Sellforte Online Service Privacy Notice

Version 2026-09-22

This notice explains how personal data is used in Sellforte's customer Online Service. It separates processing for your organization from Sellforte's own purposes. Our public demo, website, marketing, billing, and broader business relationships follow our general privacy policy. Applicants and employees have separate notices.

Your use of the Services is governed by the current published Terms of Service where agreed, or the other agreement in force between your organization and Sellforte (the “Agreement”). “DPA” means the data processing agreement or appendix applicable to your organization. References and links to published standard terms do not replace your Agreement or automatically make newer terms applicable. Mandatory legal rights and obligations remain unaffected.

1 Who is responsible

For your organization. Your organization, usually your employer, decides why and how personal data is used in its workspace. It is the controller, or acts for another controller. Sellforte processes personal data on its behalf as a processor or subprocessor under the applicable DPA. This includes account, access, service-use, and support data processed for the organization.

For our own purposes. Sellforte Solutions Oy is controller for the activities in Section 3. Our business ID is 2832424-2 and our address is Otakaari 5, 02150 Espoo, Finland. Contact privacy@sellforte.com. The same type of data, such as a login event, can serve different purposes; our role depends on the particular use.

2 Data processed for your organization

Account and access data: your name, work email, organization, role, authentication identifiers, and permissions, supplied by you or your organization.

Usage and technical data: IP address, device and browser information, sessions, timestamps, feature use, and access or audit logs generated through use.

Service content: personal data in uploaded or connected data, reports, prompts, AI Output, and action records, depending on the organization's configuration.

Support content: requests, correspondence, and attachments; recordings or transcripts only when enabled with the required information and permissions.

We use these data to authenticate users, operate and secure the workspace, provide the agreed features, and resolve support issues. Necessary account and access information is required to use the service. Your organization decides what other content is supplied.

Lawful basis. The responsible controller determines and explains its basis, which may be legitimate interests, a legal obligation, consent, or a contract with the individual, depending on the purpose. The service agreement between Sellforte and your organization is not itself a contract with you or your consent. Sellforte follows lawful instructions under the DPA rather than choosing a separate basis for its own reuse of these data.

3 Sellforte's own purposes and lawful bases

Security and abuse prevention. We use limited account, technical, and audit information to protect the platform and its users, investigate incidents, and establish or defend legal claims. Our basis is our legitimate interest in security and protecting legal rights.

Product-usage statistics. We use limited usage events, feature identifiers, timestamps, and account identifiers where necessary to count active users and measure feature adoption. Our basis is our legitimate interest in improving the service and understanding its use, subject to the safeguards described in this notice. Historical totals and trends used for business and investor reporting are anonymous and do not contain individual-user histories. We obtain consent for nonessential device storage or access where required.

Optional product analytics. With your consent, we may collect more detailed information about your interactions with the interface to understand and improve usability. You may withdraw consent at any time without affecting access to the core service.

Feedback and service communications. We use relevant business contact details, Feedback, and related correspondence to respond, follow up suggestions, improve the service, and communicate service or security information. Our basis is our legitimate interest in operating and improving the service and communicating with users. Customer content supplied for troubleshooting remains under the DPA; calling it Feedback does not change its status.

Legal duties and consent. We rely on a legal obligation where a law requires particular processing, such as handling GDPR rights requests or making required incident notifications. Where an optional activity requires consent, we explain the purpose when asking and allow withdrawal. We rely on legitimate interests only where the processing is necessary and your rights and interests do not override them.

Customer Content and records processed on your organization’s behalf remain subject to its applicable DPA and are not reused for Sellforte’s independent purposes under this notice. Identifiable and pseudonymized information remains personal data. Sellforte’s own contract, billing, account-management, and meeting-recording activities are described in our general privacy policy.

4 Recipients and international transfers

Processing for your organization. The subprocessors, processing locations, international-transfer safeguards, and technical and organizational security measures applicable to your organization’s data depend on its DPA and agreed service configuration. We use subprocessors and make international transfers in accordance with those arrangements and applicable law. Any required notices, authorizations, or opportunities to object follow the applicable DPA. Your organization can provide the relevant details, or you can contact privacy@sellforte.com for assistance.

Processing for Sellforte’s own purposes. We use the following service-provider groups for the purposes described in this notice. Providers acting as our processors work under processing agreements; these providers may differ from the subprocessors used for processing on your organization’s behalf.

Infrastructure and security. Cloud hosting, storage, security, and technical monitoring providers receive the account identifiers, technical records, and logs needed to operate and protect these activities. EU hosting may still involve authorized support or other processing outside the EEA.

