Menu
Login
Sign up
Menu

Data Policy

At Sellautomator we take the privacy of your data very seriously. We know that you are entrusting us with sensitive commercial information and we have taken security measures to avoid any concerns about data integrity.

  1. When you connect an integration with Sellautomator, we request read-only access and will not modify/write to your sales channels, ad accounts, shipping services, or any other 3rd party applications.
  2. Sellautomator only requests read permissions to fields that are required to be functional.
  3. We are aware of the needs of ecommerce. For this reason Sellautomator is a software in constant evolution.
  4. Only the full time employees of Sellautomator. have access to your data. We have taken technogical and operational measures to hide client data from any contractors we hire.
  5. All data is stored in a secure private server and all connections to Sellautomator are protected by a 256-bit encryption.
  6. We do not sell your data to 3rd parties.

Sellautomator & the GDPR

As a SAAS ecommerce analytics, Sellautomator receives and processes personal data from retailers all over the world. Some of our customers will be EU-based stores or sell to EU residents and therefore Sellautomator is required to comply with the GDPR.
Retailers (“Customers”) signing up with Sellautomator are referred to as “Data Controllers” whereas Sellautomator is a “Data Processor” (as these terms are defined by the GDPR).

Sellautomator is committed to being compliant with the GDPR, and enabling our customers to be compliant as well. We maintain and utilize robust security practices and strive to stay at the forefront of data security.

Will you sign a DPA with our company?

As a Data Processor, to comply with EU GDPR laws, we are required to provide a Data Protection Addendum (DPA). This DPA applies to our Customers that are subject to the EU General Data Protection Regulation (2016/EC/679) or “GDPR”).

You don’t have to sign a DPA with Sellautomator. By using the Sellautomator service, you agree to our Terms of Service, Privacy Policy & our DPA. This satisfies the Article 28(3) provision of the GDPR.

This Data Protection Addendum (“Addendum”) forms part of the Privacy Policy (“Privacy Policy”) between: Ginovart & Monclús Enginyers S.L.U. (“Sellautomator“) acting on its own behalf; and (ii) you (“Company”) acting on its own behalf and as agent for each Company Affiliate. The terms used in this Addendum shall have the meanings set forth in this Addendum. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement. Except as modified below, the terms of the Agreement shall remain in full force and effect. In consideration of the mutual obligations set out herein, the parties hereby agree that the terms and conditions set out below shall be added as an Addendum to the Agreement. Except where the context requires otherwise, references in this Addendum to the Agreement are to the Agreement as amended by, and including, this Addendum. 

