Last updated Sep 10, 2023
When it comes to your personal data, safety and transparency take top priority here at Rolle. To help you understand what information we collect about you, how we use it and what rights you have, weāve prepared this detailed Privacy Policy.
1. General
2. Why and how do we collect and use your personal data?
3. Personal data recipients
4. Use of cookies
5. Right of amendment
6. Your statutory rights regarding your personal data
7. Our contact details
This Privacy Policy applies to the online platform Rolle (āWebsiteā) and to the associated app (āAppā) (the Website and the App are jointly referred to as the āPlatformā).
The Platform is operated by Rolle Technologies P.C., a company registered in Greece, with business location at 2 Merlin, Str. 10672, Athens. The operator is further referred to as āWeā, āUsā or āRolleā. More details about how to get in contact with us can be found at the end of this Privacy Policy under No. 7.
The protection of your personal data is very important to us. All personal data is collected, stored and processed in accordance with Regulation (EU) 2016/679 of the European Parliament and Council (General Data Protection Regulation, GDPR for short) and/or other applicable legal provisions.
The services offered by us via the Website and/or App can function only if we collect, store, transfer, delete and/or otherwise use (ācollect and useā) specific data relating to you (āpersonal dataā or ādataā). Personal data means all information relating to an identified or identifiable natural person such as your name, date of birth, address, or email address.
This Privacy Policy describes what type of data we collect from you and for what purposes we collect and use it when you use the services offered by Us on the Platform. This Privacy Policy also contains important information on the protection of your data, especially the statutory rights you have in connection with it.
Certain services on our Platform are offered by third-party suppliers. When you use these services, the data protection regulations that govern third-party suppliers will then apply in addition to this data protection statement. Prior to your use of such services, the third-party suppliers shall require you to provide your express consent for the processing of your personal data under the GDPR or other applicable data privacy regulations.
Under applicable data protection laws, Rolle is obligated to inform you about data processing and Rolle fulfills this obligation within this Privacy Policy. This Privacy Policy and any parts of it are not meant as contractual clauses and do not form part of the general Terms and Conditions (āGTCā) (available via the link https://rolle.io/en-GR/content/info/terms-and-conditions) as a contract that is concluded with registered users. Under applicable data protection laws, Rolle can process data that is necessary for the fulfillment of a contract with you or necessary for taking steps at your request prior to entering into a contract (Art. 6 (1) (b) GDPR). References to the GTC should always be understood as information on data processing (Art. 13 and 14 GDPR) and never as clauses that form part of the GTC. By using the Platform and our services, you enter into a legally binding contract between you and Rolle, the conditions of which are described in the GTC.
We collect and use your personal data to allow you to use our Platform, to provide our services and to fulfill a contract (GTC) with you and above all, to carry out commercial transactions via the Platform, to use the electronic payment system or to leave reviews. To use these services, you need a Rolle account. For this purpose, you must register as a member on the Website or App.
Most of your personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you. A portion of your data is required to fulfill our legal obligations when you become a member of our Platform. If you do not provide us with this personal data, we will not be able to comply with legal requirements or provide our services.
This data is also used for improvement of the Platform in order to enhance user experience for our members (see 2.2.12).
We collect and use your personal data for these purposes until your Rolle account is deactivated or up to five years after your account has become inactive.
2.1.1. To enable registration on the Platform
When you register as a member on the Platform, you must provide the following data in order to complete the registration procedure and access your Rolle account:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (b) of the GDPR).
We also determine your location (country) based on your (Userās) input. You can choose to change your location (country, city or region) at any time by going to “My settings” in your Rolle account.
We collect and use your personal data for these purposes until your Rolle account is deactivated or up to five years after your account has become inactive.
2.1.2. To authenticate your identity via Google, Facebook or using an Apple ID
If you register using your Google Ireland Ltd. (Ireland), Google LLC (USA) (āGoogleā) or Meta Platforms Ireland Ltd. (Ireland), Meta Platforms, Inc. (USA) (āFacebookā), or Apple Inc. (USA) (āAppleā) account or later on decide to link your Google, Facebook or Apple account to your Rolle account, you will be transferred from our Platform to the Google, Facebook or Apple website and asked to enter the log-in information for your Google, Facebook or Apple ID account.
If you enter your Google log-in information, Google will share the following data with Rolle from your Google account (you may choose not to provide some data):
If you enter your Facebook log-in information, Facebook will share the following data with Rolle from your Facebook account (you may choose not to provide your email address):
If you enter your Apple ID log-in information, Apple will share the following data with Rolle from your Apple ID account (you may choose not to provide your email address by using Appleās Private Email Relay Service):
The data we obtain from Google, Facebook or Apple will be used to set up your Rolle account. This means that we will use the member name from your Google, Facebook or Apple ID account as your Rolle account member name so that it will be visible to other visitors to the Website and App users. No other data obtained from Google, Facebook or Apple will be visible to anyone on the Platform.
You can, at any time, unlink your Google, Facebook or Apple ID account. This can be done under “My settings” in your Rolle account. If, however, when you initially registered, you did so without linking your Google, Facebook or Apple ID account, you can create such a link later.
If, however, when you initially registered, you did so without linking your Google, Facebook or Apple ID account, you can create such a link later.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (a) of the GDPR).
We collect and use your personal data for these purposes until your Rolle account is deactivated or up to five (5) years after your account has become inactive.
2.1.3. To enable you to set up your profile information
If you decide to add profile details to the account you create on the Platform, we collect and use the following data when you choose to provide it:
Your username, profile photo, city of your address, listings (current and past) and reviews are visible to other Platform visitors, but the remainder of the data entered by you is not visible.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (a) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years. Photo metadata containing personal data is deleted immediately.
