Why this addendum exists
When Sereane reads your Etsy orders, prepares your supplier purchases and drafts your after-sales replies, it handles data that is not yours: that of your buyers. These people are not our customers and have never heard of us.
Towards them, you are the controller: you are the one who collects the data, you decide what it is used for. Sereane acts on your behalf and on your instructions: we are the processor. European law then requires a written contract between us, carrying precise commitments. This is that document.
It applies as soon as you use Sereane, with no action needed on your part. You have nothing to sign: if you have an account, it covers you.
1. What we process, for what, and for how long
- Purpose: providing the Sereane service — centralising your orders, preparing purchases from your supplier, tracking shipments, reconciling information and preparing your after-sales replies.
- Nature of the processing: collection from marketplace pages using your session, recording, structuring, consultation, reconciliation, transmission to the supplier for shipping, sending to a language model to prepare a reply, erasure.
- Categories of data subjects: your buyers, and parcel recipients where they differ from them.
- Categories of data: name, delivery address, sometimes e-mail or phone number, customs identifier where a country requires it, content of messages exchanged with your shop, images they attach there, order references and amounts, shipping information.
- No special category data within the meaning of Article 9 of the GDPR is requested or sought. If a buyer spontaneously writes some in a message, that message is handled like any other: we can neither anticipate nor filter it, and we would rather tell you that.
- Duration: that of your contract, bounded by the retention periods published in §7 bis of the privacy policy (180 days for an order, 365 days at most for a conversation).
2. We act only on your instructions
We process this data only to provide you with the service, and for nothing else. We do not sell it, do not rent it, do not use it for our own prospecting, and do not reuse it to train a model for our own benefit.
Your instructions are: your workspace's settings, the actions you take in it, and this addendum. If an instruction you give us appears to us contrary to European law, we tell you instead of carrying it out.
The law may require us to process or disclose an item of data without your instruction. In that case we inform you beforehand, unless that information is itself prohibited to us.
3. Confidentiality
Anyone authorised to access your buyers’ data is bound by a written confidentiality undertaking, signed before any access is granted.
4. Security
The measures are described in §11 of the privacy policy: access control, encryption of communications, account isolation, minimisation of exposed data, error monitoring. Passwords do not exist: sign-in happens through a one-time link valid for 15 minutes, or through an identity provider.
5. The processors we use
You generally authorise us to use the providers listed in §5 of the privacy policy, each for the role described there, with the countries and transfer mechanisms detailed in §6.
We undertake to announce any addition or replacement to you before it takes effect, through a message in your workspace. You may object to it; if the objection makes the service impossible to provide, you may cancel without penalty.
6. Your buyers' rights
It is you a buyer must contact, and you who responds. We help you with that:
- your workspace lets you erase a buyer's data immediately, without writing to us and without waiting for the 180 days;
- you can ask us for everything we hold about a given buyer, to respond to an access or portability request;
- if a buyer writes to us directly, we do not decide in your place: we forward their request to you and help see it through.
7. In the event of a data breach
If we discover a breach affecting your buyers' data, we inform you without undue delay and at the latest within 48 hours, with what we know: what happened, which data and how many people are affected, the likely consequences and what we are doing. It is you who notify the supervisory authority, within 72 hours; we provide you with what you need to do so.
8. At the end of the contract
You choose: we return the data to you in a readable format, or we erase it. Tell us in writing; we handle the request within 30 days.
One exception, stated plainly: records that accounting and tax law require us to keep remain, for up to ten years. They contain no buyer identity.
9. What you can verify
We make available the information needed to demonstrate compliance with this addendum. You may have an audit carried out, by yourself or by an independent third party, after reasonable notice and at most once a year — with no such limit in the event of a security incident.