a lawful basis.

The data subject has the right to:

• at any time require the data controller to stop using their data for direct marketing purposes;
• request information from the data controller about the processing of their data;
• receive information about the processing of their data immediately upon request, or no later than 10 days from the request;
• choose the form in which the requested information about the processing of their data is provided;
• request the correction, updating, addition, blocking, deletion, and/or destruction of their data if it is incomplete, inaccurate, or not updated, or if its collection and processing was carried out contrary to the law. For the purposes of this point, a request may be submitted in writing, orally, or by electronic means;

The rights defined in this point may be restricted if their exercise could pose a threat to:

• the interests of state security or defense;
• the interests of public safety;
• the detection, investigation, and prevention of crime;
• the rights and freedoms of the data subject and others;

The user has the right at any time, without explanation, to withdraw the consent they have given and to request the cessation of data processing and/or the destruction of the processed data;

In the event of a violation of the Law of Georgia "On Personal Data Protection", the user has the right, in accordance with the procedure established by law, to apply to the Personal Data Protection Service or a court and to request the blocking of the data before a decision is made;

• on the basis of consent given by the data subject, the Provider is entitled to process any data for direct marketing purposes;
• process data to properly conduct its activities and to ensure fulfillment of the requirements defined by law;

• to read this Policy;
• upon reviewing and accepting the conditions defined by the Policy, to express consent to the processing, storage, and recording of their data;
• to provide the Provider with accurate, true, and reliable information/data;

The data controller is obliged to stop processing data for direct marketing purposes and/or to ensure that the authorized person stops such processing no later than 10 working days from receiving the data subject's request;

To provide the data subject with the following information:

• the identity and registered address of the data controller and the authorized person (if any);
• which of their data is processed;
• the legal basis for data processing;
• how the data was collected;
• to whom their data was disclosed, and the basis and purpose of disclosure. Providing this information is not mandatory if the data is public according to law;
• the purpose of data processing;
• whether provision of the data is mandatory or voluntary; if mandatory — the legal consequences of refusal;
• the right of the data subject to receive information about their processed data and to request its correction, updating, addition, blocking, deletion, and destruction;

To take such organizational and technical measures as ensure the protection of data from accidental or unlawful destruction, alteration, disclosure, acquisition, any other form of unlawful use, and accidental or unlawful loss;

To record all actions performed on data existing in electronic form;

For data existing in non-electronic form, to ensure the recording of all actions related to the disclosure and/or alteration of data;

To ensure the adoption and existence of adequate security measures for the risks associated with data processing;

When disclosing data, to record the following information: which data will be disclosed, to whom, when, and on what legal basis. This information is stored together with the data subject's data for the duration of its storage period;

At the data subject's request, to correct, update, add, block, delete, or destroy data if it is incomplete, inaccurate, or not updated, or if its collection and processing was carried out contrary to the law. For the purposes of this point, correction, updating, addition, deletion, and destruction of data is carried out within 15 days of receiving the request, while a decision on blocking is made within 3 days and remains in force until the data controller makes a decision on the correction, updating, addition, deletion, and destruction of the data;

At the user's request, to stop processing data and/or destroy the processed data within 5 days of submission of the application, unless there is another basis for processing the data.