These documents concern agreements with Sellforte Solutions Oy. The contracting entity in your Order Form determines the applicable terms. Terms for the other Sellforte contracting entity.
These measures apply to Customer Personal Data. Their implementation may evolve under DPA Section 6.2 (Security schedule). They describe contractual controls, not a certification or a guarantee that incidents cannot occur.
A1 Governance and personnel
Sellforte assigns responsibility for information security and privacy, maintains relevant policies, reviews risks and controls regularly and after material changes, and trains personnel on their duties. Personnel are bound by confidentiality and receive access only as needed for their work.
A2 Access and separation
Access uses individual identities, least privilege, and prompt removal when no longer needed. Privileged and remote administrative access uses multifactor authentication. Customer environments and data are logically separated. Access permissions are reviewed periodically; production access and privileged changes are logged.
A3 Transmission and storage
Customer Personal Data is encrypted in transit over public networks using current secure protocols and encrypted at rest in production storage and backups. Encryption keys and credentials are restricted to authorized systems and personnel and managed separately from publicly accessible code. Secrets are protected and rotated when compromised or otherwise required by policy.
A4 Infrastructure and development
Hosting providers maintain physical and environmental protections for their facilities. Sellforte configures network restrictions, secure administrative access, malware defenses where appropriate, and protected deployment processes. Code and material changes are reviewed and tested before production release. Security vulnerabilities are assessed and remediated according to severity, exposure, and available mitigations.
A5 Logging and incident response
Sellforte logs security-relevant events, protects logs against unauthorized access and alteration, and investigates material alerts. Logs are proportionate and avoid unnecessary Customer Content. Documented response procedures cover assessment, containment, recovery, and notice under DPA Section 9 (Personal Data Breach). Security incidents and corrective actions are recorded.
A6 Availability and recovery
Sellforte maintains backups and recovery procedures appropriate to the Services and tests restoration periodically. Backups are protected against unauthorized access and ordinary production use. Retention and erasure follow ToS Section 17.6 (Return and erasure). This Annex does not establish a recovery-time or recovery-point guarantee; any agreed service levels are in the SLA.
A7 Data lifecycle and requests
Sellforte limits processing to agreed purposes, supports authorized correction, export, and erasure, and applies retention rules to active systems, backups, and supplier-held copies. Deletion covers Customer Personal Data in support attachments, logs, recordings, transcripts, summaries, and other derived records, subject only to applicable lawful retention exceptions. Erasure is reapplied following restoration before data returns to ordinary use. Shorter legal or source-provider deadlines override the maximum backup period. Production Personal Data is not used in development or testing unless necessary, authorized, and protected by equivalent controls; anonymous or synthetic data is preferred.
A8 Suppliers and transfers
Suppliers are assessed before receiving Customer Personal Data and are subject to written processing and security obligations, location controls, and lawful transfer mechanisms. Material changes follow DPA Sections 7 (Subprocessing) and 13 (International transfers). Sellforte maintains information necessary to demonstrate compliance and facilitates audits under DPA Section 12 (Audit rights).
A9 AI Services and integrations
Access to AI Services, Data Connectors, Tracking Technology, and External Services is scoped to authorized data and functions. Credentials are protected, external instructions do not override access permissions, and Automated Actions require the authorization in ToS Section 2.3 (Automated Actions and external tools). Customer Content, including Customer Personal Data, is excluded from general-purpose or generative model training. AWS abuse-monitoring retention of prompts to and outputs of AI Services (up to 30 days, within the authorized region) is disclosed in Annex C and remains subject to this DPA.
