Who is who

This agreement is between you, the business that uses Sellv for its store (the controller), and the company that provides Sellv, which provides Sellv (the processor). It is part of the terms of service and applies as long as you use Sellv.

What Sellv processes, and why

Sellv processes personal data only to provide the service you use: showing what your advertising earns, checking your tracking, and sending your store's conversions to the ad platforms you connect. It concerns:

• Your customers and visitors: order numbers and amounts, the shipping country, a keyed hash of the customer ID, a hashed email address, and, only with the visitor's consent, the IP address, browser and ad click IDs needed to report a purchase to an ad platform.
• Your team: names and email addresses of the people you invite.

Only on your instructions

Sellv processes the data only on your instructions: the terms, the settings you choose, and the changes you approve or let Autopilot make. If Sellv thinks an instruction breaks data protection law, Sellv tells you.

Confidentiality

Everyone at Sellv who can access personal data is bound to confidentiality.

Security

Sellv takes appropriate technical and organisational measures, including:

• HTTPS for every connection, and a server in the European Union.
• Access to your platforms and visitor details stored encrypted; email addresses stored only as a hash.
• Visitor details deleted after 7 days, store events after 90 days.
• Access limited to the people who need it, strong passwords, two-step verification, and a log of changes and exports.
• Daily backups, and a written plan for security incidents.

Sub-processors

Sellv uses the service providers listed in the privacy policy: the server host, an email provider and, only when you use an AI feature, an AI provider. You allow Sellv to use them. Sellv tells you at least 30 days before adding or replacing one, and you may object; if you object and we cannot find a solution, you can stop using Sellv. Sellv imposes the same data protection obligations on them. The ad platforms you connect are your own choice and work for you, not for Sellv.

Outside the European Union

The data stays in the European Union. Only an AI provider may be outside it, and then under the standard contractual clauses of the European Commission.

Helping you

Sellv helps you answer requests from people who want to see, correct or delete their data, and with a data protection impact assessment where you need one. Requests that Shopify forwards, such as erasing a customer, Sellv carries out automatically.

Data breaches

If Sellv discovers a breach involving your personal data, Sellv tells you without undue delay and at the latest within 48 hours, with what is known about what happened, which data it concerns and what Sellv is doing about it, so you can meet your own obligations.

Checking this agreement

Sellv gives you the information you need to check that this agreement is kept. You may have an audit done once a year, at your own cost and with reasonable notice, by an auditor bound to confidentiality.

When you stop

When you disconnect a platform or delete your workspace, Sellv deletes the personal data from it. Copies in backups disappear when those backups expire, within 90 days. If you want a copy first, ask before you delete.

Liability and precedence

The liability rules of the terms of service apply. Where this agreement and the terms differ about personal data, this agreement prevails. Dutch law applies.