2.1.4. To show other members relevant information regarding your activity on the Platform
When you are a registered member on the Platform, we collect, use and make public on the Platform the following information in order to provide other members with relevant information:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.1.5. To enable you to list your items
If you list items on the Platform, we will collect and use the following data for the purpose of creating, publishing and deleting listings on the Platform (the required information differs depending on the chosen item category):
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (a) of the GDPR).
Personal data collected and used for this purpose is kept for five (5) years. Deleted items and their photos are stored for 6 months. Photo metadata containing personal data is deleted immediately.
2.1.6. To enable notifications on the Platform for you
When you are a registered member on the Platform, we will provide you with notifications on the Platform regarding important updates and actions that you need to take e.g. when you receive an order request and you have to reply to the buyer.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (b), of the GDPR) and (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five t (5) years.
2.1.7. To enable you to leave reviews for other members on the Platform
If you leave reviews for other members, Rolle collects and uses the following data for the purpose of making the reviews publicly available on the Platform:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (a) of the GDPR).
You can, at any time, edit or delete your reviews left for other members.
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.1.8. To receive reviews from other members
When you receive reviews from other members, we will collect and use the following data for the purpose of making the reviews publicly available on the Platform:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.1.9. To address your public feedback about us
If you leave a public review or other feedback about the Platform, we collect and use the following data for the purpose of addressing your feedback:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose for up to five (5) years.
2.1.10. To send you important Platform communication
If you register on the Platform, we will send you emails and messages via the Platformās messaging system for the purpose of providing important notifications such as GTC, Privacy Policy changes.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (b), of the GDPR) and (Art. 6 (1) (c) of the GDPR).
We collect and use your personal data for this purpose for up to five (5) years.
2.1.11. To send you offers via the Platformās notification system
If you register on the Platform, we will send you offers related to Rolle services via the Platformās messaging system (āOffersā).
Legal basis for the collection and use of data is our legitimate interest in providing offers to our members (Art. 6 (1) (f) of the GDPR); Article 13 (2) of Directive 2002/58/EC of the European Parliament and of the Council of July 12, 2002 on the processing of personal data and the protection of privacy in electronic communications (Privacy Directive for Electronic Communications).
Rolle uses third-party service providers to send the offers, operating within the European Economic Area. In case the providers are not operating in the European Economic Area, this may result in your data being shared with our customer support agents outside the European Economic Area. In these instances, the personal data is protected by the service providers entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission.
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.1.12. To provide you with customer support service
When you send us a question, inquiry or complaint, we collect and use the following information to provide you with the Platform customer service you have requested::
The type of information we collect may vary depending on your inquiry.
The legal basis for the collection and use of data is the fulfillment of the contract between you and us in compliance with the applicable General Terms and Conditions (Article 6 (1) (b) of the GDPR).
In order to respond to your requests, Rolle might provide your data to customer support service providers, operating within the European Economic Area. In case the providers are not operating in the European Economic Area, this may result in your data being shared with our customer support agents outside the European Economic Area. In these instances, the personal data is protected by the service providers entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission.
Personal data collected and used for this purpose is kept for 5 years after the last update related to your inquiry. If your account is deleted, personal data collected and used for this purpose will be deleted along with your account.
2.1.13. To resolve any purchase-related disputes between members
If you purchase and/or sell items on the Platform and are involved in a dispute with another member, we will collect and use any of your personal data held by Rolle necessary to solve the dispute.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR) and (Art. 6 (1) (c) of the GDPR).
Personal data collected and used for this purpose is kept for five (5) years after the conclusion of a dispute.
2.1.14. To provide item verification service
We offer item verification service on our Platform. An item is checked and verified by our experts, before being uploaded in our Platform, we collect and use the following data:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).
We collect and use your personal data for this purpose for 5 years after the completion of the verification.
2.1.15. To resolve any purchase-related disputes between members
If you purchase and/or sell items on the Platform and get involved in a dispute with another member, we will collect and use any of your personal data held by Rolle necessary to solve the dispute.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR) and (Art. 6 (1) (c) of the GDPR).
Personal data collected and used for this purpose are kept for 5 years after a dispute is concluded.
2.1.16. To temporarily retain your deactivated account
If you decide to deactivate your account, we will take all reasonable efforts to make sure it is no longer viewable on the Platform and restrict the use of your personal data. For up to three (3) months, it is still possible to restore your account if it was accidentally or wrongfully deactivated or in case you change your mind and wish to return to the Platform and take action in the event that someone other than yourself gained access to and deleted your account without your knowledge.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR) and (Art. 6 (1) (c) of the GDPR).
Personal data is kept for this purpose for three (3) months from the date of deactivation of your Rolle account.
After three (3) months, we permanently delete your account from our Platform.
We collect and use your personal data in order to improve your experience when using the Platform by enabling you to personalize your feed and search results, providing you relevant suggestions and storing your previous searches, sending you notifications and otherwise making the use of Platform more pleasant.
Specific applicable legal basis for the collection and use of your data is described in each section below.
2.2.1. To enable your preferences regarding your feed and search results
If you choose to personalize the items presented to you on the Platform (on item feed, catalog and search results), we will collect and use the following data for the purpose of presenting you a feed personalized based on your preferences:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (a) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.2.2. To personalize your feed and search results
We also personalize item feeds by evaluating your preferences according to the following:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.2.3. To prioritize high value items for sale by reputable sellers
In order to determine whether you, as a reputable seller, offer high value items, we will collect and use the following data from you when you sell your items on the Platform:
We use results to prioritize high value items sold by reputable sellers when showing items to new members, and increase the visibility of items uploaded by members that have chosen the same language as you and/or live in the same country or region, items listed by new members, items that have three (3) favorites or more, items that are boosted, and we show relevant items on the Platform.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.2.4. To recommend relevant items to you
If you choose to create item listings on the Platform, we will collect and use data you provide in the listing (see 2.1.5 above) by analyzing it in order to either offer members who clicked on your items other relevant items or offer them to members to whom your items may be relevant.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.2.5. To suggest relevant item descriptions
When you create item listings on the Platform, we collect and analyze the data you provide in the listing (see 2.1.5 above) to suggest the most appropriate description for your listing.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.2.6. To improve search results on the Platform
We collect and use data provided in the item listings (see 2.1.5 above) with no seller-related information in order to improve search results by evaluating the degree of relevance of certain items with respect to a specific search keyword and to automatically suggest relevant categories for new listings. For this, we only use the item listing without any link to a particular seller.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
Rolle uses service providers who provide data analysis services to Rolle.
