Legal document
Data Processing Agreement (DPA)
This DPA forms part of the SellerHelp Terms of Service and applies from the moment the Controller connects a marketplace or other data source. The Polish version at /dpa is authoritative in case of doubt.
1. Subject matter, nature and purpose
The Processor processes personal data on behalf of the Controller solely to provide the SellerHelp functions the Controller has enabled: retrieving and displaying orders, preparing shipments, synchronising stock and prices, and producing accounting and tax reports. The Processor acts only on the Controller’s documented instructions (this DPA and the Controller’s use of the service), unless EU or Polish law requires otherwise; in that case it informs the Controller beforehand unless the law prohibits it.
2. Duration
For as long as the Controller uses SellerHelp, and afterwards only for the return and deletion period in section 9.
3. Data subjects and categories of data
Data subjects: the Controller’s customers (buyers and recipients on marketplaces) and the Controller’s personnel. Data: buyer/recipient name, delivery address, telephone, e-mail, order and payment status, shipment data, and the tax identification number of business buyers. No special categories of data are intended to be processed and the Controller shall not submit them.
4. Marketplace data (Amazon Selling Partner API)
- Personally identifiable information obtained from Amazon (“Amazon PII”) is used only to fulfil the Controller’s orders, print shipping labels and issue invoices required by law.
- The Processor does not sell, rent, license or disclose Amazon PII to third parties, does not use it for advertising or marketing, and does not combine it with other data to re-identify or profile individuals.
- Amazon PII is deleted no later than 30 days after the order is delivered (in SellerHelp: 30 days after the shipment date recorded in the system, or after the last update for cancelled or rejected orders). Deletion covers order fields, stored shipping labels and raw API payloads; data that does not identify a person (city, postcode, country, tracking number, items, amounts) may remain.
- Where tax or accounting law requires longer retention (for example an invoice), that data is held in a restricted-access archive for the statutory period and used for no other purpose.
5. Confidentiality and security
Personnel authorised to process data are bound by confidentiality and have access only as their role requires. Measures under Art. 32 GDPR include TLS in transit (1.2/1.3), mandatory multi-factor authentication for staff accounts, sign-in rate limiting, a password policy requiring length, character complexity and the exclusion of the account’s own identifying details, application-level encryption (AES-256) of buyers’ personal data in the database, encrypted backups of that data stored at a geographically separate facility with weekly automated restoration testing, daily antivirus scanning with automatic signature updates, dependency vulnerability scanning on every deployment, an independent third-party penetration test scheduled for Q1 2027 (annual cadence thereafter), a database reachable only from the application server, application-level encryption of marketplace credentials, separation of customer accounts in the application, and automatic deletion as described in section 4. A current description is published at /en/security. Marketplace credentials are used only for the Controller’s account and are never displayed in full.
6. Sub-processors
The Controller gives general authorisation for the following sub-processors. The Processor imposes obligations no less protective than this DPA and remains liable for them.
- Hetzner Online GmbH (Nuremberg, Germany) — hosting and backup storage
- PayPro S.A. (Przelewy24), Poznań, Poland — payment processing (independent controller for payments)
- LH.pl — e-mail delivery (transactional messages)
- OpenAI — AI functions; product data only (for example listing titles and descriptions), no buyer personal data
The Processor informs the Controller of an intended change at least 14 days in advance; the Controller may object on reasonable data protection grounds.
7. International transfers
Buyers’ personal data is processed within the European Economic Area. Product data sent to the AI provider may be processed outside the EEA under the mechanisms of Art. 44 et seq. GDPR and does not contain buyers’ personal data.
8. Assistance and data subject rights
The Processor assists the Controller by technical and organisational means in responding to data subject requests, in impact assessments and in prior consultations, and forwards any request it receives directly to the Controller without undue delay.
9. Return and deletion
On termination the Controller may export its data for 30 days. After that the Processor deletes all personal data (except as required by law) and confirms this in writing on request. Backups are rotated; data deleted from production leaves backups within 30 days.
10. Personal data breach
The Processor notifies the Controller without undue delay and no later than 48 hours after becoming aware of a breach affecting the Controller’s data, with the information required by Art. 33(3) GDPR. For incidents affecting data obtained from Amazon, the Processor also notifies Amazon within 24 hours of detection through the channel Amazon designates and cooperates in its investigation. Incident reports: security@sellerhelp.pl.
11. Audit
The Processor provides the information necessary to demonstrate compliance and allows audits by the Controller or an auditor it appoints, on 30 days’ notice, during business hours and no more than once a year (unless a breach or a regulator requires otherwise).
12. Liability and governing law
Liability is governed by the Terms of Service. Polish law applies; the courts with jurisdiction over the Processor's registered office apply, subject to mandatory GDPR provisions.
13. Contact
Data protection: biuro@sellerhelp.pl · Security: security@sellerhelp.pl