When it comes to your personal data, safety and transparency take top priority here at Rolle. To help you understand what information we collect about you, how we use it and what rights you have, we’ve prepared this detailed Privacy Policy.

1. General

2. Why and how do we collect and use your personal data?

3. Personal data recipients

4. Use of cookies

5. Right of amendment

6. Your statutory rights regarding your personal data

7. Our contact details

1. General

This Privacy Policy applies to the online platform Rolle (“Website”) and to the associated app (“App”) (the Website and the App are jointly referred to as the “Platform”).

The Platform is operated by Rolle Technologies P.C., a company registered in Greece, with business location at 2 Merlin, Str. 10672, Athens. The operator is further referred to as “We”, “Us” or “Rolle”. More details about how to get in contact with us can be found at the end of this Privacy Policy under No. 7.

The protection of your personal data is very important to us. All personal data is collected, stored and processed in accordance with Regulation (EU) 2016/679 of the European Parliament and Council (General Data Protection Regulation, GDPR for short) and/or other applicable legal provisions.

The services offered by us via the Website and/or App can function only if we collect, store, transfer, delete and/or otherwise use (“collect and use”) specific data relating to you (“personal data” or “data”). Personal data means all information relating to an identified or identifiable natural person such as your name, date of birth, address, or email address.

This Privacy Policy describes what type of data we collect from you and for what purposes we collect and use it when you use the services offered by Us on the Platform. This Privacy Policy also contains important information on the protection of your data, especially the statutory rights you have in connection with it.

Certain services on our Platform are offered by third-party suppliers. When you use these services, the data protection regulations that govern third-party suppliers will then apply in addition to this data protection statement. Prior to your use of such services, the third-party suppliers shall require you to provide your express consent for the processing of your personal data under the GDPR or other applicable data privacy regulations.

Under applicable data protection laws, Rolle is obligated to inform you about data processing and Rolle fulfills this obligation within this Privacy Policy. This Privacy Policy and any parts of it are not meant as contractual clauses and do not form part of the general Terms and Conditions (“GTC”) (available via the link https://rolle.io/en-GR/content/info/terms-and-conditions) as a contract that is concluded with registered users. Under applicable data protection laws, Rolle can process data that is necessary for the fulfillment of a contract with you or necessary for taking steps at your request prior to entering into a contract (Art. 6 (1) (b) GDPR). References to the GTC should always be understood as information on data processing (Art. 13 and 14 GDPR) and never as clauses that form part of the GTC. By using the Platform and our services, you enter into a legally binding contract between you and Rolle, the conditions of which are described in the GTC.

2. Why and how do we collect and use your personal data?

2.1. To enable you to use the Platform, allow us to provide our services and perform our GTC

We collect and use your personal data to allow you to use our Platform, to provide our services and to fulfill a contract (GTC) with you and above all, to carry out commercial transactions via the Platform, to use the electronic payment system or to leave reviews. To use these services, you need a Rolle account. For this purpose, you must register as a member on the Website or App.

Most of your personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you. A portion of your data is required to fulfill our legal obligations when you become a member of our Platform. If you do not provide us with this personal data, we will not be able to comply with legal requirements or provide our services.

This data is also used for improvement of the Platform in order to enhance user experience for our members (see 2.2.12).

We collect and use your personal data for these purposes until your Rolle account is deactivated or up to five years after your account has become inactive.

2.1.1. To enable registration on the Platform

When you register as a member on the Platform, you must provide the following data in order to complete the registration procedure and access your Rolle account:

• Username; 
• Full name;
• Email address;
• Mobile number;
• Address;
• ZIP code;
• Profile photo;
• Metadata of the photo you upload (geolocation, ID number of device, date and time of photo taken, etc.);
• Confirmation that you are aged over 16;
• Password (necessary when you register without a Facebook or Google account).

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (b) of the GDPR).

We also determine your location (country) based on your (User’s) input. You can choose to change your location (country, city or region) at any time by going to “My settings” in your Rolle account.

We collect and use your personal data for these purposes until your Rolle account is deactivated or up to five years after your account has become inactive.

2.1.2. To authenticate your identity via Google, Facebook or using an Apple ID

If you register using your Google Ireland Ltd. (Ireland), Google LLC (USA) (“Google”) or Meta Platforms Ireland Ltd. (Ireland), Meta Platforms, Inc. (USA) (“Facebook”), or Apple Inc. (USA) (“Apple”) account or later on decide to link your Google, Facebook or Apple account to your Rolle account, you will be transferred from our Platform to the Google, Facebook or Apple website and asked to enter the log-in information for your Google, Facebook or Apple ID account.

If you enter your Google log-in information, Google will share the following data with Rolle from your Google account (you may choose not to provide some data):

• Profile photo;
• Full name;
• Google account ID;
• Email address.

If you enter your Facebook log-in information, Facebook will share the following data with Rolle from your Facebook account (you may choose not to provide your email address):

• Profile photo;
• Full name;
• Email address;
• Facebook account ID.

If you enter your Apple ID log-in information, Apple will share the following data with Rolle from your Apple ID account (you may choose not to provide your email address by using Apple’s Private Email Relay Service):

• Full name;
• Email address;
• Apple ID.

The data we obtain from Google, Facebook or Apple will be used to set up your Rolle account. This means that we will use the member name from your Google, Facebook or Apple ID account as your Rolle account member name so that it will be visible to other visitors to the Website and App users. No other data obtained from Google, Facebook or Apple will be visible to anyone on the Platform.

You can, at any time, unlink your Google, Facebook or Apple ID account. This can be done under “My settings” in your Rolle account. If, however, when you initially registered, you did so without linking your Google, Facebook or Apple ID account, you can create such a link later.

If, however, when you initially registered, you did so without linking your Google, Facebook or Apple ID account, you can create such a link later.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (a) of the GDPR).

We collect and use your personal data for these purposes until your Rolle account is deactivated or up to five (5) years after your account has become inactive.

2.1.3. To enable you to set up your profile information

If you decide to add profile details to the account you create on the Platform, we collect and use the following data when you choose to provide it:

• Full name;
• Gender;
• Date of birth;
• Address;
• Profile photo;
• Metadata of the photo you upload (geolocation, ID number of device, date and time of photo taken, etc.);
• Your favorite items;
• Current and past listings;
• Whether you have enabled Marketing Communications;
• Information that you choose to provide in the “About You” section.

Your username, profile photo, city of your address, listings (current and past) and reviews are visible to other Platform visitors, but the remainder of the data entered by you is not visible.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (a) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years. Photo metadata containing personal data is deleted immediately.

2.1.4. To show other members relevant information regarding your activity on the Platform

When you are a registered member on the Platform, we collect, use and make public on the Platform the following information in order to provide other members with relevant information:

• Last login date;
• Verification fact;
• City;
  Reviews given and received;
• Active and Past listings;

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.1.5. To enable you to list your items

If you list items on the Platform, we will collect and use the following data for the purpose of creating, publishing and deleting listings on the Platform (the required information differs depending on the chosen item category):

• Item category;
• Item description;
• Item brand;
• Item model;
• Item condition;
• Item color;
• Item capacity;
• Item accessories;
  Item accessories description;
• Item photos;
• Item number;
• Metadata of the photos you upload (geolocation, device ID number, date and time of photo taken, etc.);
• IMEI (only when selling smartphones);
  Serial number (when selling tech gadgets, other than smartphones);
• Information on the condition of the device;
• Price;
• Discount;
• Information as to whether the item is marked as reserved;
• Shipping options;
• Parcel size;
• Reasons for deleting the item.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (a) of the GDPR).