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.2.7. To save your recent searches
In order to help you find previously searched items on the Platform, we save your search keywords. We collect and use the following data for the purpose of providing information about newly listed items on the Platform based keywords from your previous searches:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
You can delete your search history at any time.
Unless you delete your search history earlier, we collect and use your personal data for this purpose for up to thirty six (36) months.
2.2.8. To help you draw more attention to your listings
Should you order extra services, i.e. boost listing in order to increase your itemsā visibility on the Platform, we collect and use the following data:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).
Personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into or fulfill a contract (GTC) with you.
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.2.9. To suggest a price or set a cap upon creation of an item listing
If you choose to create an item listing on the Platform, our algorithms will analyze its price in addition to the item category, item brand and item condition. We will then use that information to show you pictures and prices of similar items sold in the last three months in order to help you determine the selling price for your item.
If the selling price you chose is above the price range for similar items sold on the Platform in the last three months, Rolle will also give you a tip regarding the recommended price range and set a cap based on the item’s face value.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
To perform the above function, we collect and use pictures and prices of items sold in the last thirty six (36) months.
Upon listing your items, we collect and use such information to analyze your items throughout the item listing process. Upon sale of your items, we collect and use the data mentioned above for thirty six (36) months after the itemās sale.
2.2.10. To enable notifications about your favorite items
If you favorite an item listed by another member on the Platform, Rolle will inform you when the price of your favorite Item goes down or when the item is sold. For this reason, we will collect and use the following data:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.2.11. To notify sellers when you favorite their items
If you favorite an item on the Platform, Rolle will inform the seller that you have favorited their item.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
You can disable these notifications by logging in to the Platform, going to Privacy Settings and changing the appropriate settings.
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.2.12. To improve our Platform
Rolle is committed to the Platformās optimal performance. While the Platform is in use, Rolle gathers information about actions performed on the Platform (button clicks, visiting time, notifications read, other information based on a given business case) and other data described under 2.1, 2.2, 2.5, 2.6 and 4 of this Privacy Policy in order to help us make decisions on how to improve the Platform and make it a better experience for our members.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.2.13. To conduct surveys
We are always looking for ways to improve your user experience with Rolle. As such, you may be invited to participate in a survey and your feedback may be used. For this purpose, we collect and use the following data:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR) and (Art. 13 (2) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.2.14. To conduct interviews
In order to understand our users’ needs and improve your experience on the Platform, we conduct on-site or online interviews with you. For this purpose, we collect and use the following data:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
If you wish to participate in the interview, the information above will be collected based on your consent (Art. 6 (1) (a) of the GDPR).
2.2.15. To enable you to share your user journey
We are making constant improvements to our Platform and look for ways to improve your experience while using Rolle. If you agree, we enable you to share your user journey through our Platform. In so doing, we will collect and use the following data:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
If you wish to participate in the survey, the information above will be collected based on your consent (Art. 6 (1) (a) of the GDPR).
Rolle strives to ensure that our member accounts and the Platform itself are secure and protected from cyber-attacks, unauthorized access and other similar risks.
2.3.1. To track visits to the Platform for security purposes
When you connect to the Website or App, we collect and use the following data (log files), even if you are not logged in to the Website as a member:
For access via mobile devices, the following log files are also recorder as part of your use of the Rolle App:
This data is used for security purposes, especially the prevention of cyber-attacks such as data scraps and denial of service attacks and to prevent unauthorized multiple applications.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
Personal data collected and used for this purpose is kept for thirty six (36) months.
2.3.2. To help you avoid using a compromised password
If you decide to register using a password or subsequently decide to change your password, we will check it against a database of passwords compromised in previous data breaches having occurred on other platforms and through other services. To enable this functionality, we take the password, hash it and then use the first 5 characters of the hash to Have I Been Pwned (https://haveibeenpwned.com/) to conduct a search in the database for compromised passwords.
By performing this check, we are able to protect your account by confirming that you are using a password not known to be compromised.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use personal data for this purpose only for the duration necessary to perform the password check.
2.3.3. To allow you to reset your password
If you forgot your password or decide to change it for other reasons and do not have access to your email, we may ask you to answer a few security questions to verify your identity. For this purpose, we will collect and use the following data:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.3.4. To verify your account in case of suspicious activity related to your account
If we detect activity on your account considered to be suspicious by Rolle, we will ask you to perform a basic verification by confirming your email, Facebook, Apple or Google accounts. For the purpose of performing a basic verification, we will collect and use the following data:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.3.5. To conduct phone number and two-step verifications
Should you decide to apply an additional layer of protection to your account and activate phone verification, we will use your phone number in order to enable this function. Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
You may also be asked to verify your phone number in case of suspicious activities on your account. In that event, legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).
When you verify your phone number, Rolle will collect and use your phone number for two-step verification purposes.
Personal data for mandatory verifications is required to enter into and fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.
In order to carry out phone number and two-step verifications, we might use a third service provider, enabling us to send you verification messages or make verification calls to dictate verification code if you do not verify your phone number within 5 minutes. The data is protected by the service provider entering into the EU Standard Contractual Clauses or in case your data is being shared outside the European Economic Area, the data is protected by the service provider entering into the EU Standard Contractual Clauses for the transfer of data as approved by the European Commission.
