Vavvo · Legal
Regional Legal & Privacy Addenda
Last reviewed September 19, 2026. These addenda describe Vavvo’s compliance framework; they do not state that every law listed applies to every transaction. Applicability depends on Vavvo’s contracting entity, the host, guest, venue, payment flow and country involved.
If local law gives you stronger privacy or consumer rights than Vavvo’s general terms, the mandatory local rule controls. A regional addendum does not waive those rights.
European Economic Area (EEA)
- GDPR rights, lawful-basis analysis, data minimisation, security, processor contracts, breach response and international-transfer safeguards apply where the regulation covers Vavvo’s processing.
- For online marketplace activity with EU consumers, Vavvo’s launch checklist includes Digital Services Act marketplace controls such as trader traceability, accessible seller information, reporting/notice mechanisms and complaint-handling obligations where applicable.
- EU platform-tax reporting review includes DAC7. Rental of immovable property is within DAC7’s listed relevant activities, and non-EU platform operators can have registration/reporting obligations when facilitating EU reportable sellers.
- Member-state consumer, tax, licensing, insurance, venue and local-business rules remain market-specific.
United Kingdom
- The UK launch review covers UK data-protection requirements, lawful processing, privacy rights, security, processor arrangements and international transfers.
- Vavvo’s platform-reporting review covers the UK digital-platform seller reporting regime, including seller-information collection/verification and reporting where Vavvo qualifies as a reporting platform operator.
- UK consumer, unfair-commercial-practice, tax, venue licensing and accessibility obligations are reviewed separately from EU requirements.
United States
- There is no single comprehensive private-sector privacy law covering every state. Vavvo therefore treats U.S. privacy compliance as state-specific rather than using one nationwide privacy switch.
- California review includes CCPA/CPRA applicability, notice, access/deletion/correction rights, sale/share opt-out and Global Privacy Control handling when legally required.
- Other state privacy, biometric, consumer-protection, tax, marketplace-facilitator and money-transmission/payment issues are reviewed before enabling the relevant market.
Canada
- The federal PIPEDA framework, where applicable, is addressed through accountability, identified purposes, meaningful consent, collection/use/retention limits, safeguards, openness, access/correction and complaint handling.
- Provincial privacy and consumer rules can replace or supplement federal requirements, so province-specific review remains part of launch approval.
- Vavvo’s provider review includes accountability for personal information transferred to service providers.
Caribbean & Saint Lucia
- Each Caribbean jurisdiction is reviewed independently for data protection, consumer contracts, e-commerce, venue/business licensing, tax, payments/payouts and cross-border processing.
- Saint Lucia is treated as its own launch market rather than as a generic Caribbean rule set. The admin market registry must show a completed local review before production booking is enabled.
- Vavvo does not assume that a U.S., UK or EU privacy notice alone satisfies Caribbean requirements.
Latin America
- Brazil review includes LGPD controller obligations, transparency, lawful processing, data-subject rights, security, processors and international-transfer requirements.
- Other Latin American countries are activated only after their own privacy, consumer, tax/platform-reporting and payment/payout rules are checked.
- Spanish/Portuguese localisation of legally required notices is part of the market review when required.
Asia-Pacific
- Australia review maps processing to the Privacy Act and Australian Privacy Principles where applicable, including transparency, security, access/correction and cross-border disclosure controls.
- New Zealand review includes the Privacy Act 2020 information privacy principles and overseas-disclosure requirements.
- Singapore review includes PDPA accountability, notification/consent, purpose limitation, protection, retention, transfer, access/correction and breach-notification obligations.
- India, Japan and other APAC markets receive separate review under their applicable data-protection, consumer, e-commerce, tax and payment rules rather than being treated as one regional regime.
Africa & Middle East
- South Africa review includes POPIA requirements where applicable, including responsible-party accountability, lawful processing, data-subject rights, operators, security and cross-border transfers.
- Other African and Middle Eastern markets are jurisdiction-specific, particularly for privacy registrations, local hosting/transfer rules, payments, consumer protection, sanctions and marketplace licensing.
- A country remains unavailable for live booking until those market checks are completed.
How a market becomes live
Vavvo’s administrator must complete the country review for privacy, marketplace/consumer rules, payments and payouts, tax/platform reporting, identity/biometrics, cross-border transfers, local representation and accessibility. Separately, the payment/tax market configuration must be active. Production checkout fails closed if either layer is incomplete.
Read the Terms of Use, Privacy Policy, or return to the Legal Center.