SellSpace
Data Processing Terms
These terms apply when SellSpace processes your customers' personal data on your behalf.
1. Scope and roles
1.1 These terms form a data processing agreement under Article 28 GDPR between the Seller ("Controller") and SellSpace ("Processor", SellSpace). They are part of the Terms of Service and apply from the moment the Seller opens a store.
1.2 The Seller is the controller of personal data of its Buyers and other store visitors, and decides the purposes of the processing. SellSpace processes this data only on the Seller's documented instructions, to provide the platform. For data where SellSpace decides purposes itself (account, billing, security, analytics, DSA duties) SellSpace is a separate controller, see the Privacy Policy.
2. Details of the processing
| Item | Description |
|---|---|
| Subject matter | Hosting the Seller's store, taking and delivering orders, support tickets, analytics. |
| Duration | For as long as the store exists, plus the deletion period in article 8. |
| Nature and purpose | Storage, transmission, delivery, display, e-mail sending, support handling, aggregated analytics. |
| Data subjects | The Seller's Buyers, support requesters, store visitors. |
| Categories of data | E-mail address, order details, delivered items, custom field answers, support messages, pseudonymous analytics data (no IP address). |
| Special categories | None intended. The Seller must not collect special-category data through custom fields. |
3. Obligations of the Processor
- Process personal data only on the Controller's instructions (these terms and the Controller's use of the platform), unless EU or Member State law requires otherwise; we tell the Controller if we think an instruction breaks the GDPR.
- Ensure that persons authorised to process data are bound by confidentiality.
- Take appropriate technical and organisational measures (Article 32), including hashed passwords, encrypted transport, access control, two-factor authentication for staff, signed time-limited download links, and separation of private files.
- Help the Controller with data subject requests, security, breach notifications, impact assessments and consultations, taking into account the nature of the processing.
- Notify the Controller without undue delay, and in any case within 72 hours of becoming aware where the law requires, after becoming aware of a personal data breach affecting the Controller's data.
- Make available the information needed to show compliance and allow reasonable audits (normally through documentation and written answers, on reasonable notice and at the Controller's cost).
4. Obligations of the Controller
- Have a legal basis for the processing and give Buyers the information required by the GDPR (a privacy notice).
- Use the platform lawfully and not collect more data than needed.
- Respond to data subject requests from its Buyers, with our help.
5. Sub-processors
5.1 The Controller gives general authorisation to use sub-processors. Current sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Stripe | Payment processing and Connect payouts (also an independent controller for its own purposes) | EU / US |
| Resend | Sending transactional e-mail (verification, orders, tickets, invitations) | EU / US |
| Hosting provider | Hosting and infrastructure | EU |
5.2 We inform the Controller of new or replaced sub-processors at least 15 days in advance (by e-mail or dashboard notice). The Controller may object on reasonable data protection grounds; if we cannot resolve it, the Controller may close its store.
5.3 We impose on sub-processors data protection obligations that are no less strict than these terms and remain responsible for them.
6. International transfers
Transfers outside the EEA take place only with a valid transfer mechanism: an adequacy decision (for example the EU-US Data Privacy Framework for certified providers) or the EU Standard Contractual Clauses. The Controller authorises these transfers to the sub-processors above.
7. Data subject requests and authorities
If we receive a request from a Buyer about the Controller's data, we forward it to the Controller where we can identify them and do not answer ourselves unless the law requires. We tell the Controller about requests from authorities concerning their data unless the law forbids it.
8. Return and deletion
When the store or account ends, we delete or return the Controller's personal data within 30 days, at the Controller's choice, except where the law requires us to keep it (for example order records for tax) or we need it to establish or defend legal claims. Backups are overwritten in the normal cycle.
9. Liability and law
Liability follows the Terms of Service. Dutch law governs these terms. If these terms conflict with the Terms of Service on personal data, these terms prevail.