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.3.6. To carry out payment source security checks
As part of the security process, we ask our members to provide verification of their payment source. In order to perform such security checks, Rolle collects and uses the following personal data:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
Personal data collected and used for this purpose is kept for four (4) days after the security check is passed.
2.3.7. To prevent fraudulent payments
To ensure secure payments on the Platform and uphold our GTC, we may check payments for any signs of fraudulent activities, such as unauthorized use of credit/debit card or payment information, fake transactions, etc.
If we come across such payments, we take appropriate measures as outlined in our GTC, which may include a thorough review of the transaction, cancellation of the payment, or even blocking the associated member’s account.
To detect and cancel suspicious payments, we may use fully automated tools. By doing so, we can prevent fraudulent activities in an efficient and timely manner, ultimately protecting our members from harm. We use means to ensure a high precision rate and accuracy of our automated tools, including manual reviews of automated decisions.
The following categories of data are used to prevent fraudulent payments, including making the automated decisions for detecting and cancelling suspicious transactions:
Credit/debit card data;
Transaction data;
Registration data;
Session data;
Activity on the Platform data;
Delivery data;
Security data.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).
We collect and use your personal data for this purpose for five (5) years after the payment verification procedure.
2.3.8. To ensure listing compliance with our Ownership and Originality of listed items
For some listings, we collect and use the following data in order to ensure that such listings comply with our Ownership and Originality of listed items:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We may share photos of listings or other proofs of authenticity free of your personal data with brand owners in order to verify certain items.
Personal data collected and used for this purpose is kept for five (5) years when it is necessary to solve disputes between our users.
2.3.9. To facilitate the exercise of intellectual property rights
Intellectual property right holders (or their representatives) can complete our Intellectual Property Infringement Report. Within this report, Rolle collects and uses the following personal data:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
Personal data collected and used for this purpose are kept for five (5) years.
2.3.10. To carry out account ownership checks
As part of the security process, we may ask our members to verify ownership of their Rolle account. To confirm your identity, we will need one of the following as proof:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
Personal data collected and used for this purpose is kept for four (4) days from receipt of the proof.
2.3.11. To allow you to report inappropriate behavior or content
If you would like to report inappropriate messages, members, items, spam or spoof mail, we will collect and use the following data for the purpose of ensuring the security of the Platform and its members:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.3.12. To report suicidal posts
In exceptional cases, where we notice suicidal posts on our Platform, we may report them to the police. In such cases we will collect and use and disclose the following data for the purpose of reporting suicidal posts:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (d) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
Rolle actively supervises compliance with and enforces GTC for the purpose of ensuring the security of your account and that of the Platform.
2.4.1. To calculate the trust score
In order to ensure the security of the Platform and its members, Rolle gives each member a “trust score” calculated using an algorithm, and maintains a database of unlawful activities typically performed by bad actors. The “trust score” indicates the likelihood of improper use of the Platform.
Our algorithm takes into account membersā reviews received or given, items listed on the platform, transactions, reports from other members on that member, the member’s profile and contact information, connected social media accounts to the Rolle profile, the member’s violations of our GTC, IP addresses, and browser fingerprints, other content provided to use by the member.
When member evaluations meet certain thresholds, the member’s usage of the platform is restricted or the member is asked to verify his/her telephone number, email, Facebook, Apple, or Google accounts.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.4.2. To identify and prevent malicious accounts and activities
In order to ensure the security of the Platform and its members, Rolle collects and maintains a database of keywords indicating malicious accounts and activities. This database may contain emails, certain words or phrases found in reviews, Items descriptions and other relevant data. By matching membersā activity against the keywords in the database, we can identify and prevent bad actors more effectively.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.4.3. To enforce spam filtering
In order to protect our members and the Platform, we use spam filtering tools. These tools include a list of keywords that are commonly associated with spam. If your messages include these keywords, they are stopped by the above-referenced tools and reviewed manually before being sent to other members.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.4.4. To moderate your activity on the Platform
In order to ensure the security of the Platform and its members we regularly moderate your activity on the Platform. We may check your listings automatically or we may check your listings, reviews upon receipt of reports from other members or third parties.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.4.5. To issue and enforce warnings
As a member, if you violate our GTC or take other actions that result in a warning being issued to you, we collect and use the following data to issue and enforce the warning:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.4.6. To delete or hide items that violate Rolle GTC
If you list items that violate our GTC, we will remove or hide them. However, we will retain deleted listings as proof of the violation. For this purpose, Rolle uses personal data included in the listing as specified under 2.1.5.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
Deleted listings are stored up to ninety (90) days after their removal.
2.4.7. To detect and lock compromised accounts
In order to protect our members and the Platform, we regularly check for suspicious activities to detect compromised accounts. If we determine that your account may be compromised or at your request, we may lock your account.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.4.8. To suspend members
If you cancel too many order requests in a short period of time, you may get suspended for a period of time. For this purpose, Rolle collects and uses the time and duration of the suspension.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.4.9. To block membersā accounts and enforce blocking
Depending on your usage of the Platform, and as explained in our GTC, your account may be blocked, either temporarily or permanently.
Rolle might use fully automated tools for such blocking of an account when it comes to ensuring the integrity of the Platform and the provision of safe services. Such automation is needed for Rolle to manage the security on the Platform efficiently and avoid harm to other members.
The data categories used for making the decision are as follows:
Registration data;
Your activity on the Platform;
Session information;
Information provided in the listings;
Communication data;
Your settings and preferences.
We establish profiles of harmful users such as scammers, sellers listing counterfeited items, users cheating our shipping services, based on criteria identified by Rolle, notably as a result of reporting on harmful users. The automated tools automatically detect harmful profiles which leads to a decision to block the respective accounts. Rolle uses means to ensure a high precision rate and accuracy of its automated blocking system, including manual reviews. The effects of blocking are described in our GTC.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).
