Privacy Policy
Last Updated: 27.09.2025
This Privacy Policy, as amended from time to time (the "Privacy Policy" or "Policy"), explains how KARRYCO OÜ, registry code 17304773, Tornimäe tn 5, Kesklinna linnaosa, Tallinn, Harju maakond, Eesti Vabariik (hereinafter "KARRYCO OÜ" or the "Company"), collects, uses, and protects user information obtained through its website https://www.karry.co/ (the "Site") and mobile application (the "App"). The terms "we," "us," and "our" refer to the Company.
By using the Site or App, you ("User") consent to the practices described in this Privacy Policy. Your Personal Data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable national data protection laws.
1. What if I do not want to accept this Privacy Policy?
By using the App or Site, you signify your acceptance of this Policy. If you do not agree to this Policy, please do not use the App or Site. Your continued use of the App or Site following the posting of changes to this Policy will be deemed as your acceptance of those changes.
In case you disclose any Personal Data regarding any third person (e.g. employee, co-worker, contracting party, etc.) to us, you are obliged to refer them to this Policy.
2. What information do we collect?
- Personal Data you provide (e.g., name, email address, phone number, ID documents for verification).
- Account data (credentials, preferences, settings).
- Payment data (processed by third-party providers such as Stripe; we do not store card details).
- Communication data (messages, reviews, ratings, customer support interactions).
- Automatically collected data (IP address, device information, operating system, cookies, log files).
- We do not collect Special Categories of Personal Data (race, religion, health, political opinions, etc.).
3. How do we use your information?
- To create and manage accounts.
- To perform identity verification via third-party providers.
- To process payments for Credits and services.
- To enable communication between Travelers and Senders.
- To improve and personalize the Services.
- To provide customer support and respond to inquiries.
- To comply with legal obligations (tax, fraud prevention, law enforcement requests).
The Company does not sell user data or Anonymous Data to any third party.
Legal Bases under GDPR (Article 6):
- Contract performance (providing Services, processing payments, verifying identity).
- Legal obligations (reporting, fraud prevention).
- Consent (newsletters, optional features).
- Legitimate interests (improving Services, dispute resolution, customer support).
4. How do we share your information?
It may be necessary to disclose your information to comply with any law, court orders, or government request, defend against claims, investigate or bring legal action against illegal or suspected illegal activities, enforce our Terms, or protect the rights, safety, and security of the Company, our users, or the public.
We may share your Personal Data with third-party service providers to provide you with the services that we offer you through our Site. These third-party service providers are required not to use your Personal Data other than to provide the services requested by you.
Other than as stated in this Privacy Policy, the Company does not disclose any of your personal information to third parties unless required to do so by law enforcement, court order, or in compliance with legal reporting obligations.
All third-party service providers that we share your data with shall be requested to only process your data in accordance with instructions from us and comply fully with this Privacy Policy, any applicable data protection laws and any other appropriate confidentiality and security measures. We may also share your personal data with competent authorities when this is necessary to comply with a legal obligation, court order or comparable official order issued by an authorized authority.
We may share some or all of your Personal Data in connection with or during negotiation of any merger, financing, acquisition or dissolution transaction or proceeding involving sale, transfer, divestiture, or disclosure of all or a portion of our business or assets. In the event of an insolvency, bankruptcy, or receivership, Personal Data may also be transferred as a business asset.
If another company acquires our company, business, or assets, that company will possess the Personal Data collected by us and will assume the rights and obligations regarding your Personal Data as described in this Privacy Policy.
The Site may contain links to other third-party websites which are regulated by their own privacy policies. The Company is not responsible for the privacy policies of these third-party websites even if they were accessed using the links from our site.
5. How long do we store your personal data?
We retain your data as long as your account is active or as needed to provide the Services. Upon account deletion, your personal data is erased or anonymized. Data necessary for the functioning of the platform, such as trip listings or reviews provided to other Users, will remain but will be anonymized so it cannot be linked to you. Identity verification data held by third-party providers will be deleted within one (1) month of account deletion. Minimal data may be retained for legal or fraud-prevention purposes.
6. User rights under GDPR
Under certain circumstances, you have the following rights under data protection laws in relation to your personal data:
- Request access to your personal data.
- Request correction of your personal data.
- Request erasure of your personal data.
- Object to processing of your personal data.
- Request restriction of processing your personal data.
- Request transfer of your personal data.
- Right to withdraw consent.
You also have the right to lodge a complaint with a Data Protection Authority ("DPA") if you think that your Personal Data is being processed incorrectly or your rights have been violated by the Company.
7. No fee is usually required
You will not have to pay a fee to access your personal data (or to exercise any of your other rights).
Request the transfer of your personal data to you or to a third party. We will provide your personal data in a structured, commonly used, machine-readable format. This right applies only to automated information that you provided consent for us to use, or where we used the information to perform a contract with you.
Withdraw consent at any time where we rely on consent to process your personal data. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. If you withdraw consent, we may not be able to provide certain services. We will inform you at the time if this is the case. In some circumstances, we may still be permitted to continue processing your data if another legal basis applies.
8. How can you send requests regarding your information?
You can make a request regarding your information by emailing admin@karry.co.
Unless you have made a corresponding request, we will retain your information for as long as your account has not been closed or as needed to provide you access to your account.
If you wish to close your account, please choose "Close my Account" in Settings by logging in to personal Account. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our Terms.
9. Where do we store your Personal Data?
The information we collect is primarily stored on secure servers The Services are hosted on cloud servers located in the European Union (AWS Ireland region). Certain data may also be processed outside the EEA by third-party providers under appropriate safeguards (e.g., Standard Contractual Clauses). We will take all steps reasonably necessary to ensure that personal information is treated securely and in accordance with this Privacy Policy and that any third parties that we share your information with are bound to employ similar organizational and technical measures to ensure your information's security.
10. Children's Data
The Services are not directed to or intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will delete it promptly.
11. What security precautions do we take to protect you?
We take the protection of your personal information seriously. We use industry-standard data encryption technology and have implemented restrictions related to the storage of and the ability to access your personal information. However, despite all of our efforts, please note that no transmission over the Internet or method of electronic storage can not be guaranteed to be 100% secure.
12. Contact us
If you have any questions about our Privacy Policy as outlined above, please contact us at admin@karry.co