Privacy Policy

Welcome to Revuto's Privacy Policy!

Please note that this Privacy Policy applies to personal data that is collected and processed by Revuto OÜ, a company registered in Estonia, Keemia tn 4, 10616 Tallinn, TIN: 16108647 VAT number: EE102322835 and Revuto savjetovanje d.o.o, a company registered in Croatia, Vladimira Nazora 21, 10000 Zagreb, CIN 05361567 (collectively "REVUTO", "we" or "us"). 

REVUTO companies, as joint data controllers, collect and process personal data relating to interactions on the Website and Revuto App (as defined in the Definitions section of the Terms of Use). This Privacy Policy describes how REVUTO uses and protects any information that you give us. 

In some cases, other controllers may process your data. For example, if you decide to open an electronic money account and obtain a virtual debit card to manage your subscriptions via Revuto App, Payrnet Ltd (as defined in Terms of Use) or UAB Payrnet (as defined in Terms of Use) will act as joint controllers with Revuto. To obtain more information on the processing of personal data by these controllers (as listed below in the table), please see their applicable privacy policies.This Policy applies to the data processing that takes place through or in connection with the following: (a) your use of the Website (as defined in Definition Section of our Terms of Use) (b) your use of the Software (as defined in Definition Section of our Terms of Use) (c) your use of the Revuto App (as defined in Definition Section of our Terms of Use). 

We believe in full transparency, which is why we keep our Privacy Policy simple and easy to understand. 

We strongly urge you to read this Privacy Policy and make sure that you fully understand and agree with it. If you do not agree to this Privacy Policy, please do not access or otherwise use the Website and Revuto App. 

Any capitalized but undefined term in this Privacy Policy shall have the meaning given to it in the Definitions section of the Terms of Use. 

1. DEFINITIONS

2. DATA CONTROLLER

3. WHAT DATA DO WE COLLECT ABOUT YOU AND WHEN?

4. PERSONAL DATA WE PROCESS

5. WHAT WE DO NOT DO?

6. PERSONAL DATA SECURITY

7. WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

8. INTERNATIONAL TRANSFER OF YOUR PERSONAL DATA

9. HOW LONG DO WE KEEP YOUR DATA?

10. YOUR RIGHTS

11. CALIFORNIA RESIDENTS PRIVACY NOTICE

12. CHANGES TO PRIVACY POLICY

1. DEFINITIONS

When we say "consent" we mean your explicit consent on the processing of personal data. Persons who are 18 years of age or older may give free consent to the processing of their personal data.

When we say "cookies" we mean small pieces of data stored on your device (computer or mobile device). This information is used to track your use of the Website and to compile statistical reports on website activity. For further information about the use of cookies and how you can manage them, please read our Cookie Policy.

When we say "Data controller“ we mean the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

When we say "Data Processors" or "processor" we mean any natural or legal person who processes the data on behalf of the Data Controller. In addition, we may use the services of various service providers to process your data more effectively. In such cases, they are either our processors or sub-processors.

When we say "Data Subject", bsp;"you" or "your" or we mean any natural person that shares personal data with us via Revuto.

When we say “GDPR” we mean the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

When we say "processing" we mean any operation or set of operations which is performed on personal data or sets of personal data. This includes activities such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

When we say "personal data" or "data" we mean any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, either directly or indirectly. Therefore, data about a company or any legal entity is not considered to be personal data but registering on behalf of a legal entity may include sharing personal data. For example, the information in relation to one-person companies may constitute personal data where it allows the identification of a natural person. The rules also apply to all personal data relating to natural persons in the course of professional activity, such as the employees of a company or organization, business e-mail addresses like "[email protected]". This Privacy Policy does not apply to information from which no individual can reasonably be identified (anonymized information).

When we say „Special categories of personal data“ we mean personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

2. DATA CONTROLLER

Revuto OÜ is a company registered under the laws of Estonia, which, as a Data controller, jointly with Revuto savjetovanje d.o.o, a company registered under the laws of Croatia, determines the purposes and means of the processing of personal data. Joint controllers are responsible for your personal data. The purpose of data processing is the reason why we process your personal data. The table in Section 4 of the Privacy Policy presents the purposes and legal basis for data processing. In such cases, REVUTO is responsible for your personal data.

If we obtain your consent to process your personal data for one purpose (for example, to obtain a Revuto Debit Card) and we need to use them for a different purpose (in accordance with Section 4), we will require your prior consent to use your data for a different purpose. 

