ROOV Privacy Notice

1. Who are we?

ROOV is developed and provided by Augias Corp. NV, a public limited company incorporated under Belgian law, registered with the Crossroads Bank for Enterprises under number 0670.959.094, with its registered office at Xavier De Cocklaan 70 box 2, 9831 Deurle, Belgium (hereinafter “ROOV”, “we” or “us”).

For questions about this Privacy Policy or the processing of personal data, you can contact us at:

Email: customercare@roov.app

2. What does this Privacy Policy apply to?

This Privacy Policy describes how ROOV processes personal data when ROOV itself acts as the controller.

This is the case, among other things, for certain processing activities relating to:

• the creation and management of user accounts;
• authentication and access security;
• the use and security of ROOV Business and ROOV Budget;
• customer support and communications;
• contract, customer and invoicing management;
• ROOV’s public website, including www.roov.app;
• security, logging and fraud prevention;
• the analysis, development and improvement of the ROOV Services;
• certain regulated financial services;
• marketing and commercial communications; and
• compliance with ROOV’s legal and regulatory obligations.

Customers of ROOV may also use the ROOV Services to process personal data for which the Customer itself acts as the controller and ROOV acts solely as a processor.

This is typically the case, for example, for personal data forming part of client files managed by a Customer through ROOV Business.

For such processing, the Customer determines the purposes for which the personal data is processed and the applicable legal basis. The privacy information provided by the relevant Customer applies to such processing. The relationship between ROOV and the Customer in respect of such processing is governed by a separate Data Processing Agreement.

3. What personal data does ROOV process as a controller?

Depending on your relationship with ROOV and the services you use, ROOV may process, among other things, the following personal data as a controller.

Identification and contact data, such as your name, email address, telephone number and professional contact details.

Account data, such as your user identifier, organisation, role, access rights and information about your Account.

Authentication and security data, such as information about logins, authentication methods, multi-factor authentication, security events and attempts to gain unauthorised access.

Technical and usage data, such as your IP address, date and time of access, browser and device information, features used, actions performed and technical log data.

Professional data, such as the organisation you work for, your position, your professional role and your relationship with a Customer.

Communication and support data, such as emails, support requests, notifications and other communications with ROOV.

Contractual and administrative data, such as data relating to an agreement, subscription, invoice, payment or commercial relationship with ROOV.

Marketing data, such as contact details, marketing preferences, information about previous communications and interactions with newsletters, events or other commercial communications.

Website and analytics data, such as information about your visit to our Website and, where applicable, data collected through cookies or similar technologies.

Where you use a regulated financial service provided by ROOV, ROOV may also process financial data, such as account identification data, account information and transaction data, to the extent necessary for the relevant service.

4. Where do we obtain personal data from?

ROOV may obtain personal data:

• directly from you;
• from a Customer that creates an Account for you, invites you or grants you access;
• from your employer or organisation;
• automatically when you use the ROOV Services or Website;
• through authentication, security or other technical systems;
• from service providers that support ROOV in providing its services;
• through marketing, communication and analytics applications; and
• where applicable, from financial institutions or other data sources to which you establish an authorised connection.

Where personal data is not obtained directly from you, we only process it where there is a valid legal basis for doing so.

5. Why do we process personal data and on what legal basis?

ROOV processes personal data as a controller only for specified purposes and where there is a valid legal basis for doing so.

Where processing is based on ROOV’s legitimate interests, we assess whether our interests are outweighed by your interests, fundamental rights and freedoms.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before your consent was withdrawn.

6. What data is required?

Certain personal data is required in order to use ROOV.

For example, certain identification, contact and authentication data is required to create an Account, identify a User and secure access to ROOV.

If you do not provide such required data, we may be unable to create an Account or make certain ROOV Services available to you.

Other personal data is optional. Where relevant, this will be indicated when the data is collected.

7. Personal data managed by a Customer

A Customer may use ROOV to manage personal data relating to clients, protected persons, customers of the Customer or other data subjects.

ROOV generally processes such data solely on behalf of and on the instructions of the Customer. For such processing, the Customer is the controller and ROOV is the processor.

The Customer is therefore responsible, among other things, for the purpose and legal basis of the processing, determining who has access to the data, providing the required privacy information and handling requests from data subjects.

Where a data subject asks ROOV directly to access, rectify or erase personal data contained in such a file, restrict its processing or otherwise exercise a right, ROOV will in principle refer that request to, or handle it in consultation with, the relevant Customer, as that Customer is the controller for such processing.

8. ROOV Budget

Through ROOV Budget, a User may view information made available through a Customer and share information, financial data or documents with a Customer.

Where you share data with a Customer through ROOV Budget, that data may become part of the file or records managed by that Customer.

To the extent that the Customer subsequently determines the purposes for which that data is processed, the Customer is the controller for that processing.

