Privacy Policy

1. Who We Are

Rocovit Limited operates the Rocovit platform at rocovit.com. We are a financial statement production engine serving accounting firms and audit practices across emerging markets. For privacy enquiries contact privacy@rocovit.com.

2. What Data We Collect

We collect and process data in three categories:

• Account data: name, email, company name, role, and billing information collected at registration.
• Engagement data: financial data uploaded or connected by your firm including bank statements, ledger exports, prior year financial statements, and open banking feeds.
• Usage data: platform activity logs, feature usage, session data, browser type, and IP address.

3. How We Use Your Data

We use your data for five primary purposes:

• Delivering the Rocovit service: processing engagements and generating outputs.
• Account management: login, billing, and support.
• Platform improvement: aggregate usage analytics to improve features.
• Security and compliance: fraud detection, audit logging, and regulatory obligations.
• Communications: service updates and support responses. We do not send marketing emails without explicit consent.

4. What We Never Do

We make four absolute commitments to our users:

• We never sell your data or your clients' data to any third party.
• We never use your client financial data to train AI or machine learning models.
• We never share engagement data between accounting firms.
• We never process your data for purposes beyond those stated in this policy.

5. Legal Basis for Processing

We process data under four legal bases:

• Contract performance: processing necessary to deliver the Rocovit service you have contracted for.
• Legal obligation: retaining financial records as required by applicable law.
• Legitimate interests: security monitoring, fraud prevention, and platform improvement using aggregate data.
• Consent: marketing communications where you have explicitly opted in.

6. Data Retention

• Financial engagement data: retained for 7 years in line with regulatory requirements across our operating markets.
• Account data: retained for the duration of your account plus 90 days post-cancellation.
• Usage logs: retained for 24 months.
• On cancellation: your data remains accessible for 90 days then is permanently deleted. You may request immediate deletion at any time.

7. Data Security

• AES-256 encryption for all data at rest.
• TLS 1.3 for all data in transit.
• Tenant-level database isolation - no firm can access another firm's data.
• Immutable audit logs for all data access events.
• SOC 2 Type II certification in progress - current controls meet SOC 2 requirements in practice.

8. Your Rights

The following rights are available to all users regardless of location:

• Access: request a copy of all data we hold about you.
• Correction: request correction of inaccurate data.
• Deletion: request permanent deletion of your data.
• Portability: request your data in a machine-readable format.
• Objection: object to processing for legitimate interests purposes.

To exercise any right email privacy@rocovit.com. All requests acknowledged within 48 hours and processed within 30 days.

Jurisdiction Specific Rights

Nigeria (NDPR): Nigerian users have the right to be informed, right of access, right to object to processing, right to rectification, right to erasure, and right to data portability.

South Africa (POPIA): South African users have the right to notification, right of access, right to correction, and right to objection.

European Union (GDPR): EU users have the right to be informed, access, rectification, erasure, restrict processing, data portability, object, and rights in relation to automated decision making and profiling.

9. Regulatory Compliance

NDPR (Nigeria)

Rocovit complies with the Nigeria Data Protection Regulation administered by the Nigeria Data Protection Commission. Nigerian data subjects may lodge complaints with the NDPC.

POPIA (South Africa)

Rocovit meets POPIA requirements for South African data subjects. We have appointed an Information Officer as required.

GDPR (European Union)

Rocovit complies with GDPR for EU data subjects. We maintain a lawful basis for all processing and honour all data subject rights. EU data subjects may lodge complaints with their national supervisory authority.

International Transfers

Where data is transferred outside the country of collection we apply appropriate safeguards including standard contractual clauses.

10. Cookies and Tracking

We use essential cookies for session management and authentication. We use analytics cookies to understand aggregate platform usage. We do not use advertising or tracking cookies. See our Cookie Policy for full details.

11. Third Party Services

We use third party services for cloud infrastructure, payment processing, and email delivery. All third parties are bound by data processing agreements and may only process your data as instructed by Rocovit. We do not share personal data with third parties for their own purposes.

12. Children

Rocovit is a professional platform intended for use by accounting firms and registered businesses. We do not knowingly collect data from individuals under 18.

13. Changes to This Policy

We will notify registered users by email of material changes to this policy at least 30 days before they take effect. Continued use of Rocovit after the effective date constitutes acceptance of the updated policy.

14. Contact

For any privacy question, data request, or complaint: privacy@rocovit.com. We acknowledge all messages within 48 hours.