Personal data collected and used for this purpose is kept for five (5) years. Deleted items and their photos are stored for 6 months. Photo metadata containing personal data is deleted immediately.

2.1.6. To enable notifications on the Platform for you

When you are a registered member on the Platform, we will provide you with notifications on the Platform regarding important updates and actions that you need to take e.g. when you receive an order request and you have to reply to the buyer.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (b), of the GDPR) and (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five t (5) years.

2.1.7. To enable you to leave reviews for other members on the Platform

If you leave reviews for other members, Rolle collects and uses the following data for the purpose of making the reviews publicly available on the Platform:

• Review;
• Star rating;
• Member username;
• Photo of the Item;
• Date and time of the review;
• Reply to the review.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (a) of the GDPR).

You can, at any time, edit or delete your reviews left for other members.

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.1.8. To receive reviews from other members

When you receive reviews from other members, we will collect and use the following data for the purpose of making the reviews publicly available on the Platform:

• Review;
• Star rating;
• Member username;
• Photo of the Item;
• Date and time of the review;
• Your reply to the review.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.1.9. To address your public feedback about us 

If you leave a public review or other feedback about the Platform, we collect and use the following data for the purpose of addressing your feedback:

• Full name;
• Country;
• Language (if you leave your feedback on the App Store or Google Play);
• Feedback;
• Date and time of feedback;
• Link to feedback;
• Technical data related to browser, device type and operating system (if you leave your feedback on the App Store or Google Play).

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose for up to five (5) years.

2.1.10. To send you important Platform communication 

If you register on the Platform, we will send you emails and messages via the Platform’s messaging system for the purpose of providing important notifications such as GTC, Privacy Policy changes.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (b), of the GDPR) and (Art. 6 (1) (c) of the GDPR).

We collect and use your personal data for this purpose for up to five (5) years.

2.1.11. To send you offers via the Platform’s notification system

If you register on the Platform, we will send you offers related to Rolle services via the Platform’s messaging system (“Offers”).

Legal basis for the collection and use of data is our legitimate interest in providing offers to our members (Art. 6 (1) (f) of the GDPR); Article 13 (2) of Directive 2002/58/EC of the European Parliament and of the Council of July 12, 2002 on the processing of personal data and the protection of privacy in electronic communications (Privacy Directive for Electronic Communications).

Rolle uses third-party service providers to send the offers, operating within the European Economic Area. In case the providers are not operating in the European Economic Area, this may result in your data being shared with our customer support agents outside the European Economic Area. In these instances, the personal data is protected by the service providers entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission.

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.1.12. To provide you with customer support service

When you send us a question, inquiry or complaint, we collect and use the following information to provide you with the Platform customer service you have requested::

• Your profile information;
• Platform usage information;
• Transaction and pay-out information;
• Shipment information;
• Communications;
• Age;
• Gender;
• IP address;
• Session information;
• Item listings, photos and videos;
• Requests;
• Other information submitted by you.

The type of information we collect may vary depending on your inquiry.

The legal basis for the collection and use of data is the fulfillment of the contract between you and us in compliance with the applicable General Terms and Conditions (Article 6 (1) (b) of the GDPR).

In order to respond to your requests, Rolle might provide your data to customer support service providers, operating within the European Economic Area. In case the providers are not operating in the European Economic Area, this may result in your data being shared with our customer support agents outside the European Economic Area. In these instances, the personal data is protected by the service providers entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission.

Personal data collected and used for this purpose is kept for 5 years after the last update related to your inquiry. If your account is deleted, personal data collected and used for this purpose will be deleted along with your account.

2.1.13. To resolve any purchase-related disputes between members

If you purchase and/or sell items on the Platform and are involved in a dispute with another member, we will collect and use any of your personal data held by Rolle necessary to solve the dispute.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR) and (Art. 6 (1) (c) of the GDPR).

Personal data collected and used for this purpose is kept for five (5) years after the conclusion of a dispute.

2.1.14. To provide item verification service

We offer item verification service on our Platform. An item is checked and verified by our experts, before being uploaded in our Platform, we collect and use the following data:

• Information about the item undergoing verification;
• Verification results;

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).

We collect and use your personal data for this purpose for 5 years after the completion of the verification.

2.1.15. To resolve any purchase-related disputes between members

If you purchase and/or sell items on the Platform and get involved in a dispute with another member, we will collect and use any of your personal data held by Rolle necessary to solve the dispute.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR) and (Art. 6 (1) (c) of the GDPR).

Personal data collected and used for this purpose are kept for 5 years after a dispute is concluded.

2.1.16. To temporarily retain your deactivated account

If you decide to deactivate your account, we will take all reasonable efforts to make sure it is no longer viewable on the Platform and restrict the use of your personal data. For up to three (3) months, it is still possible to restore your account if it was accidentally or wrongfully deactivated or in case you change your mind and wish to return to the Platform and take action in the event that someone other than yourself gained access to and deleted your account without your knowledge.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR) and (Art. 6 (1) (c) of the GDPR).

Personal data is kept for this purpose for three (3) months from the date of deactivation of your Rolle account.

After three (3) months, we permanently delete your account from our Platform. 

2.2. To improve your experience when using the Platform

We collect and use your personal data in order to improve your experience when using the Platform by enabling you to personalize your feed and search results, providing you relevant suggestions and storing your previous searches, sending you notifications and otherwise making the use of Platform more pleasant.

Specific applicable legal basis for the collection and use of your data is described in each section below.

2.2.1. To enable your preferences regarding your feed and search results

If you choose to personalize the items presented to you on the Platform (on item feed, catalog and search results), we will collect and use the following data for the purpose of presenting you a feed personalized based on your preferences:

• Preferred brands of the items;
• Preferred models of the items;
• Preferred condition of the items;
• Preferred prices of the items.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (a) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.2.2. To personalize your feed and search results

We also personalize item feeds by evaluating your preferences according to the following:

• Gender;
• Age;
• Country;
• Language;
• Information about your browsing activity on the Platform;
• Purchasing history;
• Your preferences.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.2.3. To prioritize high value items for sale by reputable sellers

In order to determine whether you, as a reputable seller, offer high value items, we will collect and use the following data from you when you sell your items on the Platform:

• Number of positive reviews;
• Information as to whether the seller has items that are 60% cheaper than similar items sold on the Platform (similarity is determined according to item category, brand and condition).

We use results to prioritize high value items sold by reputable sellers when showing items to new members, and increase the visibility of items uploaded by members that have chosen the same language as you and/or live in the same country or region, items listed by new members, items that have three (3) favorites or more, items that are boosted, and we show relevant items on the Platform.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.2.4. To recommend relevant items to you

If you choose to create item listings on the Platform, we will collect and use data you provide in the listing (see 2.1.5 above) by analyzing it in order to either offer members who clicked on your items other relevant items or offer them to members to whom your items may be relevant.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.2.5. To suggest relevant item descriptions

When you create item listings on the Platform, we collect and analyze the data you provide in the listing (see 2.1.5 above) to suggest the most appropriate description for your listing.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.2.6. To improve search results on the Platform

We collect and use data provided in the item listings (see 2.1.5 above) with no seller-related information in order to improve search results by evaluating the degree of relevance of certain items with respect to a specific search keyword and to automatically suggest relevant categories for new listings. For this, we only use the item listing without any link to a particular seller.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

Rolle uses service providers who provide data analysis services to Rolle.