We collect and use your personal data for making the decision on the blocking of your account until the deletion of your Rolle account.
When your account is blocked, we collect and use the following data to enforce blocking:
Your account data;
Data related to the blocking of your account, e.g. reason, date, and time of the blocking.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
We collect and use your personal data up to five (5) years upon blocking your account.
2.4.10. To enforce IP blocks
If there are signs of cyber-attacks or other risks to the Platformās security coming from your IP address, in order to protect the platform, we will collect and use your IP address and block it.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
Personal data collected and used for this purpose is kept for five (5) years.
2.4.11. To restrict the fraudulent use of payment instruments
If there are signs of any fraudulent activity with your payment instrument (e.g. credit/debit card), we will collect and use your payment instrument and order data to protect the Platform by restricting the use of your payment instrument.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (f) of the GDPR).
Personal data collected and used for this purpose are kept for the duration of the restrictions applied.
Payments made on the Platform are carried out via payment service providers that offer payment processing and escrow services.
Most of your personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you (Art. 6 (1) (b) of the GDPR). Part of your data is required to fulfill our or our payment service providersā legal obligations when you are a member of our Platform (Art. 6 (1) (c) of the GDPR). If you do not provide us with this personal data, we or our payment service providers will not be able to comply with legal requirements nor will we be able to provide our services.
This data is also used for improvement of the Platform in order to make it a better experience for our members (see 2.2.12).
2.5.1. To allow you to make a purchase or add a payment card for payment purposes
When you add a payment card or purchase an item or our extra services via the Platform, we collect and use the following data for the purpose of allowing you to make payments:
When you add a payment card or purchase an item or our extra services via the Platform, relevant payment service provider (please see 2.5.3 and 2.5.4 below) receives the following data:
Legal basis for the collection and use of data is the fulfillment of a contract (compliance with our GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).
Personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.
If you agree, we will store your bank card details for future use.
Legal basis for such collection and use is your consent (Art. 6 (1) (a) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.5.2. To allow you to add a bank account for withdrawal purposes
When you add a bank account for withdrawal purposes, we collect and use the following data to allow you to withdraw money:
Legal basis for the collection and use of data is the fulfillment of a contract (compliance with our GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).
Personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.5.3. To enable you to pay and receive payments on our Platform
If you opt to pay a seller or for extra services by payment card or other payment method integrated on the Platform, or if you use other services on the Platform for which a charge is made, the transaction in question will be collected and used via the electronic payment system STRIPE CONNECT (see our GTC), which is operated by STRIPE, Inc. (Dublin) (“STRIPE”). On behalf of Rolle, STRIPE will collect the payment information based on the payment method selected (e.g. payment card, etc.). The payment will then be implemented via STRIPE and the payment scheme owner or facilitator of the payment method you have selected. To this extent, the data protection rules of STRIPE and the payment scheme owner or facilitator of the payment method you have selected will apply.
For more information on payment procedure, see Article 6 of our GTC. If you use a payment card as your payment method, Rolle will see only the card holderās full name, the first six and last four digits of your payment card number and expiration date.
This information will be used by us solely for the purpose of confirming payment. The rest of the card data is masked and forwarded to STRIPE to handle the transaction.
Legal basis for the collection and use of data is the fulfillment of a contract (compliance with our GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).
Personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
Additionally, if you are a seller on Rolle and you want to receive payments from buyers through the above electronic payment system for the purchase of your products, you will have to accept STRIPEās Terms and Conditions and create a Custom Connect account with STRIPE. In order to do so, you must provide the following data:
STRIPE processes this information in accordance with applicable laws and as described in STRIPE’s Privacy Policy.
For this purpose, Rolle implemented STRIPEās API ā a technical measure that allows you to submit your information and other data to STRIPE without leaving the platform. All information goes straight to our payment provider STRIPE without being saved on our systems.
Legal basis for the collection and use of your personal data is the fulfillment of a contract (compliance with our GTC and STRIPEās Terms and Conditions) to which you are a party (Art. 6 (1) (b) of the GDPR).
Personal data is required to fulfill contracts (GTC and STRIPE Terms and Conditions) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill contracts with you.
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.5.4. To implement Know Your Customer (KYC) checks on our Platform
Whenever you reach the KYC thresholds which are set by STRIPE, STRIPE will ask you to provide a copy of your passport or ID card or driverās license, including temporary licenses and a copy of Utility bill. In that case, we will enable STRIPE to collect the following data from you in order to allow STRIPE, as payment service provider, to perform an identity check (so-called Know Your Customer, KYC):
As a separate safety check, STRIPE may also request a photo/screenshot of the bank statement listing transactions for a one-month period. In that case, we collect the following information as requested by STRIPE:
For this purpose, Rolle implemented STRIPEās API ā a technical measure that allows you to submit a copy of your document and other data to STRIPE without leaving the platform. All document copies go straight to our payment provider STRIPE without being saved on our systems.
This is necessary in order to fulfill our legitimate interest to provide STRIPE with necessary information for their compliance with the legal obligations to which STRIPE is subject (Art. 6 (1) (f) of the GDPR).
2.5.5. To issue refunds
If you purchase an item and it is never shipped, arrives damaged or is not as described and you issue a claim, we collect and use the data used to make a purchase (see 2.5.3 and 2.5.4) for the purpose of issuing a refund.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are party (Art. 6 (1) (b) of the GDPR).
Personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.
Transaction data is kept for five (5) years from the day of transaction.
2.5.6. To keep financial records
If you participate in purchase-sale and/or other transactions when using the Platform, Rolle will collect and use the following data in order to carry out its accounting-related duties:
This is necessary in order to comply with the legal obligations to which Rolle is subject (Art. 6 (1) (c) of the GDPR).