  1. Definitions
    1. In this Addendum, the following terms shall have the meanings set out below and cognate terms shall be construed accordingly:
      1. “Applicable Laws” means (a) any US Federal, State, or local law, statute, code, ordinance, rule or regulation (b) European Union or Member State laws with respect to any Company Personal Data in respect of which any Company Group Member is subject to EU Data Protection Laws; and (c) any other applicable law with respect to any Company Personal Data in respect of which any Company Group Member is subject to any other Data Protection Laws;
      2. “Company Affiliate” means an entity that owns or controls, is owned or controlled by or is or under common control or ownership with Company, where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise;
      3. “Company Group Member” means Company or any Company Affiliate;
      4. “Company Personal Data” means any Personal Data Processed by a Contracted Processor on behalf of a Company Group Member pursuant to or in connection with the Principal Agreement;
      5. “Contracted Processor” means Sellautomator or a Subprocessor;
      6. “Data Protection Laws” means EU Data Protection Laws and, to the extent applicable, the data protection or privacy laws of any other country;
      7. “EEA” means the European Economic Area;
      8. “EU Data Protection Laws” means EU Directive 95/46/EC, as transposed into domestic legislation of each Member State and as amended, replaced or superseded from time to time, including by the GDPR and laws implementing or supplementing the GDPR;
      9. “GDPR” means EU General Data Protection Regulation 2016/679; 1
      10. “Services” means the services and other activities to be supplied to or carried out by or on behalf of Sellautomator for Company Group Members pursuant to the Principal Agreement;
      11. “Standard Contractual Clauses” means the contractual clauses set out in Annex 2, amended as indicated (in square brackets and italics) in that Annex and under section 13.4;
      12. “Subprocessor” means any person (including any third party and any Vendor Affiliate, but excluding an employee of Sellautomator or any of its sub-contractors) appointed by or on behalf of Sellautomator or any Vendor Affiliate to Process Personal Data on behalf of any Company Group Member in connection with the Principal Agreement; and
      13. The terms, “Commission”, “Controller”, “Data Subject”, “Member State”, “Personal Data”, “Personal Data Breach”, “Processing” and “Supervisory Authority” shall have the same meaning as in the GDPR, and their cognate terms shall be construed accordingly.
  2. Processing of Company Personal Data
    1. Sellautomator shall:
      1. comply with all applicable Data Protection Laws in the Processing of Company Personal Data; and
      2. not Process Company Personal Data other than on the relevant Company Group Member’s documented instructions unless Processing is required by Applicable Laws to which the relevant Contracted Processor is subject, in which case Sellautomator shall to the extent permitted by Applicable Laws inform the relevant Company Group Member of that legal requirement before the relevant Processing of that Personal Data.
    2. Each Company Group Member:
      1. instructs Sellautomator and each Vendor Affiliate (and authorises Sellautomator to instruct each Subprocessor) to:
        1. Process Company Personal Data only for the purposes set out in the Agreement; and
        2. in particular, transfer Company Personal Data to any country or territory as reasonably necessary for the provision of the Services and consistent with the Agreement; and
      2. warrants and represents that it is and will at all relevant times remain duly and effectively authorised to give the instruction set out in section 2.2.1 on behalf of each relevant Company Affiliate.
    3. Sellautomator Personnel.
      Sellautomator shall take reasonable steps to ensure the reliability of any employee, agent or contractor of any Contracted Processor who may have access to the Company Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know / access the relevant Company Personal Data, as strictly necessary for the purposes of the Agreement, and to comply with Applicable Laws in the context of that individual’s duties to the Contracted Processor, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.
  3. Security
    1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Sellautomator shall in relation to the Company Personal Data implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.
    2. In assessing the appropriate level of security, Sellautomator shall take account in particular of the risks that are presented by Processing, in particular from a Personal Data Breach.
  4. Subprocessing
    1. In the course of providing the Services,you acknowledge and agree that Sellautomator may use Subprocessors to Process the Personal Data. Sellautomator use of any specific Subprocessor to process the Personal Data must be in compliance with Data Protection Legislation and must be governed by a contract between Sellautomator and Subprocessor.
  5. Data Subject Rights
    1. Taking into account the nature of the Processing, Sellautomator shall assist each Company Group Member by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Company Group Members’ obligations, as reasonably understood by Company, to respond to requests to exercise Data Subject rights under the Data Protection Laws.
    2. Sellautomator shall:
      1. promptly notify Company if any Contracted Processor receives a request from a Data Subject under any Data Protection Law in respect of Company Personal Data; and
      2. ensure that the Contracted Processor does not respond to that request except on the documented instructions of Company or the relevant Company Affiliate or as required by Applicable Laws to which the Contracted Processor is subject, in which case Sellautomator shall to the extent permitted by Applicable Laws inform Company of that legal requirement before the Contracted Processor responds to the request.
  6. Personal Data Breach
    1. Sellautomator shall notify Company without undue delay upon Sellautomator or any Subprocessor becoming aware of a Personal Data Breach affecting Company Personal Data, providing Company with sufficient information to allow each Company Group Member to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Data Protection Laws.
    2. Sellautomator shall cooperate with Company and each Company Group Member and take such reasonable commercial steps as are directed by Company to assist in the investigation, mitigation and remediation of each such Personal Data Breach.
  7. Data Protection Impact Assessment and Prior Consultation
    Sellautomator shall provide reasonable assistance to each Company Group Member with any data protection impact assessments, and prior consultations with Supervising Authorities or other competent data privacy authorities, which Company reasonably considers to be required of any Company Group Member by article 35 or 36 of the GDPR or equivalent provisions of any other Data Protection Law, in each case solely in relation to Processing of Company Personal Data by, and taking into account the nature of the Processing and information available to, the Contracted Processors.
  8. Deletion or return of Company Personal Data
    1. Sellautomator shall promptly and in any event within 60 days of the date of cessation of any Services involving the Processing of Company Personal Data (the “Cessation Date”), delete and procure the deletion of all copies of those Company Personal Data.
  9. General Terms
    Governing law and jurisdiction
    1. The parties to this Addendum hereby submit to the choice of jurisdiction stipulated in the Agreement with respect to any disputes or claims howsoever arising under this Addendum, including disputes regarding its existence, validity or termination or the consequences of its nullity; and
      1. this Addendum and all non-contractual or other obligations arising out of or in connection with it are governed by the laws of the country or territory stipulated for this purpose in the Agreement. 
    2. Nothing in this Addendum reduces Sellautomator obligations under the Agreement in relation to the protection of Personal Data or permits Sellautomator to Process (or permit the Processing of) Personal Data in a manner which is prohibited by the Agreement. In the event of any conflict or inconsistency between this Addendum and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.
    3. With regard to the subject matter of this Addendum, in the event of inconsistencies between the provisions of this Addendum and any other agreements between the parties, including the 4 Agreement and including (except where explicitly agreed otherwise in writing, signed on behalf of the parties) agreements entered into or purported to be entered into after the date of this Addendum, the provisions of this Addendum shall prevail.
    4. Should any provision of this Addendum be invalid or unenforceable, then the remainder of this Addendum shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, while preserving the parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.
ANNEX 1: DETAILS OF PROCESSING OF COMPANY PERSONAL DATA

This Annex 1 includes certain details of the Processing of Company Personal Data as required by Article 28(3) GDPR.

Subject matter and duration of the Processing of Company Personal Data

The subject matter and duration of the Processing of the Company Personal Data are set out in the Principal Agreement and this Addendum.

The nature and purpose of the Processing of Company Personal Data:

Customer data will be processed to provide the analysis required for Sellautomator to deliver analysis expected from the Agreement – such as (but not necessarily including) revenue, profitability, COGS analysis, profit per order, by customer, profit by country, traffic & advertising sources, and any other analysis results relevant to each customer.

The types of Company Personal Data to be Processed:

Email Addresses, Retailer/Customer order data including names and quantities of products ordered, countries and states these orders are delivered to, numbers of orders placed, sources of web traffic. Total revenue, COGS, advertisiing spend profitability

The categories of Data Subject to whom the Company Personal Data relates

Retailers’ Order Data, Customer Data, Company Revenue, Advertising & Profitability data

The obligations and rights of Company and Company Af iliates

The obligations and rights of Company and Company Affiliates are set out in the Principal Agreement and this Addendum.

If you have a specific DPA you wish us to enter in with us, please contact us at info@incubalia.com and we can review it.

© 2019 All rights reserved​

Made with ❤ by Incubalia