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.2.7. To save your recent searches

In order to help you find previously searched items on the Platform, we save your search keywords. We collect and use the following data for the purpose of providing information about newly listed items on the Platform based keywords from your previous searches:

• Your search history (most recent keyword searches);
• Date and time of your search;
• Number of newly listed items.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

You can delete your search history at any time.

Unless you delete your search history earlier, we collect and use your personal data for this purpose for up to thirty six (36) months.

2.2.8. To help you draw more attention to your listings

Should you order extra services, i.e. boost listing in order to increase your items’ visibility on the Platform, we collect and use the following data:

• Your profile information;
• Extra services you bought;
• Items you selected for extra services;
• Duration of extra services;
• Date and time of extra services you bought;
• Price of extra services;
• Payments information;
• Invoices;
• Statistics related to your items during the usage of extra services.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).

Personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into or fulfill a contract (GTC) with you.

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.2.9. To suggest a price or set a cap upon creation of an item listing

If you choose to create an item listing on the Platform, our algorithms will analyze its price in addition to the item category, item brand and item condition. We will then use that information to show you pictures and prices of similar items sold in the last three months in order to help you determine the selling price for your item.

If the selling price you chose is above the price range for similar items sold on the Platform in the last three months, Rolle will also give you a tip regarding the recommended price range and set a cap based on the item’s face value.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

To perform the above function, we collect and use pictures and prices of items sold in the last thirty six (36) months.

Upon listing your items, we collect and use such information to analyze your items throughout the item listing process. Upon sale of your items, we collect and use the data mentioned above for thirty six (36) months after the item’s sale.

2.2.10. To enable notifications about your favorite items

If you favorite an item listed by another member on the Platform, Rolle will inform you when the price of your favorite Item goes down or when the item is sold. For this reason, we will collect and use the following data:

• Title of favorited item;
• Photo of favorited item;
• Seller of favorited item;
• Price of favorited item;
• Information whether favorited item is sold;
• Information about a price reduction.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.2.11. To notify sellers when you favorite their items

If you favorite an item on the Platform, Rolle will inform the seller that you have favorited their item.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

You can disable these notifications by logging in to the Platform, going to Privacy Settings and changing the appropriate settings.

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.2.12. To improve our Platform

Rolle is committed to the Platform’s optimal performance. While the Platform is in use, Rolle gathers information about actions performed on the Platform (button clicks, visiting time, notifications read, other information based on a given business case) and other data described under 2.1, 2.2, 2.5, 2.6 and 4 of this Privacy Policy in order to help us make decisions on how to improve the Platform and make it a better experience for our members.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.2.13. To conduct surveys

We are always looking for ways to improve your user experience with Rolle. As such, you may be invited to participate in a survey and your feedback may be used. For this purpose, we collect and use the following data:

• User ID;
• Your gender;
• Your age;
• Your country;
• Your region;
• Your city;
• Your past orders;
• Your past listings;
• Your responses to our questions (e.g., your satisfaction with the Platform, your needs involving the Platform, problems that you encounter using the Platform).

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR) and (Art. 13 (2) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.2.14. To conduct interviews

In order to understand our users’ needs and improve your experience on the Platform, we conduct on-site or online interviews with you. For this purpose, we collect and use the following data:

• User ID;
• Your gender;
• Your age;
• Your interests;
• Your country;
• Your region;
• Your city;
• Your past orders;
• Your past listings;
• Recording of your interview;
• Other data you voluntarily submitted during the interview.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

If you wish to participate in the interview, the information above will be collected based on your consent (Art. 6 (1) (a) of the GDPR).

2.2.15. To enable you to share your user journey

We are making constant improvements to our Platform and look for ways to improve your experience while using Rolle. If you agree, we enable you to share your user journey through our Platform. In so doing, we will collect and use the following data:

• User ID;
• Your contact details;
• Date and time of the survey;
• Category to which you are assigned (e.g. new member of our Platform);
• Your screen recording;
• Your voice recording;
• Your face recording.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

If you wish to participate in the survey, the information above will be collected based on your consent (Art. 6 (1) (a) of the GDPR).

2.3. To ensure the security of your account and the Platform

Rolle strives to ensure that our member accounts and the Platform itself are secure and protected from cyber-attacks, unauthorized access and other similar risks.

2.3.1. To track visits to the Platform for security purposes

When you connect to the Website or App, we collect and use the following data (log files), even if you are not logged in to the Website as a member:

• User ID;
• IP address of your device;
• Browser used by your device;
• Content and URLs you connect to;
• Date and time of your connections.

For access via mobile devices, the following log files are also recorder as part of your use of the Rolle App:

• Model and manufacturer of your mobile device;
• Operating system used by your mobile device (iOS, Android, etc.).

This data is used for security purposes, especially the prevention of cyber-attacks such as data scraps and denial of service attacks and to prevent unauthorized multiple applications.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

Personal data collected and used for this purpose is kept for thirty six (36) months.

2.3.2. To help you avoid using a compromised password

If you decide to register using a password or subsequently decide to change your password, we will check it against a database of passwords compromised in previous data breaches having occurred on other platforms and through other services. To enable this functionality, we take the password, hash it and then use the first 5 characters of the hash to Have I Been Pwned (https://haveibeenpwned.com/) to conduct a search in the database for compromised passwords.

By performing this check, we are able to protect your account by confirming that you are using a password not known to be compromised.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use personal data for this purpose only for the duration necessary to perform the password check.

2.3.3. To allow you to reset your password

If you forgot your password or decide to change it for other reasons and do not have access to your email, we may ask you to answer a few security questions to verify your identity. For this purpose, we will collect and use the following data:

• Email address;
• Date of birth;
• Registration date;
• Last transaction information.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.3.4. To verify your account in case of suspicious activity related to your account

If we detect activity on your account considered to be suspicious by Rolle, we will ask you to perform a basic verification by confirming your email, Facebook, Apple or Google accounts. For the purpose of performing a basic verification, we will collect and use the following data:

• Email address; or
• Information received during Apple or Facebook or Google authentication (as described 2.1.2 above).

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.3.5. To conduct phone number and two-step verifications

Should you decide to apply an additional layer of protection to your account and activate phone verification, we will use your phone number in order to enable this function. Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

You may also be asked to verify your phone number in case of suspicious activities on your account. In that event, legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).

When you verify your phone number, Rolle will collect and use your phone number for two-step verification purposes.

Personal data for mandatory verifications is required to enter into and fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.

In order to carry out phone number and two-step verifications, we might use a third service provider, enabling us to send you verification messages or make verification calls to dictate verification code if you do not verify your phone number within 5 minutes. The data is protected by the service provider entering into the EU Standard Contractual Clauses or in case your data is being shared outside the European Economic Area, the data is protected by the service provider entering into the EU Standard Contractual Clauses for the transfer of data as approved by the European Commission.

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.3.6. To carry out payment source security checks

As part of the security process, we ask our members to provide verification of their payment source. In order to perform such security checks, Rolle collects and uses the following personal data:

• Username;
• When we perform a payment card security check – information contained in a photo of the payment card: full name, card’s expiration date and the last four digits of the card number, other information visible on the front of the card if the member chooses not to cover it;
• When we perform a bank account security check – information contained in a photo/screenshot of the bank statement listing the most recent charge/charges: date and description of the last Rolle charge, other payment information if the member chooses not to redact other information.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

Personal data collected and used for this purpose is kept for four (4) days after the security check is passed.