Communications and contact management. Communications and contact-management providers handle business contact details, service correspondence, Feedback, and communication preferences to support communications and follow-up. Their service and support operations may involve processing outside the EEA.

AI assistance. We may use AI tools to draft or analyze selected own-purpose correspondence or controller-level logs. These tools may process data outside the EU and EEA, including in the US; they do not necessarily follow the Customer’s service-hosting region.

Meeting notes. We may use note-taking tools for account-management notes and transcripts, including participant details and meeting content, for the separate business-relationship purposes described in our general privacy policy. Processing may occur outside the EU and EEA, including in the US.

Only data needed for the relevant purpose is shared. Personal data processed on your organization’s behalf is kept out of these separate AI and note-taking tools, including troubleshooting extracts and transcripts containing that data. The international-transfer safeguards below apply to our own processing.

Authorized Sellforte personnel and group companies in Finland, Germany, the UK, and the US may access data as needed for the relevant purpose. Providers engaged as our processors act under processing agreements and instructions. Tools your organization obtains independently follow that provider's own terms and privacy information.

International processing for our own purposes. These providers may process data outside the EEA, including in the US, through hosting, support, and other operations. The Customer's service-hosting region does not determine where our separate controller records are processed. We use an applicable adequacy decision or appropriate safeguards, such as EU Standard Contractual Clauses, with additional measures where required. Contact privacy@sellforte.com for recipient and country details or a copy of relevant safeguards.

We may also disclose necessary information to professional advisers for legal claims, authorities where legally required, or parties to a business transaction where lawful and subject to appropriate safeguards.

5 How long we keep data

Data processed for your organization. We retain, return, and delete personal data in accordance with your organization’s applicable agreement, lawful instructions, and legal requirements. This includes personal data in service content, support records, logs, and backups. Retention periods, any retrieval period after the service ends, and backup deletion schedules depend on those arrangements. Your organization can explain the periods applicable to your data. Retained copies remain protected and are used only for permitted purposes.

Our own usage and security logs: up to 18 months from each event, then deletion or anonymization. This supports seasonal usage analysis and investigation of delayed or long-running attacks. We minimize the data, restrict access by purpose, and assess the need for retention. Renewal of the customer agreement does not restart the clock.

Identifiable Feedback and related correspondence: during the customer agreement and for up to 12 months after it ends, to support follow-up and preserve relevant improvement context. We review the need for identity at least annually and remove it sooner when it is no longer needed.

Anonymous statistics: may remain after the underlying logs or accounts are deleted. Before treating statistics as anonymous, we assess whether individuals can reasonably be identified, including through small groups, repeated reports, or other available information.

Specific incidents, disputes, or legal duties: relevant controller records may be isolated for longer. We record the reason and expiry trigger, review the hold at least every six months, and delete or anonymize the records when the matter is finally resolved and applicable legal retention or limitation periods expire. These exceptions do not extend retention of personal data processed on your organization’s behalf under the DPA.

These limits apply to the relevant records held by our providers too. Other controller records follow the general privacy policy. We protect personal data through access controls, encryption, logging, personnel confidentiality, and proportionate security measures.

6 Cookies and similar technologies

Necessary authentication and session technologies enable secure access. Optional analytics technologies are used only with consent where required, with information about the technologies and available choices. You can refuse or withdraw that consent without losing core service functions.

7 Your rights and how to contact us

For your organization's processing: contact its privacy contact or administrator, normally through your employer. If it acts for another controller, it can identify the right contact. Sellforte assists with requests under the DPA. If you contact us directly, we promptly forward the request to the Customer and act on its instructions or as required by law.

For Sellforte's own processing: contact privacy@sellforte.com directly. You do not need to go through your employer. You can ask us which processing applies if you are unsure.

Depending on the circumstances, you may request access, correction, deletion, or restriction. You may object to processing based on legitimate interests for reasons relating to your situation, and withdraw consent without affecting earlier lawful processing. Portability applies to qualifying automated processing based on consent or a contract with you; it does not apply to every record.

We respond to requests for our controller processing within one month. If a permitted extension is needed, we explain why within that month. We may request proportionate identity verification. You may complain to the Finnish Data Protection Ombudsman or your competent local authority.

Visitors to customer websites or apps. That processing is explained in the operator’s visitor notice and our Tracking Technology Guidance, rather than this Online Service notice. Where joint controllership applies, visitors may exercise their rights against either the Customer or Sellforte.

Sellforte does not use the data covered by this notice to make solely automated decisions about individuals with legal or similarly significant effects.

We may update factual information and explanatory wording through a dated notice where law permits. We will communicate material processing changes when required, explain a new purpose before it starts, and obtain consent where required. Updating this notice does not itself create a lawful basis or change the Agreement.

Back to document navigation