Privacy policy

Company and contact

Seller Online LLC is a Pennsylvania, USA company providing services online to clients in Ukraine, the US and other countries where the relevant service is lawful and routes are available. A client’s country does not change the contracting party.

For contract, privacy and rights requests, contact Seller Online LLC: 635 Somers Ave, Feasterville-Trevose, PA 19053, USA; so-support@seller-online.com.

Our role

For registration, our own billing, support and security, Seller Online LLC determines purposes and means as a data controller. When carrying out a seller’s instructions about its buyers, we act as a processor unless the actual operation requires a different legal role. Carriers, marketplaces, payment providers and customs authorities may be independent controllers; their notices govern their own operations.

The terms on which we process buyer data on a seller’s behalf (including for the purposes of Article 28 GDPR) are set out in the “Buyer data processing” section of the user agreement.

Data and sources

• Account and team: name, contact details, business details, users and their permissions. Sources: you or your account administrator.
• Identity checks: necessary documents for a specific, justified check; we explain the purpose and required scope. Do not submit unnecessary documents through public forms.
• Connected shops: orders, products, listings, stock and statuses available to the particular integration. Sources: you and the platform you authorised.
• Buyers and recipients: names, addresses, contacts, order contents and delivery details supplied by the seller or platform.
• Services: shipments, customs declarations, warehouse operations, returns, production files, photos and operation history.
• Billing and support: service payments, invoices, requests and correspondence.
• Technical data: IP address, browser details, requests, timestamps and error logs needed to operate and protect the service. Data stored in your browser is described in the cookie notice.

Purposes and legal bases

• Contract or steps you request before entering into a contract: account creation, ordered services, billing and support.
• Legal obligations that apply to the operation: accounting, tax, customs and sanctions requirements.
• Legitimate interests: security, abuse prevention, legal claims and communications with client representatives, taking individuals’ rights into account.
• Consent where required: optional communications or technologies. Refusing or withdrawing consent does not affect the lawfulness of earlier processing or remove access to the core service.

Data needed to fulfil an order or legal requirement is necessary for that operation. If it is not supplied, we explain which service cannot be performed.

Recipients

We pass recipient data to a carrier only for a shipment the client creates and confirms in the CRM, and only to the extent needed for delivery. For a particular operation, the necessary data may also go to a warehouse, production contractor, customs broker, connected platform or payment provider. We disclose data to authorities on lawful request and to authorised advisers for legal claims.

Data is stored with infrastructure providers acting on our instructions: OVHcloud (hosting, servers in Canada) and Amazon Web Services (backups, US). Email and communications providers receive client contact details to correspond with clients. Our error-monitoring service receives no personal data.

Buyer data that a client entrusts to us to fulfil orders is used only for those orders and is not sold. The CRM does not send buyers any emails or messages.

International processing

CRM data is stored on servers in Canada, and backups in the US. Services may require access to data in the US, Ukraine and countries of dispatch, transit or destination. Where the law requires specific safeguards for an international transfer (for example under the GDPR or UK GDPR), we use a mechanism it provides for, such as standard contractual clauses.

Retention and deletion

We retain data only as long as needed for the purpose of processing, mandatory records and legal claims. We then delete or anonymise it. Backups may hold data for a limited time until they are routinely replaced.

After a shop is disconnected, no new data arrives from it, and orders already imported stay in the CRM so the client can ship them. When a client stops using the service and closes the account, we anonymise the personal data of its buyers within three days, except data the law requires us to keep. A client can also ask us to delete its buyers’ data earlier, and we delete it on request.

Data protection

• Data is transmitted only over encrypted connections (TLS 1.2 or later), including between the application server and the database.
• The database is stored on encrypted disks. Backups in Amazon Web Services are encrypted and blocked from public access.
• Only the system administrator has access to the database server. Multi-factor authentication is enabled for access to servers, administrative tools and backups.
• Access tokens for connected shops are stored on the server in an encrypted database. We do not ask for or store marketplace account passwords.
• Personal data is not written to server logs or error reports.

We maintain a security incident response plan. We notify affected clients of a personal data breach without undue delay; for data obtained through the Etsy API, we also notify Etsy no later than 24 hours after discovery. No system guarantees absolute security.

Rights and requests

Depending on applicable law, you may request access, correction, deletion, restriction or portability, object to processing based on legitimate interests and withdraw consent. You may object to direct marketing at any time. We explain lawful exceptions, such as mandatory invoice retention, in our response.

Write to the contact above; you do not need a CRM account. Identity verification is proportionate to risk and avoids unnecessary data. We respond within the applicable legal deadline: under the GDPR, normally one month, with permitted extensions and an explanation. We do not discriminate against you for exercising your rights.

Requests and the first copy of your data are normally free; a fee or refusal is possible only under a legal exception, with an explanation.

You may complain to the competent authority: in the EEA, the authority where you live, work or where the infringement occurred; in the UK, the ICO; in Ukraine, the Ukrainian Parliament Commissioner for Human Rights. You may also seek a judicial remedy. A client’s buyers can contact their seller; we assist that seller within our role.

Age and changes

Accounts are intended for people aged 18 or over who can enter into a contract. If you believe we have received unnecessary data about a child, write to us and we will review and delete it.

The revision date appears above. We announce material changes on the site or by email and request separate consent where required.