Closing your Account, ending your access to ROOV Budget or terminating a particular data connection therefore does not automatically result in information previously shared with a Customer being removed from the file or records managed by that Customer.

For questions about the further processing or retention of such data, you can contact the relevant Customer.

9. Bank data and regulated financial services

Certain ROOV Services may enable information relating to payment accounts to be obtained from financial institutions.

Where ROOV itself provides a regulated account information service, ROOV processes the personal data necessary to provide that service and to comply with the legal and regulatory obligations applicable to ROOV.

This may include, among other things:

• account identification data;
• information about account holders;
• balances;
• transactions; and
• other information made available by the relevant financial institution through the authorised connection.

Access to a payment account only takes place after the steps required under the applicable regulations have been completed.

The General Terms of Use and this Privacy Policy do not in themselves constitute consent to access a payment account.

For certain regulated financial services, ROOV may provide additional specific information about the relevant processing.

10. Artificial intelligence and product development

ROOV may use personal data for which it acts as the controller for analysis and product development, including the development, testing, training, evaluation and improvement of internal algorithms and AI models.

This may be done, among other things, to:

• improve existing features;
• increase the accuracy of automated outputs;
• develop new features;
• identify errors and anomalies;
• improve the usability and performance of ROOV; and
• increase the security and reliability of the ROOV Services.

ROOV limits the personal data used for these purposes to what is reasonably necessary for the relevant purpose. Where possible, personal data is aggregated, pseudonymised or anonymised.

The retention period for data used for development, analysis or training depends, among other things, on the relevant development purpose, the nature of the data, the lifecycle of the model or feature and the need to test, validate or reproduce results. Personal data is not retained for longer than is reasonably necessary for these purposes.

ROOV does not currently make decisions based solely on automated processing that produce legal effects concerning an individual or similarly significantly affect that individual.

If ROOV uses such decision-making in the future, it will inform the relevant data subjects in accordance with applicable law.

11. Website, analytics and cookies

When you visit our Website, ROOV may process certain technical and analytics data in order to make the Website available, secure it and analyse its use.

Where the use of cookies or similar technologies requires consent under applicable law, such technologies are only used after the required consent has been obtained.

More information about the cookies and similar technologies used, their purposes, providers and retention periods can be found in our separate Cookie Policy.

12. Direct marketing

ROOV may use personal data to inform existing and prospective Customers, Professional Users and other relevant professional contacts about its services, new features, events, training courses and other relevant developments.

This only takes place where there is a valid legal basis for doing so.

Where legally required, we obtain your consent in advance. In other cases, ROOV may rely on its legitimate interests for direct marketing, to the extent permitted by applicable law.

You may unsubscribe from electronic marketing communications at any time using the unsubscribe link in the relevant message or by contacting us at customercare@roov.app.

Where you object to direct marketing, we will no longer use your personal data for that purpose. Limited data may nevertheless be retained in order to ensure that your unsubscribe request or objection continues to be respected.

13. With whom do we share personal data?

ROOV may share personal data for which it acts as the controller with third parties where this is necessary for the relevant processing.

This may include:

• ROOV employees and other persons acting on behalf of ROOV who require the data for their role;
• hosting and infrastructure providers;
• authentication and security service providers;
• communication, marketing, analytics and customer support providers;
• invoicing, accounting and payment service providers;
• IT and software providers;
• professional advisers, such as lawyers, accountants and auditors;
• financial institutions or financial infrastructure providers where necessary for a financial service being used; and
• public authorities, supervisory authorities, courts or other competent authorities where ROOV is legally required to disclose data.

Where a third party processes personal data on behalf of ROOV, ROOV enters into appropriate contractual data protection arrangements where required.

14. Is personal data processed outside the EEA?

Some of ROOV’s service providers may process personal data outside the European Economic Area (“EEA”).

Where personal data is transferred to a country outside the EEA, this only takes place where there is a valid transfer mechanism in accordance with applicable data protection law.

ROOV may rely, among other things, on:

• an adequacy decision of the European Commission;
• standard contractual clauses approved by the European Commission; or
• another legally permitted transfer mechanism.

Where necessary, we take additional measures to ensure an appropriate level of protection.

You may contact customercare@roov.app to request further information about the applicable safeguards and, where applicable, how to obtain a copy of them.

15. How long does ROOV retain personal data?

ROOV does not retain personal data for which it acts as the controller for longer than is necessary for the purposes for which it is processed, unless a longer retention period is required or justified by law.

