Venroys Privacy Policy

1. Who is responsible for processing?

Founders: Constantino Aemilius Darshan Changoe and Muhammet Fatih Koçyigit

2. Personal Data We Process

Depending on how you use Venroys (shopping, creating an account, contacting us, or selling on the platform), we may process the following categories of personal data:

We do not intentionally collect special categories of personal data (for example, health data). Please do not include sensitive personal information in order notes, support messages, or other free-text fields unless it is strictly necessary.

3. Purposes and Legal Bases

4. Platform, seller and storefront roles

• Venroys is a controller for Venroys accounts, platform security, marketplace administration, platform fees, tax records and operation of our services.
• For an independent seller storefront, the seller may be a separate controller for customer relationships, product information, fulfillment, returns and support. The seller's identity should be available in the relevant storefront or order information.
• Where Venroys handles data only on a seller's instructions, we act as a processor under the applicable agreement. For certain services, including payments and legally required identity checks, Stripe may act as an independent controller.

5. Sources of personal data

• Directly from you through registration, checkout, support, uploads or settings.
• From sellers when they manage an order, return or customer request.
• From payment, fulfillment, shipping, verification and fraud-prevention providers.
• Automatically from devices, logs, cookies and security signals, depending on your choices.

4. Cookies and Similar Technologies

5. Sharing With Third Parties

We share personal data only when necessary, for example with:

• Payment service providers to process payments, refunds, and related transaction checks.
• Shipping and logistics partners to deliver orders and handle returns.
• Hosting, infrastructure, email, and technical service providers that support the platform.
• Analytics and marketing partners (only where permitted and, where required, with your consent).
• Public authorities, regulators, or law enforcement where we are legally required to disclose information.

Where third parties process data on our behalf, we use data processing agreements where required and instruct them to process personal data only for the agreed purposes.

8. Key service providers

Specific vendors and subprocessors may change as our infrastructure changes. We assess providers before they process personal data.

9. International transfers

Some providers or their subprocessors are located outside the European Economic Area. Where the GDPR requires it, we rely on an adequacy decision, European Commission Standard Contractual Clauses or another valid safeguard. We assess supplementary organizational and technical measures where appropriate.

6. Data Retention

After the applicable period, we delete or anonymize data unless it remains necessary for a legal claim, investigation, dispute or other legal obligation.

7. Security

We implement appropriate technical and organizational measures to protect personal data, including:

• Encryption in transit (HTTPS / TLS)
• Password hashing and secure authentication controls
• Access controls and role-based permissions
• Monitoring, backups, and security maintenance processes

No system is entirely risk-free. Protect your account with a unique password and two-factor authentication where available.

8. Your Rights

Depending on your location and applicable law, you may have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete personal data.
• Request deletion of your personal data, where applicable.
• Request restriction of processing or object to certain processing activities.
• Withdraw consent at any time where processing is based on consent.
• Receive your data in a portable format where the right to data portability applies.
• You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the supervisory authority where you usually live.

Send requests to info@venroys.com. We may request additional information to verify your identity. We normally respond within one month; the GDPR permits a reasoned extension for complex requests.

13. Fraud, trust and automated signals

Venroys uses security, fraud and performance indicators such as delivery outcomes, refunds, chargebacks, account age, policy incidents and verification status. These signals support risk management and marketplace review. Marketplace access is not automatically guaranteed by a score. Decisions with a material effect may be reviewed by a person, and you may contact us to request an explanation or review.

14. Security incidents

We investigate suspected personal-data breaches, limit their effects and notify the competent authority and affected people where legally required. Report suspected security issues to info@venroys.com without sending passwords or complete payment details.

15. Seller responsibilities

Sellers receiving personal data through Venroys must use it lawfully, securely and only for permitted business purposes. They may not use customer data for unsolicited marketing, sell it or disclose it outside necessary order and support processes. Sellers must provide their own privacy information where required and respond to data-subject requests for which they are responsible.

9. Minors

Venroys is not intended for children under the age required by applicable law to consent to data processing on their own (for example, 16 in some jurisdictions). We do not knowingly collect personal data from children without the required consent.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top shows when this page was last changed. If we make material changes, we may notify you through the website, email, or account notifications where appropriate.