These documents concern agreements with Sellforte, Inc. The contracting entity in your Order Form determines the applicable terms. Terms for agreements with Sellforte Solutions Oy.
Last updated: 2026-11-11
1 About this notice
This notice explains how personal data is used in Sellforte’s customer Online Service. It separates processing for your organization from Sellforte’s own purposes. Our public demo, website, marketing, billing, and broader business relationships follow our general privacy policy. Applicants and employees have separate notices.
Your organization’s use of the Services is governed by its agreement with Sellforte (the “Agreement”), which is either the published Terms of Service or another signed agreement. “DPA” means the data processing terms that apply under the Agreement. This notice does not change the Agreement or make newer terms apply, and mandatory law remains unaffected. Capitalized terms have the meanings in the Agreement, and “personal data” has its GDPR meaning.
For our own purposes. For Services contracted with Sellforte, Inc., Sellforte, Inc. is controller for its own activities in Section 3, at 2201 Spinks Road, Suite 252, Flower Mound, Texas 75022, United States. Sellforte Solutions Oy separately controls any group activities it determines, at Otakaari 5, 02150 Espoo, Finland. Actual roles depend on the activity; requests may be sent to the common privacy contact. Contact privacy@sellforte.com.
The same type of data, such as a login event, can serve different purposes; our role depends on the particular use.
2 Processing for your organization (Sellforte as processor)
2.1 Purposes and legal bases
Your organization, usually your employer, decides why and how personal data is used in its workspace. It is the controller, or acts for another controller. Sellforte processes personal data on its behalf as a processor or subprocessor under the applicable DPA. This includes account, access, service-use, and support data processed for the organization.
Account and access data: your name, work email, organization, role, authentication identifiers, and permissions, supplied by you or your organization.
Usage and technical data: IP address, device and browser information, sessions, timestamps, feature use, and access or audit logs generated through use.
Service content: personal data in uploaded or connected data, reports, prompts, AI Output, and action records, depending on the organization's configuration.
Support content: requests, correspondence, and attachments; recordings or transcripts only when enabled with the required information and permissions.
We use these data to authenticate users, operate and secure the workspace, provide the agreed features, and resolve support issues. Necessary account and access information is required to use the service. Your organization decides what other content is supplied.
Lawful basis. The responsible controller determines and explains its basis, which may be legitimate interests, a legal obligation, consent, or a contract with the individual, depending on the purpose. The service agreement between Sellforte and your organization is not itself a contract with you or your consent. Sellforte processes these data only on your organization’s instructions under the DPA and does not reuse them for its own purposes.
2.2 Recipients and international transfers
Recipients, locations, transfer safeguards, and security measures for your organization’s data follow its DPA. Your organization can provide the details, or you can contact privacy@sellforte.com.
2.3 Retention
We keep, return, and delete it under your organization’s agreement, its lawful instructions, and the law, including data in support records, logs, and backups. Your organization can tell you which periods apply. Retained copies remain protected and are used only for permitted purposes.
2.4 Your rights
Contact its privacy contact or administrator, normally through your employer. If it acts for another controller, it can identify the right contact. Sellforte assists with requests under the DPA. If you contact us directly, we promptly forward the request to your organization and act on its instructions or as required by law.
3 Sellforte’s own processing (Sellforte as controller)
3.1 Purposes and legal bases
Security and abuse prevention. We use limited account, technical, and audit information to protect the platform and its users, investigate incidents, and establish or defend legal claims. Our basis is our legitimate interest in security and protecting legal rights.
Product-usage statistics. We use limited usage events, feature identifiers, timestamps, and account identifiers where necessary to count active users and measure feature adoption. Our basis is our legitimate interest in improving the service and understanding its use, subject to the safeguards described in this notice. Historical totals and trends used for business reporting are anonymous and do not contain individual-user histories. We obtain consent for nonessential device storage or access where required.
Optional product analytics. With your consent, we use product analytics tools to record more detailed interactions with the interface, such as clicks, navigation, and session recordings, to improve usability. Customer Content shown on screen is masked or excluded. You can withdraw consent at any time without losing access to the core service.
