SECURITY AND PRIVACY

This Policy applies to Customers when accessing, installing, registering for or using ROVELA and the features and utilities provided on ROVELA.

This Policy is issued by the Company to set out the principles and measures for security and protection of Customers’ privacy during access to and use of ROVELA; and at the same time to help Customers recognize and proactively take necessary measures to protect their Accounts, information and devices.

The scope of this Policy includes protection of Accounts, devices, authentication methods and communications on ROVELA; management of application access permissions; use of Cookies, analytics tools and similar technologies; prevention, detection and handling of security risks and incidents; privacy protection; and matters relating to third-party links, systems or services.

For the processing and protection of Customers’ Personal Data, the PDP Policy applies. Where there is any difference between this Policy and the PDP Policy regarding the processing of Personal Data, the PDP Policy takes precedence with respect to such content.

Entering into, performing and providing the Services: The Company uses Customer information to create, maintain and manage Accounts; authenticate access rights; perform functions and utilities requested by Customers; record Service usage status; and handle necessary matters arising in the course of providing the Services on ROVELA.

Troubleshooting and improving the Services: The Company uses information to analyze performance, detect errors, troubleshoot, test, maintain, upgrade and improve the stability, safety, usability and operational efficiency of ROVELA.

Verifying and protecting Accounts: The Company uses information to verify identity, access rights and Customer requests; detect unusual login, access or usage activity; apply additional authentication measures; and protect Accounts against impersonation, takeover or unauthorized use.

Providing image and camera features: When a Customer proactively uses a feature requiring the camera or images, the Company may use the corresponding input data to perform the function requested by the Customer, including capturing documents, image recognition or scanning payment codes.

Compliance with legal obligations and regulatory requirements: The Company may collect, use, retain, compare or provide information to the extent necessary to comply with legal provisions, lawful requests of competent authorities, supervisory requirements applicable to operations at VIFC, or to protect the lawful rights and interests of the Company, Customers and relevant parties.

Communications with Customers: The Company uses contact information to send notices regarding Accounts, transactions, security and Service operations; receive and respond to support requests, inquiries, feedback or complaints from Customers through appropriate channels.

Advertising and personalization: Where the Company implements advertising, introduction or content personalization activities, the Company uses information only within the scope notified and on an appropriate basis in accordance with law. Customers are provided with mechanisms to opt out, change preferences or withdraw consent where required by law.

Security and fraud prevention: The Company uses information to monitor, detect, prevent and handle fraud, abuse, unauthorized access, system attacks, impersonation, circumvention of security measures or activities that may cause damage to Customers, the Company or a relevant party. The Company may apply appropriate risk assessment, warning or control measures to the extent permitted by law.

Other purposes: Where a purpose for use of information arises that differs from the notified Purposes, the Company will provide notice, obtain consent or apply an appropriate legal basis for processing in accordance with law before carrying out such purpose, if required by law.

By accessing, registering for and/or using ROVELA, the Customer confirms that the Customer has read, understood and accepted this Policy; and at the same time consents to the Company collecting, receiving, using, storing and processing the Customer’s information within the scope, for the purposes and in the manner set out in this Policy.

The Customer’s acceptance of this Policy takes effect from the time the Customer accesses, registers for and/or uses ROVELA and is maintained throughout the period during which the Customer continues to use the Products/Services, unless the Customer exercises the right to withdraw consent or other rights under this Policy, other relevant ROVELA policies and regulations, and applicable law.

The Customer understands that the collection and processing of certain information is necessary for the Company to operate ROVELA, authenticate and protect Accounts, ensure transaction security, prevent fraud, support Customers and provide the functions and utilities of the Products/Services. Where the Customer does not provide necessary information, withdraws consent or requests restriction of information processing, the Company may be unable to provide or continue providing part or all of the relevant Products/Services.

For access permissions to the device or device features, including the camera, images, notifications and other access permissions, the Customer’s allowing ROVELA access through the device settings is understood as acceptance of the use of such access permission for the corresponding notified purpose. The Customer may change or revoke a granted permission through the device settings at any time.

The Customer’s withdrawal of consent does not affect the lawfulness of processing activities carried out before the request to withdraw consent takes effect and does not terminate processing activities that the Company is permitted or obligated to continue carrying out in accordance with law.

Information provided by Customers: Including registration and identification information; contact information; documents, images and information used for verification; information provided by Customers when requesting support, inquiries, submitting feedback or complaints; and other information proactively provided by Customers to the Company. The specific categories of Personal Data are set out in the PDP Policy.

Information arising during use of the Services: Including information on Accounts, authentication status, transaction history and status, payment information permitted to be received, inquiry information, receipts, alerts, security check results and data arising from Customers’ interactions with ROVELA.

