PRIVACY POLICY
Pursuant to Articles 13 and 14 of EU Regulation 2016/679
Introduction
Holden International LLC (hereinafter the “Data Controller”), pursuant to Articles 13 and 14 of EU Regulation No. 679/2016 (“GDPR”), provides the following information concerning the processing of personal data in connection with the provision of its services.
This Privacy Policy applies exclusively to the Website www.royaltify.com and to the services provided through Royaltify and does not apply to third-party websites that may be accessed by the User through external links.
Royaltify provides software tools designed to assist users in collecting, organizing, monitoring and analyzing information relating to publishing activities and related services.
For the provision of such services, personal data may be provided directly by the User or acquired from third-party platforms that the User has voluntarily chosen to connect and expressly authorized.
Art. 1 – Data Controller
The Data Controller is:
HOLDEN INTERNATIONAL LLC
8 The Green, Suite R
Dover, Delaware 19901
United States
EIN: 35-2812249
Email: [email protected]
Website: www.royaltify.com
Employees, collaborators and other persons authorized by the Data Controller may process personal data exclusively within the limits of their assigned duties and in accordance with applicable data-protection legislation.
Art. 2 – Place of Data Processing
Personal data may be processed at the Data Controller’s premises and through electronic systems, software and infrastructure supplied by third-party service providers used for the operation of Royaltify.
Processing may therefore take place through servers, cloud services, databases and other technical infrastructure located in different jurisdictions, subject to the safeguards required by applicable law.
Data shall only be accessible to persons authorized to process it and to service providers where such access is necessary for the performance of their services.
Art. 3 – Types of Data Processed
The Data Controller processes data provided voluntarily by the User and data acquired from third parties with the User’s authorization, to the extent necessary to respond to requests and provide the Service.
The following categories of data may be processed:
a) Browsing data: The information systems and software procedures used to operate the Website may collect certain personal data as part of their normal operation and through the use of Internet communication protocols. Such data may include: IP address; date and time of access; pages visited; referrer URL; amount of data transmitted; browser type and version; operating system and device information; server log information. This information may be used to obtain anonymous statistical information regarding use of the Website, ensure its proper operation and protect the security of the Website and Service.
b) Data provided voluntarily by the User: Through the Website and the Service, the User may voluntarily provide personal data such as:first and last name; email address; account information; billing information; company or professional information; information contained in communications sent to the Data Controller. Where payments are handled by external payment providers, the Data Controller may receive limited information concerning the transaction without necessarily receiving the User’s complete payment-card details.
c) Data acquired from connected third-party platforms: The User may choose to connect Royaltify to third-party publishing, advertising or other supported platforms. In such cases, the Data Controller may process information made available by those platforms within the limits of the permissions expressly granted by the User. Depending on the relevant service, such information may include: information relating to connected accounts; books, publications, titles or other publishing-related content; sales and distribution information; royalties and revenue data; advertising and campaign information; costs and performance metrics; pages read or similar usage metrics; marketplace, territory and historical information; other information made available by the connected platform. The exact categories of data depend on the third-party platform and on the permissions granted by the User. Where the connection uses an authorization mechanism that does not require the User’s password to be disclosed to Royaltify, the Data Controller does not receive or store the User’s password for the relevant third-party platform.
Technical credentials, such as authorization tokens, may be processed where necessary to maintain the connection requested by the User.
Art. 4 – Purposes of Processing
The Data Controller shall process personal data only to the extent necessary for the following purposes:
a) purposes related to the performance of an agreement to which the User is a party or to the implementation of pre-contractual measures requested by the User;
b) compliance with legal obligations to which the Data Controller is subject;
c) establishing, exercising or defending legal claims;
d) enabling the User to browse the Website and use the services provided by Royaltify;
e) managing the User’s Account and providing the functionalities of the Service;
f) connecting and synchronizing third-party platforms expressly authorized by the User;
g) collecting, organizing and analyzing publishing-related data made available through connected platforms;
h) responding to specific requests sent to the Data Controller;
i) fulfilling obligations arising from applicable laws, regulations or requests from competent authorities;
j) carrying out direct marketing activities concerning services similar to those used by the User, where permitted by applicable law and subject to the User’s right to object;
k) carrying out marketing and newsletter activities where the User has provided the consent required by applicable law;
l) conducting statistical, technical or research activities, preferably using anonymous or aggregated data where possible;
m) ensuring the security, maintenance, operation and improvement of the Website and Service.
The User may withdraw consent for processing based on consent at any time by contacting the Data Controller at [email protected], without affecting the lawfulness of processing carried out before withdrawal.
4.1 – Limitations applicable to connected advertising platforms
Information obtained from connected advertising platforms is processed exclusively to provide the Service to the User who granted the authorization. It is not used for marketing or newsletters, not combined with other Users’ data for commercial purposes, and not sold or transferred to third parties. The purposes under Art. 4(j), (k) and (l) do not apply to such information.
Art. 5 – Methods of Processing
Personal data shall primarily be recorded, processed, managed and stored using electronic and IT systems and, where necessary, in paper form.
The Data Controller adopts appropriate measures designed to ensure that only data necessary for the relevant processing purposes is processed.
Personal data shall be processed for no longer than necessary to achieve the purposes for which it was collected, without prejudice to legal retention obligations.
The information systems and software used shall, where reasonably possible, be configured to minimize the use of personal and identifying data.
The User may revoke authorizations granted to Royaltify to access connected third-party platforms in accordance with the methods made available by Royaltify or by the relevant third-party platform.
Such revocation prevents the acquisition of new data through the relevant authorization, without prejudice to data already lawfully processed or data whose retention is required by law.
Art. 6 – Security Measures
The processing of personal data is protected through appropriate technical and organizational security measures designed to reduce the risks of:
• accidental or unlawful destruction;
• loss of data;
• unauthorized access;
• unlawful disclosure;
unauthorized or unlawful processing.
Personal data is processed using automated systems only for the time necessary to achieve the purposes for which it is processed.
The Data Controller adopts appropriate access controls and security measures for employees, collaborators, service providers and other authorized persons.
Persons authorized to process data are required to comply with confidentiality obligations and with the instructions provided by the Data Controller.
The Data Controller does not carry out automated decision-making producing legal or similarly significant effects on Users solely on the basis of data processed through Royaltify.
The analysis, calculations and statistics produced through Royaltify are intended to provide informational and analytical tools to the User.
Art. 7 – Recipients of Personal Data
Personal data may be processed by:
employees and collaborators authorized by the Data Controller;
• technical service providers;
• hosting and cloud infrastructure providers;
• software and database service providers;
payment providers and financial institutions where necessary;
persons, companies or professional firms providing accounting, administrative, legal, tax or financial assistance;
providers responsible for technical maintenance and support;
companies affiliated with the Data Controller where necessary for administrative or organizational purposes;
subjects, entities or authorities to whom disclosure is required by law;
judicial authorities where required under applicable law.
External service providers processing personal data on behalf of the Data Controller shall be required to process such data in accordance with applicable privacy legislation and the instructions received from the Data Controller.
Personal data shall only be made available to recipients where this is necessary for the relevant purpose.
The Data Controller does not sell personal data.
Art. 8 – Nature of Data Provision and Consent
The provision of personal data necessary to create an Account, purchase or use the Service or manage the contractual relationship is necessary for the provision of the requested Service.
Failure to provide such data may therefore make it impossible for the Data Controller to provide some or all of the requested services.
The connection of a third-party platform to Royaltify is voluntary.
By connecting a third-party account, the User expressly requests that Royaltify access and process the information made available through that connection within the limits of the authorization granted.
The User may revoke such authorization at any time.
Where consent is required for marketing or other optional purposes, such consent is voluntary and may be withdrawn at any time without affecting access to the core Service, unless the relevant processing is objectively necessary for a requested functionality.
8.1 Marketing purposes
Where the User has provided the consent required by applicable law, the contact information supplied may be used by the Data Controller for promotional, commercial and marketing communications relating to Royaltify and the Data Controller’s products or services.
Such communications may be sent through electronic means, including email, or other lawful communication channels.
The User may withdraw marketing consent or object to marketing communications at any time by contacting:
or by using any unsubscribe mechanism included in the relevant communication.
Withdrawal of marketing consent shall not affect the provision of the core Service.
Art. 9 – International Transfers of Personal Data
Personal data may be processed outside the European Economic Area, including in the United States or other countries in which the Data Controller, its personnel or service providers operate.
Where personal data protected by the GDPR is transferred to a country for which no applicable adequacy decision exists, the Data Controller shall use one of the safeguards permitted under applicable data-protection legislation, where required.
Such safeguards may include, where applicable, Standard Contractual Clauses approved by the European Commission or other lawful transfer mechanisms.
Data may also be transferred to countries covered by an adequacy decision where the conditions of that decision are satisfied.
Art. 10 – Rights of the Data Subject
Where applicable under the GDPR and other applicable data-protection legislation, the User may exercise the rights provided by law in relation to their personal data.
In particular, the User may have the right to:
obtain confirmation as to whether personal data concerning them is being processed;
• obtain access to their personal data;
request correction or updating of inaccurate or incomplete data;
request deletion of personal data where the legal conditions are met;
• request restriction of processing;
• object to processing where permitted by law;
receive personal data provided by them in a structured, commonly used and machine-readable format where the right to data portability applies;
withdraw consent at any time where processing is based on consent;
lodge a complaint with the competent supervisory authority.
Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Where necessary, the Data Controller may request information reasonably necessary to verify the identity of the person submitting the request.
Requests may be submitted by email to:
Art. 11 – Data Retention Period
The Data Controller retains personal data for the period necessary for the purposes for which such data was collected and processed and, where applicable, for the period required by legal, accounting, tax or contractual obligations.
Where data is required for legal or contractual purposes, it may be retained for up to 10 years from the last legally relevant processing activity, where such retention is required or justified under applicable law.
Data relating exclusively to the operation of the Service or to connected third-party platforms may be deleted or anonymized when no longer necessary for the provision of the Service, subject to technical backup periods and mandatory legal retention obligations.
Where the User withdraws consent for an optional processing activity, the related processing shall cease unless another lawful basis justifies its continuation.
CONTACTS
For any request concerning the processing of personal data or the exercise of privacy rights:
Holden International LLC
8 The Green, Suite R
Dover, Delaware 19901
United States
Email: [email protected]
Website: www.royaltify.com
Copyright 2026 – HOLDEN INTERNATIONAL LLC – All Rights Reserved