2.3.7. To prevent fraudulent payments

To ensure secure payments on the Platform and uphold our GTC, we may check payments for any signs of fraudulent activities, such as unauthorized use of credit/debit card or payment information, fake transactions, etc.

If we come across such payments, we take appropriate measures as outlined in our GTC, which may include a thorough review of the transaction, cancellation of the payment, or even blocking the associated member’s account.

To detect and cancel suspicious payments, we may use fully automated tools. By doing so, we can prevent fraudulent activities in an efficient and timely manner, ultimately protecting our members from harm. We use means to ensure a high precision rate and accuracy of our automated tools, including manual reviews of automated decisions.

The following categories of data are used to prevent fraudulent payments, including making the automated decisions for detecting and cancelling suspicious transactions:

Credit/debit card data;

Transaction data;

Registration data;

Session data;

Activity on the Platform data;

Delivery data;

Security data.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).

We collect and use your personal data for this purpose for five (5) years after the payment verification procedure.

2.3.8. To ensure listing compliance with our Ownership and Originality of listed items

For some listings, we collect and use the following data in order to ensure that such listings comply with our Ownership and Originality of listed items:

• Information provided in the listing (see 2.1.5 above);
• Information on the item’s authenticity: photos of e.g., the receipt, original packaging, serial number or any other relevant information that would demonstrate the item’s authenticity (e.g. IMEI for smartphones)

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We may share photos of listings or other proofs of authenticity free of your personal data with brand owners in order to verify certain items.

Personal data collected and used for this purpose is kept for five (5) years when it is necessary to solve disputes between our users.

2.3.9. To facilitate the exercise of intellectual property rights

Intellectual property right holders (or their representatives) can complete our Intellectual Property Infringement Report. Within this report, Rolle collects and uses the following personal data:

• Full name;
• Email;
• Country;
• City;
• Address;
• ZIP Address;
• Name of the organization represented;
• Relationship with the rights owner;
• IP right / copyright / patent / trademark / design data;
• Infringement data.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

Personal data collected and used for this purpose are kept for five (5) years.

2.3.10. To carry out account ownership checks

As part of the security process, we may ask our members to verify ownership of their Rolle account. To confirm your identity, we will need one of the following as proof:

• A photo/screenshot of your bank statement showing your most recent Rolle charge(s);
• A photo/screenshot of the expanded version of the Paypal statement showing the most recent Rolle order (the date, total amount, shipping address and account holder’s name should be visible);
• Proof of address: it can be a household utility bill with your name and current address that is no longer than 3 months old (e.g., gas, electricity, water, landline telephone; cellular phone bills are not permitted), or a photo/screenshot of your bank statement showing your billing address;
• A photo of your credit card used for your purchases on Rolle (the photo needs to include the cardholder’s full name, and the card’s last four (4) digits and expiration date);
• A photo of your National ID or Passport.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

Personal data collected and used for this purpose is kept for four (4) days from receipt of the proof.

2.3.11. To allow you to report inappropriate behavior or content

If you would like to report inappropriate messages, members, items, spam or spoof mail, we will collect and use the following data for the purpose of ensuring the security of the Platform and its members:

• Reported content;
• Reporting reason;
• Information provided in the report;
• Date and time of your report.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.3.12. To report suicidal posts

In exceptional cases, where we notice suicidal posts on our Platform, we may report them to the police. In such cases we will collect and use and disclose the following data for the purpose of reporting suicidal posts:

• Username;
• E-mail address
• Full name;
• IP addresses and last logins;
• Telephone number (if verified);
• Print screen/link of forum post or thread where the suicidal declaration appears.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (d) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.4. To supervise compliance with and enforce GTC

Rolle actively supervises compliance with and enforces GTC for the purpose of ensuring the security of your account and that of the Platform.

2.4.1. To calculate the trust score

In order to ensure the security of the Platform and its members, Rolle gives each member a “trust score” calculated using an algorithm, and maintains a database of unlawful activities typically performed by bad actors. The “trust score” indicates the likelihood of improper use of the Platform.

Our algorithm takes into account members’ reviews received or given, items listed on the platform, transactions, reports from other members on that member, the member’s profile and contact information, connected social media accounts to the Rolle profile, the member’s violations of our GTC, IP addresses, and browser fingerprints, other content provided to use by the member.

When member evaluations meet certain thresholds, the member’s usage of the platform is restricted or the member is asked to verify his/her telephone number, email, Facebook, Apple, or Google accounts.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.4.2. To identify and prevent malicious accounts and activities

In order to ensure the security of the Platform and its members, Rolle collects and maintains a database of keywords indicating malicious accounts and activities. This database may contain emails, certain words or phrases found in reviews, Items descriptions and other relevant data. By matching members’ activity against the keywords in the database, we can identify and prevent bad actors more effectively.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.4.3. To enforce spam filtering

In order to protect our members and the Platform, we use spam filtering tools. These tools include a list of keywords that are commonly associated with spam. If your messages include these keywords, they are stopped by the above-referenced tools and reviewed manually before being sent to other members.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.4.4. To moderate your activity on the Platform

In order to ensure the security of the Platform and its members we regularly moderate your activity on the Platform. We may check your listings automatically or we may check your listings, reviews upon receipt of reports from other members or third parties.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.4.5. To issue and enforce warnings

As a member, if you violate our GTC or take other actions that result in a warning being issued to you, we collect and use the following data to issue and enforce the warning:

• Username;
• Type of warning issued to member;
• Date of warning issued to member.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.4.6. To delete or hide items that violate Rolle GTC

If you list items that violate our GTC, we will remove or hide them. However, we will retain deleted listings as proof of the violation. For this purpose, Rolle uses personal data included in the listing as specified under 2.1.5.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

Deleted listings are stored up to ninety (90) days after their removal.

2.4.7. To detect and lock compromised accounts

In order to protect our members and the Platform, we regularly check for suspicious activities to detect compromised accounts. If we determine that your account may be compromised or at your request, we may lock your account.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.4.8. To suspend members

If you cancel too many order requests in a short period of time, you may get suspended for a period of time. For this purpose, Rolle collects and uses the time and duration of the suspension.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.4.9. To block members’ accounts and enforce blocking

Depending on your usage of the Platform, and as explained in our GTC, your account may be blocked, either temporarily or permanently.

Rolle might use fully automated tools for such blocking of an account when it comes to ensuring the integrity of the Platform and the provision of safe services. Such automation is needed for Rolle to manage the security on the Platform efficiently and avoid harm to other members.

The data categories used for making the decision are as follows:

Registration data;

Your activity on the Platform;

Session information;

Information provided in the listings;

Communication data;

Your settings and preferences.

We establish profiles of harmful users such as scammers, sellers listing counterfeited items, users cheating our shipping services, based on criteria identified by Rolle, notably as a result of reporting on harmful users. The automated tools automatically detect harmful profiles which leads to a decision to block the respective accounts. Rolle uses means to ensure a high precision rate and accuracy of its automated blocking system, including manual reviews. The effects of blocking are described in our GTC. 

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).

We collect and use your personal data for making the decision on the blocking of your account until the deletion of your Rolle account.

When your account is blocked, we collect and use the following data to enforce blocking:

Your account data;

Data related to the blocking of your account, e.g. reason, date, and time of the blocking.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data up to five (5) years upon blocking your account.

2.4.10. To enforce IP blocks

If there are signs of cyber-attacks or other risks to the Platform’s security coming from your IP address, in order to protect the platform, we will collect and use your IP address and block it.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

Personal data collected and used for this purpose is kept for five (5) years.