In principle, the following retention periods and criteria apply:

• Account, usage, security and support data is retained for as long as the Account or relevant relationship remains active and, in principle, for no more than five (5) years thereafter. Data necessary for investigating fraud, security incidents, complaints, disputes or legal claims may be retained for longer for as long as reasonably necessary.
• Contractual, administrative, invoicing and accounting data is retained for the duration of the relevant relationship and thereafter for the applicable statutory retention periods, which may in some cases be up to ten (10) years.
• Marketing and prospect data is retained for as long as there is a relevant commercial relationship or interaction and, in principle, for no more than five (5) years thereafter, unless you object or withdraw your consent earlier. Limited data may be retained for longer where necessary to ensure that an unsubscribe request or objection continues to be respected.
• Data used for internal analysis, product development and the development, testing, training or evaluation of internal algorithms or AI models is retained for as long as reasonably necessary for the relevant purpose. In doing so, ROOV takes into account, among other things, the nature of the data, the development or training purpose, the lifecycle of the relevant feature or model and the need to test, validate or reproduce results.

Where ROOV acts solely as a processor for a Customer, the applicable retention periods are determined by the Customer and the arrangements between ROOV and that Customer.

16. How do we protect personal data?

ROOV implements appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, against accidental loss, destruction or damage, and against unauthorised access.

Depending on the processing concerned, these measures include, among other things:

• access controls;
• individual user accounts;
• strong authentication measures;
• multi-factor authentication;
• encryption;
• logging and monitoring;
• backups;
• security and incident management procedures; and
• organisational measures relating to data protection and information security.

17. What rights do you have?

Where ROOV is the controller of your personal data, you have, to the extent provided for by applicable law, among other things, the right to:

• receive information about the processing of your personal data;
• access your personal data;
• have inaccurate personal data corrected;
• have incomplete personal data completed;
• have personal data erased;
• object to certain processing;
• receive your personal data, in certain cases, in a structured, commonly used and machine-readable format;
• withdraw consent that you have given; and
• exercise the applicable rights relating to decisions based solely on automated processing.

These rights are not absolute. Legal exceptions or limitations may apply depending on the processing concerned and the circumstances.

18. Right to object

Where ROOV processes personal data on the basis of its legitimate interests, you may object to such processing on grounds relating to your particular situation.

ROOV will then no longer process the relevant personal data for that purpose unless ROOV demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing, you may object to such processing at any time. Following such an objection, your personal data will no longer be used for direct marketing purposes.

19. How can you exercise your rights?

Where ROOV is the controller for the relevant processing, you may send your request to:

customercare@roov.app

We may request additional information where reasonably necessary to verify your identity and protect personal data against unauthorised access.

Where your request relates to personal data for which a Customer is the controller and ROOV acts solely as a processor, that Customer is responsible for handling your request. In such cases, ROOV does not independently decide on requests for access to, rectification or erasure of the relevant personal data, restriction of processing, or the exercise of other data protection rights.

In such cases, we may forward your request to the relevant Customer or ask you to contact that Customer directly. In any further handling of such requests, ROOV will act in accordance with applicable law and the lawful instructions of the relevant Customer.

Where a data subject is subject to a legal, judicial or other protective measure, the manner in which they may exercise their data protection rights depends on the nature and scope of that protective measure. Where provided for by applicable law, these rights may be exercised by or with the assistance of an authorised parent, guardian, court-appointed administrator or other legal representative.

ROOV may request reasonable information or supporting documents in order to determine whether the data subject may submit the request independently or whether a representative is authorised to act on their behalf. The existence of a protective measure does not automatically mean that the data subject cannot exercise their data protection rights independently.

A request for erasure does not automatically result in the deletion of personal data. The right to erasure only applies subject to the conditions and limitations of applicable law. Where the relevant personal data is processed under the responsibility of a Customer, that Customer assesses the request in its capacity as controller.

20. Data Protection Officer

ROOV has appointed a Data Protection Officer (“DPO”).

For questions about data protection or to contact the DPO, you can contact the DPO at:

Email: customercare@roov.app

Messages addressed to the DPO will be forwarded internally.

21. Complaint to a supervisory authority

If you believe that your personal data is not being processed in accordance with applicable law, you may contact ROOV or our DPO at any time.

You also have the right to lodge a complaint with a competent supervisory authority.

In Belgium, you may contact:

Belgian Data Protection Authority
Drukpersstraat 35
1000 Brussels
Belgium

You may also lodge a complaint with another competent supervisory authority where permitted by applicable law.

22. Changes to this Privacy Policy

ROOV may update this Privacy Policy from time to time, for example where our services, processing activities or legal obligations change.

The most recent version will be made available through our Website and/or the ROOV Services.

Where a change materially affects the way in which we process personal data, we will inform the relevant data subjects in an appropriate manner where required by applicable law.

A change to this Privacy Policy does not, in itself, create a new legal basis for processing personal data.

23. Contact

For questions about this Privacy Policy, the processing of your personal data or the exercise of your rights, you can contact:

Augias Corp. NV
Xavier De Cocklaan 70 box 2
9831 Deurle
Belgium

Email: customercare@roov.app