Privacy Policy

MB 011Motors, trading as CARVA (company code 306328252, VAT number LT100016019919, Tauralaukio g. 26-51, LT-92347 Klaipėda, Lithuania), is the controller of personal data described in this Policy. Privacy and data-rights requests can be sent to [email protected].

CARVA processes data to perform the service contract, meet accounting and other legal obligations, and pursue legitimate interests such as service security, fraud prevention, claim handling, and reliable operations. Where processing is optional and relies on consent, CARVA asks for that consent separately and it may be withdrawn without affecting earlier lawful processing.

Account information: name, email address, account role, and records needed to verify email sign-in with a one-time code.

Booking information: vehicle make, model, year, VIN, pickup and drop-off addresses, owner identification number, phone number, price estimate, declaration confirmation, messages, and request status.

Driver information: driver name, estimated pickup date, driver vehicle registration, carrier registration, Telegram offer actions, and driver acceptance status.

Document information: unsigned and signed pickup declarations, signature image, signature timestamp, and document status.

Technical information: session cookies, IP-derived request metadata, browser/device information, and server logs needed for security and debugging.

With your permission, Google Analytics uses analytics cookies to measure site visits. You can change this choice through Cookie settings in the footer.

Telegram Mini App information: Telegram user ID, display name, username, language, bot identity, campaign start parameter, and hashed launch/session security records. CARVA does not store raw Telegram launch data.

For driver payouts, CARVA collects the driver's first and last name, email address, phone number, billing address and country, account-holder name, IBAN, payout-account status, and records of the terms acceptance, including its document version, time, IP address, and browser or device user-agent.

The full IBAN is encrypted at rest. The profile interface displays only the last four characters, and access to the full value is limited to authorised payment, finance, compliance, and administrative processes.

This data is used to verify the driver and payout destination, administer accepted delivery work, prepare billing and accounting records, prevent fraud, resolve disputes, and send eligible payouts. Necessary payout processing is based on performing the driver service relationship, legal obligations, and CARVA's legitimate security and claims-handling interests—not on marketing consent.

A new or changed payout account remains pending until verified. CARVA may request reasonable identity, authority, account-ownership, tax, or invoice evidence and may hold or reject a payout while information is incomplete, inconsistent, suspected to be fraudulent, disputed, or subject to a legal or compliance restriction.

Providing complete and accurate payout-profile data is required when a driver asks CARVA to make a bank payout; without it CARVA cannot verify or send that payout. CARVA does not use the payout profile for solely automated decisions that produce legal or similarly significant effects.

To create and manage delivery requests, estimate delivery costs, assign drivers, generate declarations, collect customer signatures, and provide chat updates.

To authenticate users by email with a one-time code and keep sessions secure.

To authenticate Telegram Mini App launches, prevent replay, link an account only after verified sign-in, and attribute quotes to the correct channel and campaign.

To notify the configured Telegram channel about driver offers and operational updates.

CARVA's internal management system is the authoritative order record. Telegram is an auxiliary notification and action channel; a Telegram message does not replace the status recorded in CARVA.

To prevent fraud, debug errors, maintain service reliability, and comply with applicable legal obligations.

When you sign in, CARVA uses your email address to send a short-lived one-time verification code.

CARVA does not require or store a password for customer sign-in.

Verification and session records are used only to secure access and are not used for advertising.

Telegram does not provide CARVA with a verified email address. A first-time Telegram customer must complete the required CARVA profile before booking.

An existing CARVA account is linked only from an authenticated customer session. CARVA never links accounts using a Telegram username or display name alone.

You can revoke bot access in Telegram and request removal of the Telegram account link through the CARVA data deletion process.

CARVA shares information only when needed to operate the delivery and payout flows, for example with assigned drivers, authorised internal administrators and finance staff, banking or payment providers, Telegram bot notifications, database hosting, app hosting, and map/address providers.

Drivers receive the booking details needed to review, accept, and complete transport work.

Data may also be disclosed to accountants, professional advisers, regulators, courts, law enforcement, or other authorities when required to meet legal obligations or establish, exercise, or defend legal claims.

We do not sell personal data.

CARVA receives information from you, the person placing the order, the assigned driver or carrier, the seller or pickup contact, payment providers and signing providers. Booking data can include the seller’s name, email and telephone number, auction or release references, vehicle readiness, key sets, pickup photos, delivery codes and records of handover or a reported problem. Signing records may include the signing method, provider reference and verification result.

Customer and driver data needed for the agreed service is processed to perform the contract or take steps at your request before a contract. Necessary information about a seller, owner, representative or recipient who is not our contracting customer is processed for the legitimate interest of verifying authority and coordinating a lawful handover. Accounting records are processed to meet legal duties. If you supply someone else’s details, make sure you are entitled to share them and direct them to this Policy.

For a business or partnership enquiry, CARVA uses your name, role, company, contact details and message to answer you and discuss the proposed cooperation. Pre-contract steps apply where you may contract personally; otherwise the basis is the legitimate interest in handling business enquiries. A partner enquiry does not give access to private customer orders.

