Annex B Processing details

Version 2026-09-22

B1 Parties and contacts

The Customer identified in the Order Form is the controller of Customer Personal Data, or acts as a processor authorized by the controller identified in its instructions. Sellforte Solutions Oy acts as processor or subprocessor. The Customer's contact is identified in the Order Form. Sellforte's contact is privacy@sellforte.com, Otakaari 5, 02150 Espoo, Finland.

B2 Subject matter and purposes

Sellforte processes Customer Personal Data to provide the marketing measurement and analysis Services ordered by the Customer. This includes onboarding, obtaining and checking data, customer-specific modeling, delivering results, operating and securing the Services, providing support, and returning or deleting data. AI features, Tracking Technology, external-tool access, and Automated Actions are included only where enabled within the agreed scope. The limited joint-controller arrangement for Tracking Technology is described in DPA Section 1.2 (Roles).

B3 Nature and frequency

Processing includes collecting, receiving, organizing, storing, checking, combining, and analyzing data; generating results; providing access to authorized recipients; correcting or restricting data; anonymizing data where authorized; and deleting it. Processing continues while the Services are provided. The Order Form and authorized connector settings determine how often data is collected and results are updated.

B4 Data subjects

• Users and personnel of the Customer, its Affiliates, agencies, and suppliers whose Personal Data is processed for the Services.

• Individuals whose Personal Data is included in Customer Content, such as customers, prospects, website or app visitors, and advertising audiences. Data involving children and restricted data remain subject to ToS Section 3.6 (Tracking Technology) and DPA Section 4.1 (Restricted data).

B5 Data categories

• Business contact details, User account identifiers, access permissions, and service-use records processed on the Customer's behalf.

• Personal Data contained in sales, transactions, marketing campaigns, advertising spend, conversions, and customer interactions.

• Online and device identifiers and technical event data collected through enabled Tracking Technology.

• Personal Data included in support communications, AI prompts and responses, and records of authorized actions. Special-category and criminal-offense data may be intentionally submitted only by separate written agreement under DPA Section 4.1 (Restricted data). Accidental receipt remains protected by the DPA.

B6 Duration and minimization

Sellforte processes only the Customer Personal Data needed for the agreed Services and instructions. Processing continues during the Services and any agreed transition, then only as needed for return, retrieval, deletion, or lawful retention. DPA Section 11 (Deletion or return of Personal Data) and ToS Section 17.6 (Return and erasure) govern the retrieval period, deletion, and backup expiry. Earlier lawful deletion instructions and shorter mandatory deadlines prevail.

B7 Location and recipients

Primary hosting is in the EU unless the Customer selects another supported region in the Order Form. Annex C identifies the authorized subprocessors, their functions, and processing locations, including relevant access from other countries. DPA Section 13 (International transfers) and Annex D govern international transfers.

B8 Controller instructions

The Order Form, authorized service settings, and documented requests record the Customer's processing instructions. If the Customer acts for another controller, it must identify that controller and have authority to give those instructions. New purposes, restricted data, or materially different categories of individuals require documented instructions and any necessary assessment before the new processing begins.

Back to document navigation