Privacy Policy

This Privacy Policy explains how Rovy Digital Ltd ("Rovy", "we", "our" or "us") collects, uses, shares and protects personal data when you use our website, create a Supplier Account or purchase Products through the Services.

Rovy is a company incorporated in England and Wales.

Rovy provides Merchant of Record services that enable Suppliers to sell digital Products worldwide. As Merchant of Record, Rovy acts as the contractual seller for Transactions processed through the Services and provides checkout, payment processing, tax handling, fraud prevention, settlements and related commerce services.

This Privacy Policy applies to:

• visitors to our website;
• Suppliers using the Services;
• Buyers purchasing Products through the Services; and
• individuals who communicate with Rovy.

Where additional privacy notices apply to a particular Service or Product, those notices supplement this Privacy Policy.

Rovy acts as an independent data controller for personal data processed in connection with:

• operating the Services;
• Supplier Accounts;
• Transactions;
• payment processing;
• fraud prevention;
• tax compliance;
• legal and regulatory obligations; and
• customer support.

Where Rovy processes personal data solely on a Supplier's documented instructions in order to provide the Services, Rovy acts as a data processor.

Suppliers remain responsible for their own collection and use of personal data in connection with their Products, websites, applications and customer relationships.

If you have questions about this Privacy Policy or how we process personal data, you can contact us using the details provided at the end of this Privacy Policy.

The personal data we collect depends on how you interact with the Services.

Information Suppliers provide. When a Supplier creates an account or uses the Services, we may collect:

• name and contact information;
• company information;
• billing and settlement details;
• tax information;
• identity verification and KYC information;
• account credentials;
• communications with Rovy; and
• other information required to provide the Services or comply with Applicable Laws.

Information Buyers provide. When a Buyer purchases a Product, we may collect:

• name;
• email address;
• billing address;
• country and region;
• Transaction details;
• payment status;
• device, browser and IP address information;
• fraud prevention and risk signals; and
• communications relating to a purchase or refund.

Rovy does not store full payment card numbers or card verification values (CVV/CVC). Payment credentials are collected and processed directly by PCI DSS compliant payment partners.

Information collected automatically. When you use the Services or visit our website, we may automatically collect information such as:

• IP address;
• browser type;
• operating system;
• device identifiers;
• pages visited;
• referring website;
• timestamps;
• usage information; and
• diagnostic and security logs.

We may also use cookies and similar technologies as described in our Cookie Policy.

We use personal data to:

• provide and operate the Services;
• create and manage Supplier Accounts;
• process Transactions;
• issue invoices and payment confirmations;
• calculate, collect and remit applicable taxes;
• process settlements;
• provide customer support;
• detect, prevent and investigate fraud, abuse and security incidents;
• comply with Applicable Laws, regulatory requirements and requests from competent authorities;
• communicate with Suppliers and Buyers;
• improve, maintain and develop the Services;
• protect the rights, property and security of Rovy, Suppliers, Buyers and third parties; and
• enforce our agreements, policies and legal rights.

We do not sell personal data.

Where UK GDPR or other applicable privacy laws require a legal basis for processing, we rely on one or more of the following:

Where we rely on legitimate interests, we take reasonable steps to ensure that our interests are balanced against your rights and freedoms.

Where consent is required, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal.

We may share personal data with:

• Suppliers, to deliver Products, provide support and manage customer relationships;
• payment service providers, banks and financial institutions;
• identity verification, fraud prevention and compliance providers;
• tax calculation and tax compliance providers;
• cloud hosting and infrastructure providers;
• analytics, communications and customer support providers;
• professional advisers, including legal, accounting and audit providers;
• regulators, law enforcement authorities and courts where required by Applicable Laws; and
• any successor entity in connection with a merger, acquisition, corporate reorganisation or sale of all or substantially all of our business or assets.

We require service providers processing personal data on our behalf to protect personal data and process it only for authorised purposes.

We do not sell personal data to third parties.

Personal data may be transferred to and processed in countries outside the United Kingdom or the European Economic Area.

Where we transfer personal data internationally, we implement appropriate safeguards as required by Applicable Laws, including:

• adequacy decisions;
• Standard Contractual Clauses;
• the UK International Data Transfer Agreement or Addendum; or
• other legally recognised transfer mechanisms.

You may request additional information about the safeguards we use by contacting us.

We retain personal data only for as long as necessary to:

• provide the Services;
• complete Transactions;
• process settlements, refunds and Chargebacks;
• comply with legal, tax, accounting and regulatory obligations;
• resolve disputes; and
• enforce our agreements.

Retention periods vary depending on the type of personal data and the legal requirements applicable to it.

Where personal data is no longer required, we securely delete, anonymise or otherwise dispose of it.

Depending on your location and Applicable Laws, you may have the right to:

• access your personal data;
• correct inaccurate personal data;
• request deletion of your personal data;
• restrict or object to certain processing activities;
• receive your personal data in a portable format;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a competent data protection authority.

Where Rovy processes personal data on behalf of a Supplier, we may direct your request to the relevant Supplier or assist the Supplier in responding, as required by Applicable Laws.

We may request information necessary to verify your identity before responding to a request.

Rovy maintains appropriate administrative, technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration and destruction.

These measures may include:

• encryption in transit;
• access controls;
• authentication and authorisation controls;
• security monitoring and logging;
• regular security reviews; and
• the use of PCI DSS compliant payment partners for payment processing.

While we take reasonable steps to protect personal data, no method of transmission over the Internet or electronic storage is completely secure.

We use cookies and similar technologies to:

• operate the Services;
• remember preferences;
• maintain secure sessions;
• understand how the Services are used; and
• improve the performance of our website.

Where required by Applicable Laws, we obtain your consent before placing non-essential cookies.

For more information, please see our Cookie Policy.

We use automated systems to help detect fraud, prevent abuse, comply with legal obligations and protect the security of the Services.

These systems may analyse Transaction information, device information, payment data and other relevant signals to determine whether additional verification or manual review is required.

Where Applicable Laws provide rights relating to automated decision-making, you may request human review by contacting us.

The Services are not directed to children under the age required by Applicable Laws to provide valid consent for the processing of their personal data.

We do not knowingly collect personal data from children without appropriate legal authority.

If you believe that a child has provided personal data to Rovy in error, please contact us and we will take appropriate steps to investigate and, where required, delete the information.

We may update this Privacy Policy from time to time.

When we make material changes, we will update the "Last Updated" date and, where required by Applicable Laws, provide additional notice.

The latest version of this Privacy Policy will always be available on our website.

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

Rovy Digital Ltd
128 City Road, London EC1V 2NX, United Kingdom
Email: [email protected]

If you are not satisfied with our response, you may have the right to lodge a complaint with the data protection authority in your country or, where applicable, with the UK Information Commissioner's Office (ICO).