2.4.11. To restrict the fraudulent use of payment instruments 

If there are signs of any fraudulent activity with your payment instrument (e.g. credit/debit card), we will collect and use your payment instrument and order data to protect the Platform by restricting the use of your payment instrument.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).

Personal data collected and used for this purpose are kept for the duration of the restrictions applied.

2.5. To enable your payment for items

Payments made on the Platform are carried out via payment service providers that offer payment processing and escrow services. 

Most of your personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you (Art. 6 (1) (b) of the GDPR). Part of your data is required to fulfill our or our payment service providers’ legal obligations when you are a member of our Platform (Art. 6 (1) (c) of the GDPR). If you do not provide us with this personal data, we or our payment service providers will not be able to comply with legal requirements nor will we be able to provide our services.

This data is also used for improvement of the Platform in order to make it a better experience for our members (see 2.2.12).

2.5.1. To allow you to make a purchase or add a payment card for payment purposes

When you add a payment card or purchase an item or our extra services via the Platform, we collect and use the following data for the purpose of allowing you to make payments:

• Full name;
• First six and last four digits of your payment card number;
• Expiration date.

When you add a payment card or purchase an item or our extra services via the Platform, relevant payment service provider (please see 2.5.3 and 2.5.4 below) receives the following data:

• Payment card holder’s full name;
• Payment card number;
• Expiration date;
• Security code (CVV/CVC) number.

Legal basis for the collection and use of data is the fulfillment of a contract (compliance with our GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).

Personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.

If you agree, we will store your bank card details for future use.

Legal basis for such collection and use is your consent (Art. 6 (1) (a) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.5.2. To allow you to add a bank account for withdrawal purposes

When you add a bank account for withdrawal purposes, we collect and use the following data to allow you to withdraw money:

• Account holder’s full name;
• Account number;
• Address.

Legal basis for the collection and use of data is the fulfillment of a contract (compliance with our GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).

Personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.5.3. To enable you to pay and receive payments on our Platform

If you opt to pay a seller or for extra services by payment card or other payment method integrated on the Platform, or if you use other services on the Platform for which a charge is made, the transaction in question will be collected and used via the electronic payment system STRIPE CONNECT (see our GTC), which is operated by STRIPE, Inc. (Dublin) (“STRIPE”). On behalf of Rolle, STRIPE will collect the payment information based on the payment method selected (e.g. payment card, etc.). The payment will then be implemented via STRIPE and the payment scheme owner or facilitator of the payment method you have selected. To this extent, the data protection rules of STRIPE and the payment scheme owner or facilitator of the payment method you have selected will apply.

For more information on payment procedure, see Article 6 of our GTC. If you use a payment card as your payment method, Rolle will see only the card holder’s full name, the first six and last four digits of your payment card number and expiration date.

This information will be used by us solely for the purpose of confirming payment. The rest of the card data is masked and forwarded to STRIPE to handle the transaction.

Legal basis for the collection and use of data is the fulfillment of a contract (compliance with our GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).

Personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

Additionally, if you are a seller on Rolle and you want to receive payments from buyers through the above electronic payment system for the purchase of your products, you will have to accept STRIPE’s Terms and Conditions and create a Custom Connect account with STRIPE. In order to do so, you must provide the following data:

• Full name;
• Date of birth;
• Address;
• IBAN;
• VAT identification number (optional).

STRIPE processes this information in accordance with applicable laws and as described in STRIPE’s Privacy Policy.

For this purpose, Rolle implemented STRIPE’s API – a technical measure that allows you to submit your information and other data to STRIPE without leaving the platform. All information goes straight to our payment provider STRIPE without being saved on our systems.

Legal basis for the collection and use of your personal data is the fulfillment of a contract (compliance with our GTC and STRIPE’s Terms and Conditions) to which you are a party (Art. 6 (1) (b) of the GDPR).

Personal data is required to fulfill contracts (GTC and STRIPE Terms and Conditions) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill contracts with you.

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.5.4. To implement Know Your Customer (KYC) checks on our Platform

Whenever you reach the KYC thresholds which are set by STRIPE, STRIPE will ask you to provide a copy of your passport or ID card or driver’s license, including temporary licenses and a copy of Utility bill. In that case, we will enable STRIPE to collect the following data from you in order to allow STRIPE, as payment service provider, to perform an identity check (so-called Know Your Customer, KYC):

• Full name;
• Date of birth;
• Address;
• VAT identification number;
• Email address;
• Information present on the provided document (exact list depends on the document provided): document number, picture, gender, nationality, date of issue, expiration date, place of birth, personal code, signature, other information on a particular document.

As a separate safety check, STRIPE may also request a photo/screenshot of the bank statement listing transactions for a one-month period. In that case, we collect the following information as requested by STRIPE:

• Full name;
• Date of birth;
• Country;
• Address;
• Information present on the provided statement: account holder’s full name, transaction history (deposits, charges, withdrawals) and other information present on a particular statement.

For this purpose, Rolle implemented STRIPE’s API – a technical measure that allows you to submit a copy of your document and other data to STRIPE without leaving the platform. All document copies go straight to our payment provider STRIPE without being saved on our systems.

This is necessary in order to fulfill our legitimate interest to provide STRIPE with necessary information for their compliance with the legal obligations to which STRIPE is subject (Art. 6 (1) (f) of the GDPR).

2.5.5. To issue refunds

If you purchase an item and it is never shipped, arrives damaged or is not as described and you issue a claim, we collect and use the data used to make a purchase (see 2.5.3 and 2.5.4) for the purpose of issuing a refund.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are party (Art. 6 (1) (b) of the GDPR).

Personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.

Transaction data is kept for five (5) years from the day of transaction.

2.5.6. To keep financial records

If you participate in purchase-sale and/or other transactions when using the Platform, Rolle will collect and use the following data in order to carry out its accounting-related duties:

• Full name;
• Username;
• Address;
• VAT identification number (where applicable);
• Value and description of supplied goods and/or services.

This is necessary in order to comply with the legal obligations to which Rolle is subject (Art. 6 (1) (c) of the GDPR).

Financial regulations require us to keep accounting documents that confirm the transactions for ten (10) years.

2.6. To enable shipment of items purchased on the Platform

Rolle strives to make the shipping of items purchased on the Platform as smooth and convenient as possible by offering shipping methods on the Platform.

Most of your personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.

This data is also used for improvement of the Platform in order to make it a better experience for our members (see 2.2.12).

2.6.1. To enable you to ship or receive items

If you choose to enter your shipping information or when you buy or sell items, we collect and use the following data that you provide for dispatch and shipping purposes:

• Full name;
• Country;
• City;
• Telephone number;
• E-mail address;
• Signature;
• Address of the package drop off point;
• Package tracking number;
• Confirmation of package delivery;
• Other shipping information required by a particular shipping service provider.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).

Personal data are required to perform a contract (GTC) with you. In case you do not provide us with this personal data, we will not be able to conclude and execute a contract (GTC) with you.

We provide personal data collected and used for this purpose to the shipping provider integrating its shipping services with Rolle.

Personal data collected and used for this purpose is kept for five (5) years.

2.6.2. To track your parcel

When you buy or sell items on the Platform, we collect and use the following data for shipment tracking purposes:

• Date and time of package delivery;
• Package tracking number;
• Address;
• Package location of the parcel.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).

Personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.

Personal data collected and used for this purpose is kept for five (5) years.

