PRIVACY POLICY

Last Updated: January 2026

1. Data Controller

1.1 The data controller responsible for processing personal data is:

Revana Ltd EOOD
Sofia, Bulgaria
Email: support@keevana.com

1.2 Revana Ltd EOOD operates Keevana POS and Keevana Market (collectively referred to as “Keevana”).

2. Categories of Data Processed

We process personal and business-related data necessary to provide and improve our services.

2.1 Account and Business Data

This may include:

  • Company name
  • Registered address
  • Contact details (name, email address, phone number)
  • Sales transaction data
  • Inventory records
  • Product and pricing information

2.2 Identity Verification Data

Where required for compliance, fraud prevention, or security purposes, we may request:

  • Government-issued identification documents
  • Business registration documents
  • Tax registration details
  • Proof of signing authority

Such verification is conducted only where necessary and proportionate.

2.3 Location Data

Precise GPS location data may be collected in order to:

  • Verify the physical location of a shop
  • Position the shop correctly within Keevana Market
  • Improve local search visibility and discoverability
  • Prevent fraudulent misrepresentation of shop location

Location services can be controlled through device settings, although disabling them may limit functionality.

2.4 Device and Usage Data

We may automatically collect:

  • Device type
  • Operating system
  • Application version
  • Log files
  • Performance and diagnostic data
  • Feature interaction metrics

This data is used to maintain stability, improve functionality and ensure security.

3. Legal Basis for Processing

Processing of personal data is based on one or more of the following legal grounds under the General Data Protection Regulation (GDPR):

  • Contract performance (Art. 6(1)(b) GDPR) – to provide Keevana services
  • Legal obligations (Art. 6(1)(c) GDPR) – where required by applicable law
  • Legitimate interests (Art. 6(1)(f) GDPR) – for platform security, fraud prevention and service improvement
  • Explicit consent (Art. 6(1)(a) GDPR) – where required, such as for AI Insights

4. AI Processing

4.1 Keevana may offer optional AI-powered analytics (“AI Insights”).

4.2 Activation of AI Insights requires explicit in-app consent via a confirmation pop-up before data is processed.

4.3 AI processing may involve selected sales and inventory data in order to generate automated business insights and recommendations.

4.4 Consent may be withdrawn at any time by:

Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

5. Aggregated and Statistical Processing

5.1 We may process sales and inventory data in anonymised, aggregated or pseudonymised form to:

  • Improve product functionality
  • Develop generalised pricing insights
  • Enhance analytical and performance models
  • Strengthen system stability

5.2 This processing:

  • Does not identify individual shops
  • Cannot reasonably be traced back to a specific business
  • Is used solely for product improvement purposes

6. Data Sharing

6.1 Data may be shared only with carefully selected service providers necessary for operating the platform, including:

  • Hosting and cloud infrastructure providers
  • Payment service providers for transaction processing
  • Analytics and technical service providers

6.2 All service providers operate under GDPR-compliant data processing agreements and may process data only on our documented instructions.

6.3 Keevana:

  • Does not sell personal data
  • Does not share user data for advertising purposes
  • Does not voluntarily disclose user data to public authorities

6.4 Data will only be disclosed to public authorities if we are legally obligated to do so under applicable law and strictly limited to the minimum extent required. We carefully review any official data request for legal validity and scope. Where legally permitted, we seek to limit disclosure to the minimum required and may challenge requests that we consider unlawful or disproportionate.

7. Data Retention

7.1 Personal data is retained:

  • For the duration of the contractual relationship
  • As required by applicable legal retention obligations
  • Until a valid deletion request is received, unless legal retention applies

7.2 Backup copies are deleted in accordance with standard technical retention cycles.

8. Account Deletion

8.1 Users may delete their account at any time:

8.2 Upon account deletion:

  • Personal and business data will be permanently deleted or irreversibly anonymised
  • Deletion will occur within a reasonable technical timeframe
  • Data may be retained only where legally required (e.g., accounting or tax obligations)

9. Your Rights Under GDPR

Users have the following rights under applicable data protection law:

  • Right of access
  • Right to rectification
  • Right to erasure
  • Right to restriction of processing
  • Right to data portability
  • Right to withdraw consent at any time
  • Right to lodge a complaint with the Bulgarian supervisory authority

10. Exercising Your Rights

10.1 To exercise any of the above rights, users may contact:

support@keevana.com

10.2 We may request reasonable identity verification before fulfilling such requests to protect account security.

10.3 Requests will be handled in accordance with statutory deadlines under applicable data protection laws.

10.4 The right of access entitles users to obtain confirmation of whether personal data is processed and to receive a copy of such data, along with information about the purposes of processing, retention periods and data recipients.

Scroll to Top