3. WHAT DATA DO WE COLLECT ABOUT YOU AND WHEN?

We may collect and receive information about you in various ways:

• (i) Information you provide through the use of the Revuto Services, Revuto Website and Revuto App (for example, by creating the account on the Website).
• (ii) Information you decide to provide through getting in touch with us via our Contact page.
• (iii) Information we collect through the use of cookies in accordance with our Cookie Policy (for example, your time zone).

4. PERSONAL DATA WE PROCESS

5. WHAT WE DO NOT DO?

REVUTO will never:

• Sell any kind of personal information or data
• Disclose this information to marketers or third parties not specified in Section 7
• Process your data in any way other than stated in this Privacy Policy.

6. PERSONAL DATA SECURITY

REVUTO takes the privacy and security of its members' personal information seriously. We maintain administrative, technical and physical safeguards designed to protect your information’s security, confidentiality and integrity. 

Upon assessing whether a measure is adequate and which level of security is appropriate, we consider the nature of the personal data we are processing and the nature of the processing operations we perform, the risks to which you are exposed by our processing activities, the costs of the implementation of security measures and other relevant matters in the particular circumstances.

Some of the measures we apply include access authorization control, information classification (and handling thereof), protection of integrity and confidentiality, data backup, firewalls, data encryption and other appropriate measures. We equip our staff with the appropriate knowledge and understanding of the importance and confidentiality of your personal data security.

We protect personal information you provide online in connection with registering yourself as a user of our Website or Revuto App. Access to your own personal information is available through a password selected by you. This password is encrypted while transmitted from your browser to our servers and while stored on our systems. To protect the security of your personal information, never share your password to anyone. Please notify us immediately if you believe your password has been compromised.

Whenever we save your personal information, it’s stored on servers and in facilities that only selected REVUTO personnel and our contractors have access to. We encrypt all data that you submit through the Website during transmission using Transport Layer Security (TLS) in order to prevent unauthorized parties from viewing such information. Remember – all information you submit to us by email is not secure, so please do not send sensitive information in any email to REVUTO. We never request that you submit sensitive or personal information over email, so please report any such requests to us by sending an email to [email protected].

Steps you can take to help us keep your information safe

There are many steps you can take to help us keep your information safe. First and foremost, choose complex, independent passwords for each website and service you maintain an account with. This helps keep any breach of any of your accounts isolated to one service. Also, don’t use anything related to your birthday, address, phone number, PIN number or any other easily guessable information in your password.

REVUTO urges your caution when using public computers or networks, like at a coffee shop or library. To best protect your personal information and login information, don’t use such computers to access your sensitive accounts, and if you must, ensure that you logout of your account entirely.

When either you or we update information in your account, such as the status of your account or Revu Token (REVU) balance, we typically send you notice of these changes via email or text message. In recent years, individuals, businesses and even governments have seen a rise in “phishing” attacks. Phishing occurs when someone attempts to obtain your password or other sensitive information. Scammers often do this by impersonating a trusted user, or by offering a compelling reason to open a malicious email attachment, click on a link or give over information. We never ask for your sensitive personal information, such as password, over email or other unsecure methods or through any site not under the revuto.com domain. Please notify us at [email protected] if you ever receive suspicious correspondence from us.

7. WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

REVUTO utilizes external processors for certain processing activities. We use information audits to identify, categorize and record all personal data that is processed outside the company, so that the information, processing activity, processor and legal basis are all recorded, reviewed and easily accessible.

We have strict due diligence procedures and measures in place and review, assess and background check all processors prior to forming a business relationship. We obtain company documents, certifications, references and ensure that the processor is adequate, appropriate and effective for the task we are employing them for.

We audit their processes and activities prior to contract and during the contract period to ensure compliance with the data protection regulations and review any codes of conduct that oblige them to confirm compliance.

This is the list of processors with whom we share your personal data:

We may also share your personal data with our outside accountants, legal counsels and auditors.

• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation;
• to prevent and detect fraud or crime;
• in response to a subpoena, warrant, court order, or as otherwise required by law.

Finally, personal information may be disclosed or transferred as part of, or during negotiations of, a merger, consolidation, sale of our assets, as well as equity financing, acquisition, strategic alliance or in any other situation where personal information may be transferred as one of the business assets of Revuto.

We do not have a list of all third parties we share your data with, as this would be dependent on your specific use of our Services. However, if you would like further information about who we have shared your data with, or to be provided with a list specific to you, you can request this by writing to [email protected].

8. INTERNATIONAL TRANSFER OF YOUR PERSONAL DATA

We may transfer your personal data to countries other than the one you reside in. In these cases, we will transfer your personal data only:

1. To the countries within the EEA;
2. To the countries which do not form the EEA but are considered to ensure an adequate level of protection;
3. To the countries which do not belong to those specified under item 1. and 2, but only by applying the appropriate safeguard measure in accordance with the GDPR.

9. HOW LONG DO WE KEEP YOUR DATA?

The period for which we store your personal data depends on a particular purpose for the processing of personal data, as explained in detail in Section 4 of this Privacy Policy. We retain personal data for as long as we reasonably require it for legal or business purposes. In determining data retention periods, we take into consideration the applicable law (see Section 21 of the Terms of Use), contractual obligations, and the expectations and requirements of our Users. When we no longer need personal information, or when you request us to delete your information, where this is legal, we will securely delete or destroy it.

Personal data we collected for your early access to Revuto will be deleted by the end of February 2022, provided you have not continued using our Services.

However, as an exception to the retention periods in Section 4 of this Privacy Policy the data may be processed to determine, pursue or defend claims and counterclaims.

10. YOUR RIGHTS

As a Data Subject in the EEA, whose personal information we hold, you have certain rights under the GDPR. This part of the Privacy Policy aims to give you a general understanding of these rights. In relation to each of the rights noted below, we provided a reference to the specific provision of the GDPR from which that right arises.

Right of Access (Article 15 GDPR)

You can send us a request for a copy of the personal data we hold about you.

We have ensured that appropriate measures have been taken to provide such in a concise, transparent, intelligible and easily accessible form, using clear and plain language. Such information is provided in writing free of charge. It may be provided by other means when authorized by the Data Subject and with prior verification as to the subject’s identity.

Information is provided to the Data Subject at the earliest convenience, but at a maximum of 30 days from the date the request was received. Where the retrieval or provision of information is particularly complex or is subject to a valid delay, the period may be extended by two further months where necessary.

Right to Correction of Your Personal Data(Article 16 GDPR)
If the personal data we have about you is incorrect, you have the right to request that we correct that data. When notified of inaccurate data by the Data Subject, we will rectify the error within 30 days and inform any third party of the rectification if we have disclosed the personal data in question to them.
Right to Be Forgotten or Right to Erasure (Article 17 GDPR)

You have the right to request from us that your personal data is deleted in certain circumstances including:

• The personal data are no longer needed for the purpose for which they were collected;
• You withdraw your consent (where the processing was based on consent);
• You object to the processing and no overriding legitimate grounds are justifying us processing the personal data;
• The personal data have been unlawfully processed; or
• To comply with a legal obligation.

However, this right does not apply where, for example, the processing is necessary:

• To comply with a legal obligation; or
• For the establishment, exercise or defense of legal claims.

Right to Restriction of Processing (Article 18 GDPR)

If the accuracy of the personal data is contested, you consider the processing is unlawful but you do not want it erased, we no longer need the personal data but you require it for the establishment, exercise or defense of legal claims or you have objected to the processing and verification, you can exercise your right to the restriction of processing.

Right to Withdraw the Consent (Article 13(2)c) GDPR)

If you have provided your consent to the collection, processing and transfer of your personal data, you have the right to fully or partly withdraw your consent. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose(s) to which you originally consented unless there is another legal ground for the processing.

Right to Lodge a Complaint

If you have any concerns or requests in relation to your personal data, please contact us at [email protected] and we will respond as soon as possible but not later than within 30 days.

If you are unsatisfied with how we process your data, you may contact the competent supervisory authority.

In case you believe that we are processing your personal data in violation of the GDPR, you have the right to lodge a complaint with the supervisory authority located in the EEA where you reside or work or where the alleged infringement took place.

11. CALIFORNIA RESIDENTS PRIVACY NOTICE („Notice“)

This Section supplements the information contained in the REVUTO's Privacy Policy and applies solely to visitors, users, and others who reside in the State of California and fall under the scope of the California Consumer Privacy Act (“consumers” or “you”) when they visit the Website or use the Services. Under this Notice REVUTO complies with the California Consumer Privacy Act of 2018 (“CCPA”).

Any capitalized but undefined term in this Notice shall have the meaning given to it in the CCPA, Definitions section of the Terms of Use, Privacy Policy and Cookie Policy.

This Notice makes an integral part of our Privacy Policy and Terms of Use.

Information we collect

For more details about the personal information REVUTO has collected over the last 12 months please see Section 4 of the Privacy Policy - Personal Data We Process .

The categories of personal information that are listed in Section 4 are obtained by REVUTO in accordance with Section 3 of the Privacy Policy - What Data Do We Collect About You And When?

Use of Personal Information

REVUTO collects personal information for the purposes described in Section 4 of the Privacy Policy - Personal Data We Process .

Sharing Personal Information

REVUTO shares personal information with the categories of third parties described in Section 7 of the Privacy Policy - With whom do we share your personal data?

Please note that REVUTO uses third-party cookies for advertising purposes as further described in our Cookie Policy .

REVUTO does not sell your personal information

REVUTO does not sell personal information, including personal information of anyone under 18 years of age.

Under the CCPA, a business that sells consumers personal information to others must: 1) give notice to consumers before selling their personal information to others; and 2) provide to consumers the right to opt-out of the sale of their personal information.

Therefore, the notification and opt-out requirements do not apply to REVUTO.

Your Rights and Choices

This section describes your rights under the CCPA and explains how to exercise those rights.   These rights may be exercised by consumers when REVUTO operates as a Data Controller.

Right to know Personal Information and Data Portability Rights

You have the right to request that we disclose certain information to you about REVUTO's collection and use of your personal information over the past 12 months, i.e.:

• Our business or commercial purpose for collecting your personal information.

The categories of personal information we collected about you.

• The categories of third parties with whom we share your personal information.
• The specific pieces of personal information we collected about you („data portability request “).

We will disclose this information to you once we receive and confirm your verifiable consumer request.

Right to Deletion

You have the right to deletion your personal information REVUTO collected. REVUTO will delete your personal information from the records once we receive and confirm your verifiable consumer request unless a CCPA exception applies.

Namely, we may deny your deletion request subject to the exceptions in CCPA §1798.105, i.e. if retaining the information is necessary for REVUTO or our service providers to:

1. Complete the transaction for which REVUTO collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of REVUTO's ongoing business relationship with you, or otherwise perform our contract with you.
2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
3. Debug products to identify and repair errors that impair existing intended functionality.
4. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code §1546 seq. ).
6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
7. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
8. Comply with a legal obligation.
9. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

If your request is justified, REVUTO will also direct their service providers to delete your personal information as well.

Right to Non-Discrimination

REVUTO will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, REVUTO will not:

• Deny you use of our Services.
• Provide you a different level or quality of Services.
• Charge you different prices or rates for Services, including through the use of discounts or other benefits or by imposing penalties.
• Suggest that the person exercising their rights will receive a different price or rate for Services or a different level or quality of Services.

Right to say no to the sale of your personal information (Right to opt-out)

As explained above, the CCPA requires businesses that sell personal information to allow consumers the ability to opt-out of the selling of their personal information.

Again, REVUTO does not sell personal information.

Exercising your rights

To exercise the rights to access, data portability, and deletion, please submit a verifiable consumer request at [email protected] or contact us via Revuto Live Support on www.revuto.com.

Consumers are entitled to make a request for access or data portability twice within a 12-month period.

To exercise your rights, you may send a request by yourself or use an authorized agent.

If REVUTO cannot verify your identity or authority to make the request and confirm the personal information related to you, REVUTO cannot respond to your request or provide you with personal information.

We try to respond to consumers' requests within 45 days of their receipt. Sometimes, REVUTO may need more time to respond to the request (up to 90 days total from the moment we receive the request) when REVUTO will inform the consumer of the reason and extension period in writing.

You are not obliged to create an account with us in order to make a verifiable consumer request. We will deliver our written response to the registered email associated with the account if you have an account with us. Please note that any information we provide will only cover the 12-month period preceding the consumers' request receipt. If we cannot comply with your request, we will provide an explanation.

If a consumer files a data portability request, REVUTO will select a format that is readily useable and should allow the transmission of the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to verifiable consumer requests unless it is excessive, repetitive, or manifestly unfounded. If REVUTO  determines that the request warrants a fee, REVUTO will:

• inform you why the decision was made and
• provide the consumer with a cost estimate before completing the request.

12. CHANGES TO PRIVACY POLICY

We reserve the right to change Privacy Policy from time to time at our sole discretion. If we make any changes, we will publish the new rules on this web page and, if we have your email, we will notify you directly.

Where you have previously consented to our Privacy Policy, your continued use of the Revuto after we make changes is deemed to be acceptance of the updated rules.