1. Who we are and where data comes from
SEPIVEL LTD is the controller for platform accounts, enquiries, billing administration, security and removal requests. Contact our privacy team at support@sepivel.com or at our registered office above. Merchants generally control their own customers’ order data. We process it on their instructions under data-processing terms, which you can request from support at any time.
We collect information from you, from authorised colleagues at your business, from our providers and from public marketplace seller profiles and listings. Public sources can include names, business contacts, store links and catalog content. Please do not send special-category information through our forms. We need your contact details to respond to a request. We may also need identity and billing details to meet a contract or a legal duty.
2. Purposes and lawful bases
| Purpose / information | UK GDPR lawful basis |
|---|---|
| Accounts, service delivery and requested pre-contract steps; contact and account information | Contract (Article 6(1)(b)) where you are the contracting individual; legitimate interests (Article 6(1)(f)) for business representatives: administering the customer relationship. |
| Responding to review, callback and support requests; contact, store URL and message | Legitimate interests: answering an enquiry you initiate; contract where necessary for an individual customer’s service. Replying to your request is not marketing consent. |
| Invoices, accounting and required legal records | Legal obligation (Article 6(1)(c)) where accounting or tax duties apply; contract for billing administration. |
| Security, fraud investigation and disputes; logs and incident records | Legitimate interests: protecting users, services and legal claims; legal obligation where applicable. |
| Public seller research and catalog feasibility; seller links, public business contacts and listing information | Legitimate interests: assessing which business services are relevant to a seller, balanced against your interests and limited to what is necessary. You can object at any time. |
| Removal requests; requester role, contact, slug and reason | Legitimate interests: handling objections and rights complaints; legal obligation where a duty to act applies. |
| Optional analytics and marketing or chat tags when enabled | Consent (Article 6(1)(a)), given before any optional tag loads. Promotional messages use the lawful basis and any consent required for the channel. |
3. Who we share data with
Our operators and providers receive only the information they need for their task. Stripe may act as an independent controller for its regulatory processing. We disclose data to authorities where the law requires it.
- Vercel: hosting, plus analytics and performance measurements when enabled and permitted.
- Supabase: database and authentication.
- Cloudflare R2: catalog media and object storage.
- Stripe: hosted payments, payment references and verification.
- Resend: service email delivery.
- Sepivel sales/support chat: messages and contact details stored in our Supabase database for the conversation you request. No HubSpot or Pipedrive connection is used.
4. How long we keep data
We keep personal data only as long as the purpose, your contract, legal duties, unresolved disputes and security needs require.
- Enquiries and unsuccessful reviews: reviewed for deletion 12 months after last meaningful contact, unless a relationship or dispute requires longer.
- Account and merchant operational data: for the agreement and the export window, then deleted within 90 days after closure, subject to legal holds and backup expiry.
- Invoice and tax records: generally six years from the end of the relevant financial year, or longer where a legal duty or investigation requires it.
- Routine security logs: reviewed after 90 days. Incident evidence is kept until investigations and any claims periods end.
- Removal requests: kept while we investigate and for 12 months after resolution. We may keep minimal suppression information to prevent republication or unwanted contact.
- Consent preferences: until you clear them or the policy version changes. Provider cookie durations are in the tag inventory.
Deleted data can remain in backups until they expire in the normal cycle.
5. International transfers
Our providers and authorised operators may access data outside the UK, including in the United States. Where personal data is transferred outside the UK we rely on UK adequacy regulations or on appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, with a transfer risk assessment where one is required. You can ask support for details of the locations involved and for a copy of the applicable safeguards, with confidential terms redacted where necessary.
6. Your rights and complaints
You can ask for access to your data, and for its correction, erasure or restriction. You can ask for portability where we process data on the basis of consent or contract by automated means. These rights have conditions and exemptions, and we may need to verify your identity. We normally reply within one month and explain any lawful extension or exception.
You can object to processing based on legitimate interests, including seller research, and you can object to direct marketing at any time. You can withdraw consent through Cookie settings or by contacting support. Withdrawing consent does not affect processing that took place before. To object to a preview, use the removal form. We do not make decisions about individuals based solely on automated processing that have legal or similarly significant effects.
You can complain to the Information Commissioner’s Office (ICO), telephone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You do not need to contact us first. Other local regulators and rights remain available to you.