Venroys 隐私政策

1. 谁负责处理？

Founders: Constantino Aemilius Darshan Changoe and Muhammet Fatih Koçyigit

2. 我们处理的个人数据

根据您使用 Venroys 的方式（购物、创建帐户、联系我们或在平台上销售商品），我们可能会处理以下几类个人数据：

我们不会故意收集特殊类别的个人数据（例如健康数据）。除非绝对必要，否则请勿在订单备注、支持信息或其他自由文本字段中包含敏感的个人信息。

3. 目的和法律依据

4. Platform, seller and storefront roles

• Venroys is a controller for Venroys accounts, platform security, marketplace administration, platform fees, tax records and operation of our services.
• For an independent seller storefront, the seller may be a separate controller for customer relationships, product information, fulfillment, returns and support. The seller's identity should be available in the relevant storefront or order information.
• Where Venroys handles data only on a seller's instructions, we act as a processor under the applicable agreement. For certain services, including payments and legally required identity checks, Stripe may act as an independent controller.

5. Sources of personal data

• Directly from you through registration, checkout, support, uploads or settings.
• From sellers when they manage an order, return or customer request.
• From payment, fulfillment, shipping, verification and fraud-prevention providers.
• Automatically from devices, logs, cookies and security signals, depending on your choices.

4. Cookie 和类似技术

5. 与第三方共享

我们仅在必要时共享个人数据，例如与以下机构共享：

• 支付服务提供商负责处理付款、退款和相关交易检查。
• 负责配送订单和处理退货的运输和物流合作伙伴。
• 为平台提供支持的托管、基础设施、电子邮件和技术服务提供商。
• 分析和营销合作伙伴（仅在允许的情况下，并在需要时征得您的同意）。
• 在法律要求我们披露信息的情况下，我们会向公共机构、监管机构或执法部门披露信息。

当第三方代表我们处理数据时，我们会根据需要使用数据处理协议，并指示他们仅出于约定的目的处理个人数据。

8. Key service providers

Specific vendors and subprocessors may change as our infrastructure changes. We assess providers before they process personal data.

9. International transfers

Some providers or their subprocessors are located outside the European Economic Area. Where the GDPR requires it, we rely on an adequacy decision, European Commission Standard Contractual Clauses or another valid safeguard. We assess supplementary organizational and technical measures where appropriate.

6. 数据保留

After the applicable period, we delete or anonymize data unless it remains necessary for a legal claim, investigation, dispute or other legal obligation.

7. 安全性

我们采取适当的技术和组织措施来保护个人数据，包括：

• 传输过程中加密（HTTPS / TLS）
• 密码哈希和安全身份验证控制
• 访问控制和基于角色的权限
• 监控、备份和安全维护流程

No system is entirely risk-free. Protect your account with a unique password and two-factor authentication where available.

8. 你的权利

根据您所在地区和适用法律，您可能享有以下权利：

• 请求查阅我们持有的关于您的个人数据。
• 请求更正不准确或不完整的个人数据。
• 如适用，请请求删除您的个人数据。
• 请求限制处理或反对某些处理活动。
• 如果数据处理是基于您的同意，您可以随时撤回您的同意。
• Receive your data in a portable format where the right to data portability applies.
• You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the supervisory authority where you usually live.

Send requests to info@venroys.com. We may request additional information to verify your identity. We normally respond within one month; the GDPR permits a reasoned extension for complex requests.

13. Fraud, trust and automated signals

Venroys uses security, fraud and performance indicators such as delivery outcomes, refunds, chargebacks, account age, policy incidents and verification status. These signals support risk management and marketplace review. Marketplace access is not automatically guaranteed by a score. Decisions with a material effect may be reviewed by a person, and you may contact us to request an explanation or review.

14. Security incidents

We investigate suspected personal-data breaches, limit their effects and notify the competent authority and affected people where legally required. Report suspected security issues to info@venroys.com without sending passwords or complete payment details.

15. Seller responsibilities

Sellers receiving personal data through Venroys must use it lawfully, securely and only for permitted business purposes. They may not use customer data for unsolicited marketing, sell it or disclose it outside necessary order and support processes. Sellers must provide their own privacy information where required and respond to data-subject requests for which they are responsible.

9. 未成年人

Venroys 不面向未达到适用法律规定可自行同意数据处理的年龄（例如，某些司法管辖区规定为 16 岁）的儿童。我们不会在未获得必要同意的情况下故意收集儿童的个人数据。

11. 本隐私政策的变更

我们可能会不时更新本隐私政策。页面顶部的“最后更新”日期显示了本页面上次更改的时间。如果我们做出重大变更，我们会酌情通过网站、电子邮件或帐户通知告知您。