Privacy policy

1. Controller

2. Visiting the website (server log files)

When you access our website, our hosting provider automatically processes data in server log files: IP address, date and time of access, page/file requested, volume of data transferred, referrer URL, browser type and operating system. Purpose: technical provision, stability and security of the website. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure, functioning service). Storage period: as a rule no more than 30 days.

Fonts are served locally from our own server (self-hosting). Your IP address is therefore not transmitted to third parties (e.g. Google Fonts).

3. Getting in touch (request form & email)

You can contact our sales team through the form at sellforge.ai/en/contact. The data you enter is processed: name, company/store, email address and — where provided — phone number, store URL, order volume and free-text message. The same applies to enquiries you send us directly by email.

Purpose: handling your enquiry and preparing a contract. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures) or your consent under Art. 6 (1) (a) GDPR, which you give in the form and may withdraw at any time with effect for the future. Storage period: until your enquiry has been dealt with conclusively; the data is then deleted unless statutory retention periods apply.

4. Registration & user account

If you create an account for the sellforge platform, we process the data you provide: store/company name, first and last name, email address, password (stored encrypted), address (street, postcode, city, country) and — if provided — the VAT ID.

Purpose: creating and managing your account, providing the platform, preparing and performing the contract. Legal basis: Art. 6 (1) (b) GDPR (contract or pre-contractual measures). Storage period: for the duration of the contractual relationship; after account deletion the data is deleted unless statutory retention periods apply (e.g. § 132 BAO, 7 years for invoices).

5. Payment processing (subscription)

Paid packages are processed via the payment service provider Stripe Payments Europe, Ltd. (Ireland), where applicable involving Stripe, Inc. (USA). The data required for payment (name, email, billing address, amount, payment method) is transmitted directly to Stripe. Payment details (e.g. credit card numbers) are not stored by us. Legal basis: Art. 6 (1) (b) GDPR. Third-country transfer: processing may in part take place in the USA; EU Commission standard contractual clauses under Art. 46 GDPR are in place, supplemented by the EU-US Data Privacy Framework. Stripe privacy information.

6. Processors & recipients

We use carefully selected service providers with whom data processing agreements under Art. 28 GDPR are in place:

• Hosting / infrastructure: servers operated within the European Union.
• Payment processing: Stripe (see section 5).
• Email delivery: system and transactional emails (e.g. registration and invoice mails) sent via an email service provider.

Any further disclosure to third parties only takes place where we are legally obliged to do so or where you have consented.

7. Data of our customers' customers (processing on behalf)

If you use sellforge as a store operator, we process the personal data of your end customers exclusively on your behalf and on your instructions. In this respect we are a processor within the meaning of Art. 28 GDPR; the basis is a data processing agreement (DPA) that we provide to you as part of your use of the platform. You remain the controller for this data as the store operator.

8. Cookies & reach measurement

For technical operation we use necessary storage (e.g. session and login management in the signed-in area).

To analyse usage behaviour we use Microsoft Clarity (Microsoft Ireland Operations Ltd., where applicable involving Microsoft Corporation, USA) — via heatmaps and pseudonymous session recordings. This happens solely with your express consent given through the cookie banner; without consent no recording takes place. Legal basis: Art. 6 (1) (a) GDPR. Processing may in part take place in the USA (standard contractual clauses under Art. 46 GDPR and the EU-US Data Privacy Framework). You may withdraw your consent at any time with effect for the future (delete cookies/local storage). Microsoft privacy information.

9. Your rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent given (Art. 7 (3) GDPR)

An informal email to office@sellforge.ai is sufficient to exercise them.

10. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. Competent in Austria:
Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.

11. Changes

We adapt this privacy policy when changes in the legal situation or in our processing activities make it necessary. The version published on this page applies at any given time.