Global Privacy Policy

1. Our Roles: Controller vs. Processor

Because Rovekey provides a multi-tenant B2B platform for hotel operations, our legal responsibilities depend on the type of data being processed:

• Rovekey as a Data Controller (or "Data User" / "Organization"): When you visit our website, register an Organization account, or interact with our billing team, we determine the purpose and means of processing your personal data. This Privacy Policy primarily governs this data.
• Rovekey as a Data Processor (or "Data Intermediary"): When a hotel or enterprise customer ("Customer") utilizes Rovekey to log parcels, daily turnover recaps, or staff rosters, the Customer is the Data Controller. Rovekey processes this operational data strictly on behalf of the Customer in accordance with our Data Processing Agreement (DPA). If you are a hotel guest or an employee of a Customer and have questions about how your data is handled within the platform, please contact the Customer (your hotel) directly.

2. What Data We Collect (As a Controller)

We collect personal data directly from you when you create an account, purchase a subscription, or contact support:

• Identity & Contact Data: Full name, work email address, contact telephone, and job title.
• Organization & Billing Metadata: Property name, business registration details, billing email, and Stripe Customer ID. (Note: We do not process or store raw credit card numbers).
• Technical & Telemetry Data: IP address, browser type, authentication logs, and device identifiers collected automatically upon platform access to monitor security and enforce tenant isolation.

3. Purpose and Legal Basis for Processing

We collect and process your personal data in accordance with applicable data protection laws, including the Hong Kong PDPO and Singapore PDPA, for the following purposes:

• To Fulfill Our Contract: To set up your Organization workspace, authenticate user logins, provide the platform services, and manage your subscription and billing.
• For Platform Security and Improvement: To monitor system performance, investigate suspected fraud or unauthorized access, and analyze de-identified telemetry to improve our system architecture (relying on legitimate business interests where permitted by law).
• For Legal and Regulatory Compliance: To comply with statutory tax, invoicing, accounting, and anti-money laundering regulations in the jurisdictions where we operate.
• With Your Consent: For sending direct marketing communications, newsletters, or feature updates. You maintain the right to withdraw this consent or opt-out at any time.

4. Cross-Border Data Transfers

Rovekey is headquartered in the Hong Kong Special Administrative Region. To provide a high-availability, low-latency service, we utilize global cloud infrastructure with servers located in the United States and Singapore.

When we transfer personal data across borders, we implement recognized contractual and technical safeguards:

• For Hong Kong/Singapore Data: We utilize the Recommended Model Contractual Clauses (RMCs) endorsed by the Hong Kong PCPD and ensure recipients are bound by obligations comparable to the PDPO and PDPA.

A full list of our authorized Sub-processors and their locations can be found at rovekey.com/legal/subprocessors.

5. Security & Data Retention

• Security: We employ strict multi-tenant logical isolation via database-level Row Level Security (RLS), end-to-end TLS encryption in transit, encryption at rest, and principle-of-least-privilege access controls.
• Retention: We retain administrative and billing data for as long as your organization maintains an active subscription, and thereafter for up to seven (7) years to satisfy statutory tax, accounting, and legal audit requirements. Customer operational data is deleted or anonymized upon termination of the Agreement in accordance with our DPA.

6. Your Global Privacy Rights

Depending on your jurisdiction (including rights granted under the PDPO and PDPA), you may have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request Erasure (the "Right to be Forgotten") of your data, subject to our legal retention obligations.
• Withdraw Consent at any time where processing is based on consent (including opting out of marketing communications).
• Object to or Restrict certain processing activities.

How to exercise these rights:

• If you are an Organization Admin or website visitor, please email your request to our Data Protection Officer at hello@rovekey.com.
• If your data is hosted within a hotel's Rovekey workspace (i.e., you are a hotel employee or guest), Rovekey cannot delete or modify your data directly. We will promptly route your request to the relevant Organization Admin, who possesses the administrative tooling to fulfill your request.

7. Direct Marketing

We will not sell your personal data. We will not use your personal data for direct marketing without your express, informed consent. If you consent to receive platform updates, operational newsletters, or feature releases, you may opt out at any time by clicking the "Unsubscribe" link in any promotional message or emailing us directly.

8. Contact Our Data Protection Officer (DPO)

If you have any questions, complaints, or requests regarding this Privacy Policy or our data handling practices, please contact our Data Protection Officer: