Guests, auditors and your own team sometimes ask how ROLLER handles personal data under privacy laws like GDPR and the California Consumer Privacy Act (CCPA).
This guide explains ROLLER's role as your data processor, where to find the agreements that cover it, and what to do when a guest asks you to access or delete their data.
ROLLER's role in your data
ROLLER acts as a data processor for your guests' personal data, and you, as the venue, are the data controller. This applies under GDPR, UK GDPR and US state privacy laws, including California's CCPA. ROLLER only processes guest data on your instructions, and you're responsible for meeting your own obligations toward your guests under whichever laws apply to your venue.
ROLLER keeps technical and organizational measures in place to protect guest data against loss, alteration or unauthorized disclosure, set out in the data processing agreement.
ROLLER will notify you without undue delay if a security incident affects guest data, with enough detail for you to meet your own regulatory reporting obligations.
ROLLER doesn't sell or share guest personal data for commercial purposes, and only uses aggregated or de-identified data to improve the product.
For the venue staff account details you and your staff give ROLLER directly, such as sign-up information, ROLLER is the controller. That data sits under ROLLER's privacy policy rather than the data processing agreement.
Where to find the agreements
Three pages cover how ROLLER handles data under GDPR and other privacy laws:
The data processing agreement sets out ROLLER's obligations as a processor and your obligations as a controller, under GDPR, UK GDPR and US state privacy laws, including California, Virginia, Connecticut, Utah and Colorado. It's incorporated by reference in ROLLER's master terms of service, so you're already covered by it without a separate signature: the page itself is the current version.
ROLLER's privacy policy covers the data ROLLER collects directly, and explains individual rights under GDPR and US state privacy laws, such as access, correction and deletion.
ROLLER's security and compliance page covers certifications and technical safeguards, including SOC 2 and PCI DSS compliance, encryption and role-based access with multi-factor authentication.
If a guest asks you to access, correct or delete their data
Guests have rights under GDPR and US state privacy laws, including the right to access their data, have it corrected or have it deleted. See ROLLER's privacy policy for the full list. If a guest raises one of these requests directly with ROLLER, ROLLER tells them to submit it to you, and you're responsible for responding to them.
To learn more, see How do I delete a guest's data?
FAQs
Is ROLLER compliant with GDPR and US privacy laws like CCPA?
ROLLER processes guest data as a data processor under the data processing agreement, and commits to security measures, breach notification and data deletion timeframes set out there.
Does ROLLER sign a data processing agreement (DPA)?
Yes. The DPA sets out ROLLER's obligations as a processor and your obligations as the controller of your guests' data.
Which privacy laws does the DPA cover?
GDPR, UK GDPR and US state privacy laws, including California, Virginia, Connecticut, Utah and Colorado. See the data processing agreement for the full list.
What happens if there's a data breach affecting guest data?
ROLLER notifies you without undue delay, with enough detail for you to meet your own regulatory reporting obligations, as set out in the data processing agreement.
How long does ROLLER take to delete data after a request?
Up to 180 days from the request, or from when your ROLLER service ends, per the data processing agreement.
Learn more
How do I delete a guest's data?: the steps to remove a guest's personal data from ROLLER on request.
Add policies: terms & conditions, privacy and subscriber opt-in: how to add your own venue's policy links to checkout and guest communications.
Enable cookie consent in progressive checkouts: how to turn on cookie consent prompts during checkout.
Data processing agreement: ROLLER's obligations as your data processor and your obligations as controller, under GDPR, UK GDPR and US state privacy laws.
Privacy policy: what ROLLER collects directly, and individual rights under GDPR and US state privacy laws.
Security and compliance: ROLLER's certifications and technical safeguards, including SOC 2 and PCI DSS compliance.
Master terms of service: the agreement that incorporates the data processing agreement by reference for all ROLLER customers.