Financial regulations require us to keep accounting documents that confirm the transactions for ten (10) years.
Rolle strives to make the shipping of items purchased on the Platform as smooth and convenient as possible by offering shipping methods on the Platform.
Most of your personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.
This data is also used for improvement of the Platform in order to make it a better experience for our members (see 2.2.12).
2.6.1. To enable you to ship or receive items
If you choose to enter your shipping information or when you buy or sell items, we collect and use the following data that you provide for dispatch and shipping purposes:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).
Personal data are required to perform a contract (GTC) with you. In case you do not provide us with this personal data, we will not be able to conclude and execute a contract (GTC) with you.
We provide personal data collected and used for this purpose to the shipping provider integrating its shipping services with Rolle.
Personal data collected and used for this purpose is kept for five (5) years.
2.6.2. To track your parcel
When you buy or sell items on the Platform, we collect and use the following data for shipment tracking purposes:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).
Personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.
Personal data collected and used for this purpose is kept for five (5) years.
Rolle seeks to involve our members in marketing campaigns that benefit our members. At the same time, we wish to present you with marketing material that is both relevant and engaging.
2.7.1. To send you marketing emails
You can register for our newsletter and for other marketing emails (“Marketing Emails”). When you register, we will ask you for your permission to use your email address to send you Marketing Emails containing the latest information on our products and services, especially regarding goods available on the Platform, special offers and marketing campaigns. If, upon registration, you do not give your permission, you can change your mind at any time and agree to receive Marketing Emails by changing the settings on your Rolle account.
We base such collection and use on your consent (Art. 6 (1) (a) of the GDPR).
You can grant or revoke your consent to receive Marketing Emails at any time with future effect. In your Rolle account, you can adjust your settings to choose what emails you wish to receive or disable the receipt of further Marketing Emails. Alternatively, you can click “Unregister” at the end of the Marketing Email. Revoking your consent will not affect the legality of the collection and use carried out prior to withdrawal of your consent.
Rolle uses service providers to send Marketing Emails operating within the European Economic Area. In case the providers are not operating in the European Economic Area, this may result in your data being shared with our customer support agents outside the European Economic Area. In these instances, the personal data is protected by the service providers entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission.
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years or until you revoke your consent.
2.7.2. To personalize marketing messages
Rolle will use the data used to register you on the Platform (see above under 2.1.1, 2.1.2 and 2.1.3) and related to your Rolle account (see 2.2), your log files (see 2.3.1 above) and other means (see 2.7.7) to personalize marketing messages and advertisements presented to you.
You can grant or revoke your consent to receive personalized marketing messages at any time. In your Rolle account, you can adjust your settings to choose if you want to receive personalized messages or not. Revoking your consent will not affect the legality of the collection and use carried out prior to withdrawal of your consent.
We base such collection and use on your consent (Art. 6 (1) (a) of the GDPR).
Rolle uses service providers to send Marketing Emails operating within the European Economic Area. In case the providers are not operating in the European Economic Area, this may result in your data being shared with our customer support agents outside the European Economic Area. In these instances, the personal data is protected by the service providers entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission.
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years or until you revoke your consent.
2.7.3. To contact you for publicity and/or earning opportunities
If you register on the Platform, we may contact you via email or via the Platformās messaging system to offer you to share your content (e.g., pictures) on our social media profiles, or to participate in our marketing campaigns, or to have your information shared with the press, or for other publicity and/or earning opportunities. This is done in order to ensure that only members who give their consent are featured on our social media profiles or receive other publicity and/or earning opportunities.
We base such collection and use on your consent (Art. 6 (1) (a) of the GDPR).
If you consent, we may check your profile information to ensure that we only offer publicity and/or earning opportunities to members with a good reputation (i.e., compliance with the GTC). The collection and use of your personal data for this purpose will be based on your consent (Art. 6 (1) (a) of GDPR).
If you agree to participate in publicity and/or earning opportunities offered by us, the further collection and use of your personal data will be based on your consent (Art. 6(1)(a) of the GDPR).
If you sign a contract with Rolle related to the publicity and/or earning opportunity, the collection and use of your personal data will be based on a contract between Rolle and you (Art. 6(1)(b) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.7.4. To conduct advertisement campaigns involving you
If you agree to participate in our advertisement campaigns, we will use your telephone number to contact you with a proposal to participate in our advertisement campaign and give you more details about the project.
If you sign a contract with Rolle related to the advertising campaign, we will collect and use the following data for the purpose of completing and fulfilling a contract between you and Rolle:
If you agree, your participation in our advertisement campaign will be based on a contract between Rolle and you (Art. 6(1)(b) of the GDPR).
This data may be transferred to our partners (advertising agencies, directors) that are responsible for implementing the advertisement campaign.
Personal data for your participation in our advertisement campaign are required to fulfill a contract with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract with you.
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.7.5. To enable us to post your content on our social media accounts
If you agree, we will post your content on our social media accounts for marketing and PR purposes.
We base such collection and use on your consent (Art. 6(1)(a) of GDPR).
You may grant or revoke your consent at any time by logging into the Platform, visiting Privacy Settings and changing relevant settings.
In order to post your content on our social media accounts, we provide data to social media platform operators. The following social media platform operators are established outside the European Economic Area, which may result in your data being transferred outside the European Economic Area. In these cases the personal data is protected by the operators entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission:
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.7.6. To allow you to see personalized advertisements
Upon your consent, Rolle will allow advertising service partners to collect your IP address and/or mobile device identifier and place their cookies on your devices and then use the data to personalize advertisements presented to you. This means that with your consent, you will receive advertisements based on your interests and your activity on the Platform. Namely, advertising service partners will collect and use the following data:
To the extent that it involves personal data, we base such collection and use on your consent (Art. 6 (1) (a) of the GDPR).