2.7. To carry out marketing activities

Rolle seeks to involve our members in marketing campaigns that benefit our members. At the same time, we wish to present you with marketing material that is both relevant and engaging.

2.7.1. To send you marketing emails

You can register for our newsletter and for other marketing emails (“Marketing Emails”). When you register, we will ask you for your permission to use your email address to send you Marketing Emails containing the latest information on our products and services, especially regarding goods available on the Platform, special offers and marketing campaigns. If, upon registration, you do not give your permission, you can change your mind at any time and agree to receive Marketing Emails by changing the settings on your Rolle account.

We base such collection and use on your consent (Art. 6 (1) (a) of the GDPR).

You can grant or revoke your consent to receive Marketing Emails at any time with future effect. In your Rolle account, you can adjust your settings to choose what emails you wish to receive or disable the receipt of further Marketing Emails. Alternatively, you can click “Unregister” at the end of the Marketing Email. Revoking your consent will not affect the legality of the collection and use carried out prior to withdrawal of your consent.

Rolle uses service providers to send Marketing Emails operating within the European Economic Area. In case the providers are not operating in the European Economic Area, this may result in your data being shared with our customer support agents outside the European Economic Area. In these instances, the personal data is protected by the service providers entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission.

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years or until you revoke your consent.

2.7.2. To personalize marketing messages

Rolle will use the data used to register you on the Platform (see above under 2.1.1, 2.1.2 and 2.1.3) and related to your Rolle account (see 2.2), your log files (see 2.3.1 above) and other means (see 2.7.7) to personalize marketing messages and advertisements presented to you.

You can grant or revoke your consent to receive personalized marketing messages at any time. In your Rolle account, you can adjust your settings to choose if you want to receive personalized messages or not. Revoking your consent will not affect the legality of the collection and use carried out prior to withdrawal of your consent.

We base such collection and use on your consent (Art. 6 (1) (a) of the GDPR).

Rolle uses service providers to send Marketing Emails operating within the European Economic Area. In case the providers are not operating in the European Economic Area, this may result in your data being shared with our customer support agents outside the European Economic Area. In these instances, the personal data is protected by the service providers entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission.

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years or until you revoke your consent.

2.7.3. To contact you for publicity and/or earning opportunities

If you register on the Platform, we may contact you via email or via the Platform’s messaging system to offer you to share your content (e.g., pictures) on our social media profiles, or to participate in our marketing campaigns, or to have your information shared with the press, or for other publicity and/or earning opportunities. This is done in order to ensure that only members who give their consent are featured on our social media profiles or receive other publicity and/or earning opportunities.

We base such collection and use on your consent (Art. 6 (1) (a) of the GDPR).

If you consent, we may check your profile information to ensure that we only offer publicity and/or earning opportunities to members with a good reputation (i.e., compliance with the GTC). The collection and use of your personal data for this purpose will be based on your consent (Art. 6 (1) (a) of GDPR).

If you agree to participate in publicity and/or earning opportunities offered by us, the further collection and use of your personal data will be based on your consent (Art. 6(1)(a) of the GDPR).

If you sign a contract with Rolle related to the publicity and/or earning opportunity, the collection and use of your personal data will be based on a contract between Rolle and you (Art. 6(1)(b) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.7.4. To conduct advertisement campaigns involving you

If you agree to participate in our advertisement campaigns, we will use your telephone number to contact you with a proposal to participate in our advertisement campaign and give you more details about the project.

If you sign a contract with Rolle related to the advertising campaign, we will collect and use the following data for the purpose of completing and fulfilling a contract between you and Rolle:

• Full name;
• Date of birth;
• Nationality;
• Information about your business certificate or individual business activity.

If you agree, your participation in our advertisement campaign will be based on a contract between Rolle and you (Art. 6(1)(b) of the GDPR).

This data may be transferred to our partners (advertising agencies, directors) that are responsible for implementing the advertisement campaign.

Personal data for your participation in our advertisement campaign are required to fulfill a contract with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract with you.

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.7.5. To enable us to post your content on our social media accounts

If you agree, we will post your content on our social media accounts for marketing and PR purposes.

We base such collection and use on your consent (Art. 6(1)(a) of GDPR).

You may grant or revoke your consent at any time by logging into the Platform, visiting Privacy Settings and changing relevant settings.

In order to post your content on our social media accounts, we provide data to social media platform operators. The following social media platform operators are established outside the European Economic Area, which may result in your data being transferred outside the European Economic Area. In these cases the personal data is protected by the operators entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission:

• LinkedIn Corporation (USA);
• Google LLC (USA);
• TikTok Inc (USA);
• Twitter, Inc (USA);
• LinkedIn Corporation (USA);
• Meta Platforms, Inc. (USA).
  

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.7.6. To allow you to see personalized advertisements

Upon your consent, Rolle will allow advertising service partners to collect your IP address and/or mobile device identifier and place their cookies on your devices and then use the data to personalize advertisements presented to you. This means that with your consent, you will receive advertisements based on your interests and your activity on the Platform. Namely, advertising service partners will collect and use the following data:

• IP address of the connection;
• Mobile Device ID;
• Advertising ID;
• Information on websites browsed by the visitor – list of pages and products viewed, clicked, put in a basket or bought the Platform;
• URL of the pages viewed by the visitor (“referrer”); URL of the previous page viewed by the visitor;
• Technical information related to the browser, device type and visitor operating system version (“user-agent”);
• Timestamp (date, time);
• Information about the possible relationships among different browsers and devices;
• Other information collected by a particular advertisement services provider.

To the extent that it involves personal data, we base such collection and use on your consent (Art. 6 (1) (a) of the GDPR).

You can choose not to receive personalized marketing and advertisements at any time by changing relevant settings on the Platform. Withdrawal of permission will not affect the lawfulness of the collection and use carried out prior to the withdrawal of permission.

To enable our service providers to show you personalized advertisements, your data is used by partners who provide personalized advertisement services.

Information is collected for this purpose by advertising service partners and is not stored by Rolle.

2.7.7. To evaluate efficiency of promotional campaigns

When you use the Platform, Rolle analyzes its marketing activities and how you use the Platform (when you register, login, create a listing, make a sale or purchase, upload an item’s photo, open our App, register or install the app, etc.) for the purpose of evaluating the efficiency of promotional campaigns, and to better comprehend visitor behavior after they have viewed a certain ad and visited our Platform or downloaded our App.

We base such collection and use on our legitimate interest to improve the efficiency of our promotional campaigns (Art. 6(1)(f) of GDPR). To the extent that it involves personal data, we base such collection and use on your consent (Art. 6 (1) (a) of the GDPR).

In order to carry out the above evaluations, Rolle provides your data to service providers who evaluate the efficiency of promotional campaign services.

Rolle uses service providers to communicate promotional campaigns, operating within the European Economic Area. In case the providers are not operating in the European Economic Area, this may result in your data being shared with our customer support agents outside the European Economic Area. In these instances, the personal data is protected by the service providers entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission.

In order to optimize our advertising campaigns, we send certain information on your activities like apps opened, sessions, registrations, logins, information about you listing an item, uploading an item’s photo or buying an item, etc. to Google and Facebook advertising platforms. Thus, we transfer the data of your activities to the following recipients:

• Meta Platforms, Inc. (USA). Personal data is protected by the service provider entering into the EU Standard Contractual Clauses for the transfer of data as approved by the European Commission;
• Google LLC (USA). Personal data is protected by the service provider entering into the EU Standard Contractual Clauses for the transfer of data as approved by the European Commission;
• TikTok, Inc. (USA). Personal data is protected by the service provider entering into the EU Standard Contractual Clauses for the transfer of data as approved by the European Commission;
• Twitter, Inc. (USA). Personal data is protected by the service provider entering into the EU Standard Contractual Clauses for the transfer of data as approved by the European Commission.

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.7.8. To manage our social media profiles

If you are interested in our activity and follow our profiles on social media, we collect and use the following data about you in order to manage our social networking sites:

• Full name;
• Email address;
• Gender;
• Country;
• Picture;
• Message;
• Time and date the message was received;
• Content of the message;
• Message attachments;
• Response to the message;
• Message response time;
• Information about our rating;
• Comments on a post;
• Post shares;
• Information about post reactions.

We base such collection and use on our legitimate interest to manage our social media profiles (Art. 6(1)(f) of GDPR).

In order to manage our social media accounts, we receive and provide data to social media platform operators.

The following social media platform operators are established outside the European Economic Area, which may result in your data being transferred outside the European Economic Area. In these cases personal data is protected by the operators entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission:

• LinkedIn Corporation (USA);
• Google LLC (USA);
• TikTok Inc (USA);
• Twitter, Inc (USA);
• LinkedIn Corporation (USA);
• Meta Platforms, Inc. (USA).

Personal data collected and used for this purpose are kept as long as you are registered on a specific social media network.

Joint Controllership with Facebook (“page insights”)

Rolle operates a so-called fan page on the social media platform of Facebook. Rolle operates a so-called fan page on the social media platform of Facebook. Facebook and Rolle are only jointly responsible for the processing of so-called “insights data” (Art. 26 (1) sentence 1 of the GDPR) insofar as this data is used for the creation of so-called “page insights” and only for the data collection phases from Rolle’s fan page until its transmission to Facebook. For other data processing, Rolle and Facebook are separately responsible for data processing.

Within the scope of their joint controllership, Rolle and Facebook have entered into an agreement (referred to as the “page insights controller addendum“). The agreement covers the data processing that is collected and used in connection with a visit or interaction with our fan page, but only to the extent that this data is also (subsequently) processed for “page insights”. “Page insights” includes analysis services that help us to better understand interactions on our site. In this context, we do not receive any personal data from Facebook, only an anonymous evaluation and illustration. Facebook provides more information on this on its help page for “page insights”. The information about data for “page insights” explains how “insights data” is collected and used to create “page insights”. This includes the following actions:

• Views and interactions with a page, post, video, story, or other content associated with a page;
• Subscribing or unsubscribing to a page;
• Reactions to a page or a contribution (e.g. a “like”; recommendation, share, comment, subscription, etc.);
• Hiding a page contribution or reporting it as spam;
• Moving the mouse over a link to a page or the name or profile picture of a page to see a preview of the page contents;
• Clicks on the website, phone number, “route planning” button or any other button on a page;
• Views of an event of a page, reactions to an event (including the type of reaction), clicks on a link for event tickets;
• Starting a messenger conversation with the page;
• Views or clicks on articles in a website shop;
• IP address as well as other information that is available on your end device in the form of cookies.

The processing of visitor data from our fan page serves the purpose of providing the page as well as the statistical evaluation of the use of our page. This evaluation is made anonymous for Rolle. The legal basis for data processing is Art. 6 (1)(f) of the GDPR. Our legitimate interests in the processing of personal data when visiting the site and the creation of “site insights” consist of presenting the company and the Platform. Similarly, we also seek to contact members and interested parties in order to provide information on products and promotions, as well as for the collection of data in order to generate anonymous evaluations and illustrations on the use of our fan page.

If you wish to exercise your rights with respect to your data (see bullet point 6. below), contacting Facebook directly is the most effective way. You can contact us if you still need help in exercising your rights. In accordance with our agreement, Facebook assumes primary responsibility for fulfilling the obligations for the joint processing of “insights data”. This includes fulfilling the following rights:

• The right to access (Art. 15 of the GDPR);
• The right to ratification (Art. 17 of the GDPR);
• The right to restrict processing (Art. 18 of the GDPR);
• The right to data portability (Art. 20 of the GDPR); and
• The right of objection (Art. 21 of the GDPR).

Facebook provides more details on how to exercise these rights in the “page insights data” information.

Joint Controllership with LinkedIn

Rolle operates a so-called company page on LinkedIn, the social media platform. LinkedIn and Rolle are only jointly responsible (Art. 26 (1) sentence 1 of the GDPR) for the processing of so-called “insights data”, enabling us to receive anonymized statistics and insights on how visitors interact with our page. For other data processing, Rolle and LinkedIn are separately responsible for data processing.

Within the scope of the joint controllership, Rolle and LinkedIn have entered into an agreement (referred to as the “Page Insights Joint Controller Addendum”) in which the data protection obligations are allocated between LinkedIn and Rolle. The agreement stipulates the following:

• LinkedIn is responsible for enabling you to exercise your rights pursuant to the GDPR. In order to do so, you can contact LinkedIn online via https://www.linkedin.com/help/linkedin/ask/PPQ or via the contact information in the data protection guidelines. You can contact LinkedIn Ireland’s Data Protection Officer via the following link: https://www.linkedin.com/help/linkedin/ask/TSO-DPO. You can also reach out to us using the contact information mentioned below to exercise your rights with respect to the processing of your personal data for insights. In such a case, we will forward your request to LinkedIn.
• LinkedIn and Rolle have agreed that the Irish Data Protection Commission shall be the responsible supervisory authority monitoring the processing for insights. You always have the right to lodge a complaint with the Irish Data Protection Commission (see www.dataprotection.ie) or any other supervisory authority.

The data processing of LinkedIn company page visitors serves to provide the page itself as well as the statistical evaluation of the use of our page. This evaluation is made anonymous for Rolle (LinkedIn does not share personal data with us when providing us with the insights, we only have access to a summarized version of the insights; also, we are unable to make conclusions about individual members based on information in the insights). The legal basis for the processing of your personal data is Art. 6 (1)(f) of the GDPR. Our legitimate interests in the processing of personal data when visiting the site and the creation of the “insights” consist of presenting the company and the Platform and, for example, contacting members and interested parties and providing information about products and promotions, as well as the collection of data for the creation of anonymous evaluations and illustrations on the use of our company page.

2.7.9. To enable you to participate in Rolle’s referrals program

If you refer one or more friends to Rolle’s Platform, you can earn Rolle shopping vouchers. We will collect and use the following data for the purpose of enabling you to participate in Rolle’s referrals program and to provide you with a Rolle shopping voucher:

• Your member name;
• Your referral link;
• Profile data on the member you invited;
• Date and time of the registration of your invited member;
• Number of items uploaded of your invited member;
• Date and time of items uploaded;
• Information on successful sale of listed items of your invited member;
• Shopping voucher;
• Amount of shopping voucher;
• Expiration of shopping voucher.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are party (Art. 6 (1) (b) of the GDPR).

Personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.

2.8. For legal purposes

2.8.1. To handle your requests related to personal data

If you exercise your statutory rights regarding your data (see 6 below), we will collect and use the data contained in your request in addition to any other personal data held by Rolle for the purpose of examining the request, responding to it and, when necessary, taking necessary action.

This is necessary in order to comply with the legal obligations to which Rolle is subject (Art. 6 (1) (c) of the GDPR).

Personal data collected and used for this purpose are kept for two (2) years from the day we respond to your request.