Cookies, analytics tools and similar technologies: The Company may use Cookie files, software development kits, measurement tags, device identifiers and similar technologies to maintain access sessions, remember preferences, protect logins, measure performance, detect errors, analyze usage and support system security. Cookies or technologies necessary for operations, authentication and security may be used to the extent necessary to provide the Services.

Technical information and system logs: The Company may automatically record device type, operating system, application or browser version, IP address, access time, login session, actions on the system, authentication data, error information, security alerts, transaction logs and other technical information necessary to operate, monitor, trace and protect ROVELA.

Payment card information: Where card information is entered and processed in the secure environment of a payment processor, the Company does not store the full card number on ROVELA’s core system. The Company only receives truncated information, tokenized information or transaction identification information to the extent necessary to provide the Services, perform reconciliation, provide support and handle incidents.

Information from other sources: The Company may receive information from service providers, partners, competent authorities, public information sources or other lawful sources to the extent necessary for verification, security, fraud prevention, Service support or compliance with legal obligations. The receipt and use of information are carried out on an appropriate legal basis.

Control of access to the Services: To the extent permitted by law, the Company has the right to temporarily restrict, suspend or deny access to part or all of ROVELA when it detects or has reasonable grounds to suspect intrusion, impersonation, fraud, abuse, exploitation of vulnerabilities, violation of security rules or a risk that may affect the safety of Customers, the Company or the system. The application of this control measure does not limit the Customer’s mandatory rights under law.

The processing, storage, deletion, destruction or de-identification period for Data/information is implemented in accordance with applicable law for each type of data and processing activity, and for Personal Data, is implemented in accordance with the PDP Policy.

System logs, access logs, authentication information, security logs, data used for fraud prevention, incident handling, inquiries or disputes may be retained for the period necessary to protect the system, trace events, investigate and handle incidents, provide evidence of electronic activities, perform legal obligations or protect the lawful rights and interests of the Company and relevant parties. Closing an Account or ceasing use of the Services does not automatically terminate retention obligations that continue to be required by law or a lawful purpose.

The Company may integrate, connect, embed or provide links to systems, websites, applications or services of Partners/Third Parties to support verification, transaction processing, security, storage, technical support or other necessary functions of ROVELA. Where necessary, the Company may provide, share or permit access to information to the extent consistent with this Policy, the PDP Policy, applicable agreements and legal provisions.

Independent activities of Partners/Third Parties are governed by the terms, policies and security measures of such Partners/Third Parties. When Customers are redirected to the environment of a Partner/Third Party or proactively interact directly with a Partner/Third Party, Customers are responsible for reading and reviewing the corresponding terms and policies before continuing to use or provide information. To the extent permitted by law, the Company is not responsible for the collection, use or security of information independently carried out by a Partner/Third Party outside the Company’s reasonable control.

Where the Company engages, appoints or permits a Partner/Third Party to process information within the scope of the Company’s responsibility, the Company applies appropriate selection, contractual, authorization and monitoring measures according to the nature of the service, level of risk and legal requirements. The use of a Partner/Third Party does not exclude the Company’s obligations to the extent the law determines that the Company is responsible.

The Company applies administrative, technical, organizational and physical measures appropriate to the nature of the information, level of risk, legal requirements, standards and operating conditions to limit the risk of unauthorized access to, use, alteration, disclosure, loss or destruction of information. Security measures are reviewed, assessed and updated as appropriate to risks arising in the course of operations.

Depending on the system and type of information, measures may include: (i) access authorization based on functions and duties and control of privileged accounts; (ii) application of appropriate authentication methods; (iii) encryption, masking, tokenization or equivalent protective measures for confidential information and sensitive data; (iv) logging, monitoring, alerting and detection of unusual activity or unauthorized access; (v) backup, recovery and maintenance of operational capability; (vi) vulnerability management, patching, security testing and change control; (vii) application of security requirements to personnel, Partners and service providers; and (viii) verification of identity and authority before providing information or carrying out a request that may affect an Account, transaction or Personal Data.

The Company maintains appropriate traceability for data messages, authentication information, system logs and transaction history to serve verification, reconciliation, inquiries, incident investigation, dispute resolution and provision of evidence in accordance with law.

The Company publishes official access, installation and contact channels; and may also provide alerts, guidance for identifying fraud and impersonation, and recommendations for safe use of the Services. Customers should check the source of release, access address, recipient information, displayed content and contact channel before providing information, entering authentication information or confirming an action on ROVELA.

No information system, data transmission method or security measure can absolutely eliminate all risks. Therefore, the Company does not guarantee that ROVELA will in all circumstances be entirely free from interruption, intrusion, attack or incidents. To the extent permitted by law, the Company is not responsible for damage arising entirely from events beyond the Company’s reasonable control, acts of independent third parties or Customers’ failure to comply with required security measures.