Feedback and service communications. We use relevant business contact details, Feedback, and related correspondence to respond, follow up suggestions, improve the service, and communicate service or security information. Our basis is our legitimate interest in operating and improving the service and communicating with users. Customer Content shared with support or as feedback remains subject to the DPA.
Legal duties and consent. We rely on a legal obligation where a law requires particular processing, such as handling GDPR rights requests or making required incident notifications. Where an optional activity requires consent, we explain the purpose when asking and allow withdrawal. We rely on legitimate interests only where the processing is necessary and your rights and interests do not override them.
Identifiable and pseudonymized information remains personal data. Sellforte’s own contract, billing, account-management, and meeting-recording activities are described in our general privacy policy.
3.2 Recipients and international transfers
We use the following groups of service providers, which act as our processors under processing agreements:
- Infrastructure and security: cloud hosting, storage, security, and monitoring providers, for account identifiers, technical records, and logs.
- Communications and contact management: providers that handle business contact details, correspondence, Feedback, and communication preferences.
- Product analytics, with your consent: providers that receive interaction data and account identifiers.
- Productivity and collaboration tools: providers of tools for correspondence, documents, meetings, and records.
We share only the data needed for each purpose. Authorized Sellforte personnel and group companies in Finland, Germany, the UK, and the US may access data as needed. Tools your organization obtains independently follow their providers’ own terms.
International processing. These providers and group companies may process data outside the EEA, including in the US. Where required, we use an adequacy decision or appropriate safeguards, such as EU Standard Contractual Clauses, with additional measures where needed. Contact privacy@sellforte.com for details or a copy of the safeguards.
We may also disclose necessary information to professional advisers, to authorities where legally required, and to parties to a business transaction, with appropriate safeguards.
3.3 Retention
Our own usage and security logs: up to 18 months from each event, then deletion or anonymization. This supports seasonal usage analysis and investigation of delayed or long-running attacks. We minimize the data, restrict access by purpose, and assess the need for retention.
Optional product analytics: up to 18 months from each event, then deletion or anonymization.
Identifiable Feedback and related correspondence: during the customer agreement and for up to 12 months after it ends, to support follow-up and preserve relevant improvement context. We review the need for identity at least annually and remove it sooner when it is no longer needed.
Anonymous statistics: may remain after the underlying logs or accounts are deleted. Before treating statistics as anonymous, we assess whether individuals can reasonably be identified, including through small groups, repeated reports, or other available information.
Specific incidents, disputes, or legal duties: relevant controller records may be isolated for longer. We record the reason and expiry trigger, review the hold at least every six months, and delete or anonymize the records when the matter is finally resolved and applicable legal retention or limitation periods expire. These exceptions do not extend retention of personal data processed on your organization’s behalf under the DPA.
These limits apply to the relevant records held by our providers too. Other controller records follow the general privacy policy. We protect personal data through access controls, encryption, logging, personnel confidentiality, and proportionate security measures.
3.4 Cookies
Necessary authentication and session technologies enable secure access. Optional analytics technologies are used only with consent where required, with information about the technologies and available choices. You can refuse or withdraw that consent without losing core service functions. The consent tool lists optional analytics cookies and their lifetimes.
3.5 Your rights
Contact privacy@sellforte.com directly. You do not need to go through your employer. You can ask us which processing applies if you are unsure.
Depending on the circumstances, you may request access, correction, deletion, or restriction.
Right to object. You may object at any time to processing based on our legitimate interests (Section 3) for reasons relating to your situation, and withdraw consent at any time without affecting earlier lawful processing. You may also have a right to data portability where processing is automated and based on consent or a contract with you.
We respond to requests for our controller processing within one month. If a permitted extension is needed, we explain why within that month. We may request proportionate identity verification. You may complain to the Finnish Data Protection Ombudsman or your competent local authority.
Sellforte does not use the data covered by this notice to make solely automated decisions about individuals with legal or similarly significant effects.
4 Changes to this notice
We may update this notice by publishing a new version. We will tell you about material changes where required, explain any new purpose before it starts, and ask for consent where required.