2.8.2. To provide information to law enforcement and other state institutions

If we have reasonable grounds to suspect that you are involved in illegal activities, we will collect and use necessary data from your profile data (see 2.1), data related to your activities on the Platform (see 2.2) and data collected and used for security purposes (see 2.3 and 2.4) in order to notify the law enforcement and other state institutions.

Rolle also provides the above data to law enforcement and other state institutions when we receive requests for information in relation to investigations carried out by these institutions.

This is necessary in order to comply with the legal obligations to which Rolle is subject (Art. 6 (1) (c) of the GDPR).

Personal data is required to fulfill our legal obligations when you are a member of our Platform. If you do not provide us with this personal data, we will not be able to comply with legal requirements.

Rolle collects and uses your personal data for this purpose for the same amount of time that your Rolle account is stored – for 3 months from the date of deactivation of your Rolle account or after five (5) years of inactivity on your account.

2.8.3. To defend our rights against chargebacks

If you have made transactions via our payment service providers, we will collect and use your personal data held by Rolle to the extent necessary to resolve a particular situation.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are party (Art. 6 (1) (f) of the GDPR).

2.8.4. To defend the rights and interests of Rolle

If you become involved in a dispute with Rolle or we need to carry out enforcement of our GTC or otherwise defend, enforce, exercise and uphold our rights, we will collect and use all of your personal data held by Rolle to the extent necessary to resolve a particular situation.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are party (Art. 6 (1) (f) of the GDPR).

Personal data collected and used for this purpose are kept for five (5) years.

2.9 To evaluate the condition of your listed item

When you upload a listing on the Platform and you request Rolle to evaluate its condition, you must provide the following data in order to complete the evaluation procedure:

• Username;
• Full name;
• Email address;
• Mobile number;

This information is collected directly from you at the pre-contractual and contractual stage.

Additionally, during the evaluation process, Rolle collects the following information about your Item: 

If the listed Item is a smartphone, Rolle collects the unique identifier of your mobile device (“IMEI number”). The IMEI number is collected during the evaluation phase and used by our company in order to confirm the Make and Model of your device. To the extent that the above IMEI number or similar identifiers or similar information derived therefrom may be interpreted as, or become, personal data in accordance with the relevant applicable law, we undertake to treat such information as personal data in accordance with the terms of this Privacy Policy.

If the listed Item is a not a smartphone, Rolle collects the serial number of your device. The serial number is collected during the evaluation phase and used by our company in order to confirm the Make and Model of your device. To the extent that the above serial number or similar identifiers or similar information derived therefrom may be interpreted as, or become, personal data in accordance with the relevant applicable law, we undertake to treat such information as personal data in accordance with the terms of this Privacy Policy.

Information about the functionality of some other components of your device such as biometrics, camera front/back, audio (microphone/speaker), digitizer. To collect this information, the App will request you to provide us with the required access on the camera (capture front/back side photos from your device), biometrics, audio functionalities of your device etc. The information that will be collected will be stored and used solely for the purpose of evaluating your device’s condition.  

Additionally, a video of the evaluation appointment will be recorded with the following info:

• Your screen recording;
• Your voice recording;
• Your face recording.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (b) of the GDPR).

We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years. 

3. Personal data recipients

Rolle transfers or shares personal data with service providers only insofar as necessary and allowed in accordance with applicable laws. Service providers to which your personal data is transferred or with whom it is shared for specific purposes are described under 2 above. In addition, we appoint the following service providers who, as a result, receive personal data as data recipients.

We perform ongoing technical maintenance and upgrades to the Platform to protect the security and confidentiality of personal data we process and to perform certain business-related functions that help make our services available and functional. For this reason, we transfer your profile data to service providers who provide cloud and hosting services, IT security, maintenance and technical services, and communications services.

The following service providers are established outside the European Economic Area, which may result in your data being transferred outside the European Economic Area. In these cases the personal data is protected by the service providers entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission:

• Amazon Web Services, Inc. (USA);
• Google LLC (USA);
• Apple Inc. (USA);
• TikTok Inc (USA);
• Twitter, Inc (USA);
• LinkedIn Corporation (USA);
• Microsoft Corporation (USA);
• Slack Technologies, Inc. (USA);
• Cloudflare, Inc. (USA).
• Phonecheck, Inc. (USA)

We transfer personal data to attorneys, attorney assistants, notaries, bailiffs, auditors, accountants, bookkeepers, debt collectors, consultants, translation agencies, IT service providers, insurance companies, and archiving services that provide services to Rolle.

Rolle is legally obligated to provide personal and/or usage data to investigative, criminal prosecution or supervisory authorities if and to the extent required to prevent risk to the public and for the prosecution of criminal acts.

Rolle may share your data with third parties when transferring rights and obligations pertaining to the contractual relationship between you and Rolle to such third parties in accordance with the GTC (available via the link: https://staging.rolle.io/el-GR/content/info/terms-and-conditions), in particular in the event of the transfer of a business sector, a merger by way of the creation of a new company, a merger by way of absorption, a de-merger or any changes in control affecting Rolle.

4. Use of cookies

Rolle uses cookies and similar technologies on the Platform. You can find out more by visiting our Cookie Policy (available via the link: https://staging.rolle.io/en-GR/content/info/cookie-policy).

5. Right of amendment 

As our services are constantly evolving, we reserve the right to change this Privacy Policy at any time subject to the applicable regulations. Any changes will be published promptly on this page. You should, nevertheless, check this page regularly for any updates.

6. Your statutory rights regarding your personal data

Subject to conditions, limitations, and exceptions established by statutory data protection provisions, you have the right at any time:

• to be informed of the data we collect and use and to request access or demand a copy of the data concerned (right to access). You can access any data you actively provided us on the Platform (2.1, 2.5 and 2.6) at any time through your Rolle account;
• to demand the correction of inaccurate data and, subject to the nature of the collection and use, the completion of incomplete data (right to rectification). You can also amend any of the data that you have actively provided us on the Platform (2.1, 2.5 and 2.6) at any time through your Rolle account (except reviews);
• subject to just cause, to demand the deletion of your data (right to deletion);
• to demand that the collection and use of your data be restricted, provided the legal criteria are met (right to restrict processing);
• subject to the legal criteria being met, to receive the data you have provided in a structured, current and machine-readable form and to transfer this data to another data controller or, when technically feasible, to have it transferred by Rolle (right to data portability);
• to object to the collection and use of data – only where the collection and use is based on a task carried out in the public interest or in the exercise of a vested official authority (Art. 6 (1)(e) of GDPR) or legitimate interest (Art. 6 (1)(f) of GDPR), including profiling, based on the same data collection and use grounds as explained in other sections of this statement (right to object). You also have the right to object to the collection of your personal data for direct marketing purposes at any time;
• to revoke any permission, you have granted us at any time. Such revocation will not affect the legality of collection and use carried out prior to the revocation and is based on the permission granted. You can revoke your permission to receive our newsletter by changing your Rolle account settings to block the receipt of any further Marketing Emails. Alternatively, you can click “Unsubscribe” at the end of the Marketing Email;
• not to receive discriminatory treatment while exercising your rights.

To exercise any of the rights specified in this section, you can contact Rolle and submit your request using the contact information (7 below).

7. Our contact details

If you have any questions regarding the collection and use of your data as part of your use of the Platform, or regarding your rights, please contact our data protection officer at [email protected].

Rolle data protection officer:

2 Merlin Str.

10672 Athens

Greece

---

Effective date: 31/08/2023 | Last updated: 31/08/2023