Measures for protection of Personal Data, handling of Personal Data incidents and responsibilities of the parties in the processing of Personal Data continue to be implemented in accordance with the PDP Policy.

Where implemented, the Company may use information on Customers’ activities on ROVELA to improve experience, content and features and introduce Services more suited to Customers’ needs, on an appropriate legal basis for processing and within the notified scope.

For advertising or personalization activities that are not necessary for provision of the Services, the Company provides notice and a mechanism for Customers to choose, opt out or withdraw consent where required by law. Opting out of advertising does not affect necessary notices regarding Accounts, transactions, security, operations or legal obligations.

Where advertising content, links or services provided by a third party are displayed on ROVELA, the Company provides appropriate identification or notice to the necessary extent. When Customers interact directly with a third party, the third party’s independent processing of information is carried out in accordance with that party’s policy.

The Company does not sell Customers’ Personal Data to third parties for the third parties’ unrestricted use for independent advertising purposes. Where information is provided to a third party for advertising, measurement or personalization, the Company applies requirements concerning the legal basis for processing, scope of data and Customer choice rights in accordance with the PDP Policy and legal provisions.

Customers have the right to be informed of and exercise rights relating to Personal Data in accordance with law and the PDP Policy. If a Customer has questions about how the Company collects, uses or protects information, the Customer may contact the Company using the information in Section 12.3 of this Policy.

Customers have the right to consent, refuse consent, withdraw consent, request restriction of or object to Personal Data processing activities to the extent permitted by law and in accordance with the PDP Policy. Exercise of a right may affect a feature or Service that directly depends on the corresponding information; in such case, the Company will handle the matter in accordance with law and the PDP Policy.

Customers have the right to check, update, correct or request the Company to correct their information through functions provided on ROVELA or through support channels. The Company has the right to require information necessary to verify identity, authority and the validity of the request before carrying it out.

Customers are responsible for protecting their Accounts, devices, passwords, PINs, one-time passwords (OTPs), biometric information used for authentication and other information used to access or authenticate Accounts; and must not unlawfully share, transfer or allow others to use them. Responsibilities relating to use of Accounts and authentication methods are implemented in accordance with the Terms of Service and the PDP Policy.

Customers undertake that the information, documents and requests provided to the Company are complete, accurate, lawful and timely; and must update them when changes occur. Customers are responsible for consequences arising from intentionally providing incorrect, forged or misleading information or failing to update information in a manner that affects the ability to verify, support or protect Accounts.

Customers must notify the Company immediately upon discovering or suspecting that a device, Account or authentication information has been lost, stolen, disclosed or accessed without authorization, or upon discovering an unusual transaction, notice or activity. The Company never requests Customers to provide full passwords, PINs or OTPs through calls, messages or ordinary support channels. Customers should not comply with requests to provide such information from any organization or individual claiming to represent ROVELA.

Customers must not interfere with, scan, conduct unauthorized testing of, exploit vulnerabilities in, circumvent security measures of, gain unauthorized access to, distribute malicious code through, unlawfully collect or use information from, reverse engineer, or carry out conduct that disrupts, overloads or compromises the security of ROVELA. To the extent permitted by law, the Company has the right to apply technical measures, restrict access, disable features or take other necessary measures to protect the system and affected parties; and reserves the right to claim compensation or take legal measures in respect of violations.

The Company has the right to amend, update, supplement or replace this Policy from time to time to align with the business situation, ROVELA’s operations, changes to the Products/Services, technology, security measures, requirements of competent authorities, requirements applicable under the VIFC framework and/or relevant legal provisions. The amended, updated, supplemented or replaced version and its effective time will be published by the Company on the ROVELA Platform and/or notified to Customers by an appropriate method.

Customers are responsible for regularly checking and updating themselves on the contents of this Policy. A Customer’s continued access to, registration for and/or use of ROVELA after the amended, updated, supplemented or replaced version of the Policy takes effect is understood to mean that the Customer has read, understood and accepted all such amended, updated, supplemented or replaced content.

Effective amended, updated, supplemented or replaced content forms an integral part of this Policy and applies to Customers from the effective time published by the Company, or where the Company notifies a different application time.

Upon detecting signs or incidents of cybersecurity, information security or violations of Personal Data protection regulations, the Company takes appropriate measures to verify; isolate and prevent; preserve logs and evidence; assess the scope, type of information and level of impact; remediate and recover; and prevent recurrence.

The Company records, reports, notifies and coordinates incident handling with competent authorities, relevant supervisory entities or Customers within the scope, content and time limits prescribed by law. Notification to Customers is carried out based on the nature of the incident, level of impact and requirements of applicable law.

Customers may submit feedback regarding security, privacy, indications that information has been used for an improper purpose, or support requests through the following official channels: