Privacy Policy

1. Data Controller

CROSS.GE (cross.ge) is an online car marketplace operating in Georgia. As the data controller, we are responsible for the processing of your personal data in accordance with the Law of Georgia on Personal Data Protection (No. 3144/2023).

2. Data We Collect

• Phone number — for account registration and verification
• Name — displayed to other users on your listings
• Listing data — vehicle information, photos, prices you publish
• Messages — communications between users via the built-in chat
• Usage data — pages visited, search queries (anonymized, no third-party tracking)

3. Purpose of Processing

• Account creation and authentication via OTP
• Publishing and managing car listings
• Enabling communication between buyers and sellers
• Ensuring platform security and preventing fraud
• Improving the service based on anonymized usage patterns

4. Legal Basis

We process your data based on: (a) your consent when creating an account; (b) contract performance — providing the marketplace service; (c) legitimate interest — platform security and fraud prevention.

5. Data Storage

Your data is stored on secure servers within the EU (Supabase infrastructure). Data is retained for as long as your account is active. Upon account deletion, all personal data is permanently removed within 30 days.

6. Cookies

We use only strictly necessary cookies for session management and authentication. We do not use analytics, advertising, or third-party tracking cookies. No data is shared with advertising networks.

7. Your Rights

Under Georgian data protection law, you have the following rights:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure — delete your account and all associated data
• Right to restriction — limit how your data is processed
• Right to portability — receive your data in a structured format
• Right to object — object to data processing
• Right to withdraw consent — at any time without affecting prior processing

8. International Data Transfer

Your data may be stored on servers located in the EU. The EU is recognized as providing adequate data protection. No data is transferred to countries without adequate protection guarantees.

9. Children's Privacy

Our service is intended for users aged 16 and older. We do not knowingly collect data from children under 16. If we discover that a child under 16 has created an account, we will promptly delete it.

10. Supervisory Authority

You have the right to lodge a complaint with the Personal Data Protection Service of Georgia (PDPS) at pdps.ge if you believe your data protection rights have been violated.

Contact

For any questions regarding your personal data, contact us at: support@cross.ge