You can choose not to receive personalized marketing and advertisements at any time by changing relevant settings on the Platform. Withdrawal of permission will not affect the lawfulness of the collection and use carried out prior to the withdrawal of permission.
To enable our service providers to show you personalized advertisements, your data is used by partners who provide personalized advertisement services.
Information is collected for this purpose by advertising service partners and is not stored by Rolle.
2.7.7. To evaluate efficiency of promotional campaigns
When you use the Platform, Rolle analyzes its marketing activities and how you use the Platform (when you register, login, create a listing, make a sale or purchase, upload an itemās photo, open our App, register or install the app, etc.) for the purpose of evaluating the efficiency of promotional campaigns, and to better comprehend visitor behavior after they have viewed a certain ad and visited our Platform or downloaded our App.
We base such collection and use on our legitimate interest to improve the efficiency of our promotional campaigns (Art. 6(1)(f) of GDPR). To the extent that it involves personal data, we base such collection and use on your consent (Art. 6 (1) (a) of the GDPR).
In order to carry out the above evaluations, Rolle provides your data to service providers who evaluate the efficiency of promotional campaign services.
Rolle uses service providers to communicate promotional campaigns, operating within the European Economic Area. In case the providers are not operating in the European Economic Area, this may result in your data being shared with our customer support agents outside the European Economic Area. In these instances, the personal data is protected by the service providers entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission.
In order to optimize our advertising campaigns, we send certain information on your activities like apps opened, sessions, registrations, logins, information about you listing an item, uploading an itemās photo or buying an item, etc. to Google and Facebook advertising platforms. Thus, we transfer the data of your activities to the following recipients:
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.7.8. To manage our social media profiles
If you are interested in our activity and follow our profiles on social media, we collect and use the following data about you in order to manage our social networking sites:
We base such collection and use on our legitimate interest to manage our social media profiles (Art. 6(1)(f) of GDPR).
In order to manage our social media accounts, we receive and provide data to social media platform operators.
The following social media platform operators are established outside the European Economic Area, which may result in your data being transferred outside the European Economic Area. In these cases personal data is protected by the operators entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission:
Personal data collected and used for this purpose are kept as long as you are registered on a specific social media network.
Joint Controllership with Facebook (āpage insightsā)
Rolle operates a so-called fan page on the social media platform of Facebook. Rolle operates a so-called fan page on the social media platform of Facebook. Facebook and Rolle are only jointly responsible for the processing of so-called “insights data” (Art. 26 (1) sentence 1 of the GDPR) insofar as this data is used for the creation of so-called “page insights” and only for the data collection phases from Rolle’s fan page until its transmission to Facebook. For other data processing, Rolle and Facebook are separately responsible for data processing.
Within the scope of their joint controllership, Rolle and Facebook have entered into an agreement (referred to as the “page insights controller addendum“). The agreement covers the data processing that is collected and used in connection with a visit or interaction with our fan page, but only to the extent that this data is also (subsequently) processed for “page insights”. “Page insights” includes analysis services that help us to better understand interactions on our site. In this context, we do not receive any personal data from Facebook, only an anonymous evaluation and illustration. Facebook provides more information on this on its help page for “page insights”. The information about data for “page insights” explains how “insights data” is collected and used to create “page insights”. This includes the following actions:
The processing of visitor data from our fan page serves the purpose of providing the page as well as the statistical evaluation of the use of our page. This evaluation is made anonymous for Rolle. The legal basis for data processing is Art. 6 (1)(f) of the GDPR. Our legitimate interests in the processing of personal data when visiting the site and the creation of “site insights” consist of presenting the company and the Platform. Similarly, we also seek to contact members and interested parties in order to provide information on products and promotions, as well as for the collection of data in order to generate anonymous evaluations and illustrations on the use of our fan page.
If you wish to exercise your rights with respect to your data (see bullet point 6. below), contacting Facebook directly is the most effective way. You can contact us if you still need help in exercising your rights. In accordance with our agreement, Facebook assumes primary responsibility for fulfilling the obligations for the joint processing of “insights data”. This includes fulfilling the following rights:
Facebook provides more details on how to exercise these rights in the “page insights data” information.
Joint Controllership with LinkedIn
Rolle operates a so-called company page on LinkedIn, the social media platform. LinkedIn and Rolle are only jointly responsible (Art. 26 (1) sentence 1 of the GDPR) for the processing of so-called “insights data”, enabling us to receive anonymized statistics and insights on how visitors interact with our page. For other data processing, Rolle and LinkedIn are separately responsible for data processing.
Within the scope of the joint controllership, Rolle and LinkedIn have entered into an agreement (referred to as the “Page Insights Joint Controller Addendum”) in which the data protection obligations are allocated between LinkedIn and Rolle. The agreement stipulates the following:
The data processing of LinkedIn company page visitors serves to provide the page itself as well as the statistical evaluation of the use of our page. This evaluation is made anonymous for Rolle (LinkedIn does not share personal data with us when providing us with the insights, we only have access to a summarized version of the insights; also, we are unable to make conclusions about individual members based on information in the insights). The legal basis for the processing of your personal data is Art. 6 (1)(f) of the GDPR. Our legitimate interests in the processing of personal data when visiting the site and the creation of the “insights” consist of presenting the company and the Platform and, for example, contacting members and interested parties and providing information about products and promotions, as well as the collection of data for the creation of anonymous evaluations and illustrations on the use of our company page.
2.7.9. To enable you to participate in Rolleās referrals program
If you refer one or more friends to Rolleās Platform, you can earn Rolle shopping vouchers. We will collect and use the following data for the purpose of enabling you to participate in Rolleās referrals program and to provide you with a Rolle shopping voucher:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are party (Art. 6 (1) (b) of the GDPR).
Personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
2.8.1. To handle your requests related to personal data
If you exercise your statutory rights regarding your data (see 6 below), we will collect and use the data contained in your request in addition to any other personal data held by Rolle for the purpose of examining the request, responding to it and, when necessary, taking necessary action.
This is necessary in order to comply with the legal obligations to which Rolle is subject (Art. 6 (1) (c) of the GDPR).
Personal data collected and used for this purpose are kept for two (2) years from the day we respond to your request.
2.8.2. To provide information to law enforcement and other state institutions
If we have reasonable grounds to suspect that you are involved in illegal activities, we will collect and use necessary data from your profile data (see 2.1), data related to your activities on the Platform (see 2.2) and data collected and used for security purposes (see 2.3 and 2.4) in order to notify the law enforcement and other state institutions.
Rolle also provides the above data to law enforcement and other state institutions when we receive requests for information in relation to investigations carried out by these institutions.
This is necessary in order to comply with the legal obligations to which Rolle is subject (Art. 6 (1) (c) of the GDPR).
Personal data is required to fulfill our legal obligations when you are a member of our Platform. If you do not provide us with this personal data, we will not be able to comply with legal requirements.
Rolle collects and uses your personal data for this purpose for the same amount of time that your Rolle account is stored ā for 3 months from the date of deactivation of your Rolle account or after five (5) years of inactivity on your account.
2.8.3. To defend our rights against chargebacks
If you have made transactions via our payment service providers, we will collect and use your personal data held by Rolle to the extent necessary to resolve a particular situation.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are party (Art. 6 (1) (f) of the GDPR).
2.8.4. To defend the rights and interests of Rolle
If you become involved in a dispute with Rolle or we need to carry out enforcement of our GTC or otherwise defend, enforce, exercise and uphold our rights, we will collect and use all of your personal data held by Rolle to the extent necessary to resolve a particular situation.
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are party (Art. 6 (1) (f) of the GDPR).
Personal data collected and used for this purpose are kept for five (5) years.
When you upload a listing on the Platform and you request Rolle to evaluate its condition, you must provide the following data in order to complete the evaluation procedure:
This information is collected directly from you at the pre-contractual and contractual stage.
Additionally, during the evaluation process, Rolle collects the following information about your Item:
If the listed Item is a smartphone, Rolle collects the unique identifier of your mobile device (āIMEI numberā). The IMEI number is collected during the evaluation phase and used by our company in order to confirm the Make and Model of your device. To the extent that the above IMEI number or similar identifiers or similar information derived therefrom may be interpreted as, or become, personal data in accordance with the relevant applicable law, we undertake to treat such information as personal data in accordance with the terms of this Privacy Policy.
If the listed Item is a not a smartphone, Rolle collects the serial number of your device. The serial number is collected during the evaluation phase and used by our company in order to confirm the Make and Model of your device. To the extent that the above serial number or similar identifiers or similar information derived therefrom may be interpreted as, or become, personal data in accordance with the relevant applicable law, we undertake to treat such information as personal data in accordance with the terms of this Privacy Policy.
Information about the functionality of some other components of your device such as biometrics, camera front/back, audio (microphone/speaker), digitizer. To collect this information, the App will request you to provide us with the required access on the camera (capture front/back side photos from your device), biometrics, audio functionalities of your device etc. The information that will be collected will be stored and used solely for the purpose of evaluating your deviceās condition.
Additionally, a video of the evaluation appointment will be recorded with the following info:
Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (b) of the GDPR).
We collect and use your personal data for this purpose until your Rolle account is deactivated or inactive for five (5) years.
Rolle transfers or shares personal data with service providers only insofar as necessary and allowed in accordance with applicable laws. Service providers to which your personal data is transferred or with whom it is shared for specific purposes are described under 2 above. In addition, we appoint the following service providers who, as a result, receive personal data as data recipients.
We perform ongoing technical maintenance and upgrades to the Platform to protect the security and confidentiality of personal data we process and to perform certain business-related functions that help make our services available and functional. For this reason, we transfer your profile data to service providers who provide cloud and hosting services, IT security, maintenance and technical services, and communications services.
The following service providers are established outside the European Economic Area, which may result in your data being transferred outside the European Economic Area. In these cases the personal data is protected by the service providers entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission:
We transfer personal data to attorneys, attorney assistants, notaries, bailiffs, auditors, accountants, bookkeepers, debt collectors, consultants, translation agencies, IT service providers, insurance companies, and archiving services that provide services to Rolle.
Rolle is legally obligated to provide personal and/or usage data to investigative, criminal prosecution or supervisory authorities if and to the extent required to prevent risk to the public and for the prosecution of criminal acts.
Rolle may share your data with third parties when transferring rights and obligations pertaining to the contractual relationship between you and Rolle to such third parties in accordance with the GTC (available via the link: https://staging.rolle.io/el-GR/content/info/terms-and-conditions), in particular in the event of the transfer of a business sector, a merger by way of the creation of a new company, a merger by way of absorption, a de-merger or any changes in control affecting Rolle.
Rolle uses cookies and similar technologies on the Platform. You can find out more by visiting our Cookie Policy (available via the link: https://staging.rolle.io/en-GR/content/info/cookie-policy).
As our services are constantly evolving, we reserve the right to change this Privacy Policy at any time subject to the applicable regulations. Any changes will be published promptly on this page. You should, nevertheless, check this page regularly for any updates.
Subject to conditions, limitations, and exceptions established by statutory data protection provisions, you have the right at any time:
To exercise any of the rights specified in this section, you can contact Rolle and submit your request using the contact information (7 below).
If you have any questions regarding the collection and use of your data as part of your use of the Platform, or regarding your rights, please contact our data protection officer at [email protected].
Rolle data protection officer:
2 Merlin Str.
10672 Athens
Greece
Effective date: 31/08/2023 | Last updated: 31/08/2023