CARVA uses the order details to match a driver, prepare a pickup declaration, obtain your signature, confirm the advance and balance payments, activate pickup and coordinate progress through to delivery. The assigned driver and authorised operations staff receive the details needed for their part of that work. Where a seller email is provided, CARVA sends pickup information and the signed declaration to that seller to coordinate release of the vehicle. The declaration contains the personal and vehicle details shown to you before signing.

Service emails may cover sign-in, payment, driver assignment, signing, pickup, progress, handover and support. Transactional email delivery and failure records help CARVA check whether an important notice was sent. These are service communications. Optional advertising requires its own applicable basis and is not authorised by placing an order.

Payment providers handle the payment credentials entered in their checkout. CARVA uses payment status, provider and transaction references, amounts, currency, refund and invoice data to reconcile your order. Depending on the method offered, providers can include Paysera or Stripe; an optional wallet payment also involves its wallet and blockchain providers. Do not put card credentials or a wallet recovery phrase in an order message.

CARVA uses service providers for hosting and storage, maps and address lookup, transactional email (including Brevo where configured), payments and electronic signing (including Dokobit where offered). Telegram processes interactions with its service under its own terms. A provider can act as a processor or as an independent controller for its own legal and service purposes.

If you open an insurance broker referral, CARVA records the referral source and may associate it with your estimate and order. A first-party receipt lasts one day to retain this choice through sign-in. We do not automatically send your vehicle, contact or order details to the broker. The broker handles your enquiry under its own privacy terms. Opening the link does not purchase insurance.

Essential cookies and browser storage support secure sign-in, your selected language, saved order progress and cookie choices. With your consent, Google Analytics measures visits and booking steps, such as the selected audience and time spent on a step. CARVA’s analytics events omit entered addresses, VINs, contact details, message contents and raw order identifiers. You can withdraw analytics consent through Cookie settings in the footer.

CARVA may invite you to share your own experience on Trustpilot. Reviewing is optional. Opening that link takes you to an independent platform with its own privacy policy. Do not publish VINs, private addresses, telephone numbers, signatures, delivery codes or someone else’s personal details in a public review.

We aim to make the delivery market easier to understand through public route examples and service information. Selected historical vehicle, city/country, delivery-type and price information may appear publicly, with demonstration entries labelled as examples. This does not make private order records, conversations, street addresses, identity details or signed declarations open data.

External providers may process data outside the European Economic Area. Such transfers require a valid GDPR transfer basis, such as an applicable adequacy decision or appropriate safeguards, including standard contractual clauses where required. Contact [email protected] for details of the recipients, processing locations and safeguards relevant to your data.

The required order, contact, payment and release details are necessary to arrange delivery; without them CARVA may be unable to accept or complete the service. You can ask for human review of a price, matching or payout issue. CARVA does not treat a price estimate or a suggested match as a final decision with legal or similarly significant effects made solely by automated processing.

We respond to data-rights requests without undue delay and normally within one month. If the law permits an extension for complexity or the number of requests, we tell you within that first month and explain why. We may ask for proportionate identity verification. You may withdraw consent or complain to VDAI without first contacting CARVA.

While a delivery is active, CARVA keeps the direct details needed to arrange collection and delivery. Thirty days after an undisputed completed or cancelled delivery, CARVA automatically and irreversibly redacts the customer name and email, VIN, owner identification number, street addresses and postcodes, customer and driver phone numbers, payment checkout URL, and private operational notes from the delivery record. The redundant stored signature image is also deleted; the signed declaration PDF is retained as the legal record.

This cleanup concerns the delivery record and separate signature image; it does not automatically erase the account, messages, evidence photos or signed PDFs. The remaining historical record contains the request reference, vehicle make/model/year, pickup and drop-off city/country, status, and accounting totals or references. Signed declarations, invoices, payment references, evidence, and dispute material are retained only for applicable accounting, tax, safety, dispute, and legal-claims periods. Disputed deliveries are not automatically redacted while a claim may require the evidence.

A current driver payout profile is kept while the driver relationship is active or a payout may remain due. Payout transactions, invoices, account-change history, and acceptance evidence are kept for the applicable accounting, tax, anti-fraud, and legal-claims periods; data is then deleted or anonymized when no longer required.

Account/session data may be deleted or anonymized when it is no longer needed or when you request deletion, subject to legal retention duties.

You may request access, correction, portability, restriction, or deletion of your personal data and may object where processing relies on legitimate interests.

You may sign out of active sessions and request removal of account data that is no longer required.

To request deletion, use the data deletion page or email us directly.

You may complain to the Lithuanian State Data Protection Inspectorate (VDAI) or another competent supervisory authority. Contacting CARVA first does not limit that right.

When you choose Paysera, your personal and transaction data may be transmitted to Paysera and its acquiring bank for payment processing, fraud prevention and compliance with legal obligations. The acquiring bank may act as an independent data controller. The acquirer applicable to the payment is identified in Paysera's project or payment records; contact [email protected] for the relevant recipient and privacy information. Where recipients process data outside the EEA, applicable safeguards include an adequacy decision or EU standard contractual clauses and a transfer impact assessment where required. CARVA does not receive your full card number or security code from hosted checkout. Essential contract copies and legal receipts are sent to your real booking email even if you turn off optional service updates.