Privacy policy

1. Operator and scope of this policy

SellyHub is a store website and management service operated by an individual, reachable through the service contacts below. This policy covers visitors, account holders, store owners, people requesting support and people submitting reports or complaints.

For account administration, service billing, security and complaint handling where we determine the purposes and means, the SellyHub operator acts as a personal data controller. Using the service does not automatically constitute consent to every type of processing.

2. Customers of individual stores

Store owners determine their products, prices, sales conditions and purposes for using customer information. They generally act as controllers for those activities and must provide an appropriate privacy notice and lawful basis.

Where we process store data on lawful instructions, we act as a processor within the relevant service and contractual arrangements. Processing for our own purposes must be assessed separately. This policy does not replace a store’s policy or alter either party’s statutory responsibilities.

Stores may display a store name with a working public business contact, such as email, separately from unnecessary private details. Stores and service operators must still provide the business or data controller information, contact location and other details required by law. A store name or social account does not waive those duties.

Contact the relevant store first about its sales or customer records. You may also report suspected misuse of our service or a store’s failure to respond; we assess requests according to our relevant role.

3. Information we may receive

The categories depend on the features and providers actually used. Do not include game passwords, one-time codes or full payment card details in ordinary support requests.

• Accounts and contact: your stated name, email, contact username or social account, profile, correspondence and proportionate identity verification information where necessary.
• Authentication and security: password hashes, two-factor settings, sessions, sign-in events and relevant activity logs.
• Store services: store names, domains, plans, settings, authorized administrators and setup or service requests.
• Service payments: amounts, times, transaction references, status, necessary payer/recipient information and evidence you submit.
• Technical information: IP address, browser, device type, request times, error logs and information needed to prevent abuse.
• Reports and evidence: relevant store URLs, events, correspondence, ownership documents and evidence from reporters or affected stores, with restricted access.

4. Sources of personal data

We receive information directly from you when you register, use or pay for services or contact us, and technical information through system use. Information may also come from store owners, payment or security providers, reporters and legally authorized authorities.

For information received from others, we consider necessity, a lawful basis and applicable notification duties. Submitters must be entitled to share it and should redact unrelated third-party information.

5. Purposes and lawful bases

Without information required by contract or law, we may be unable to create an account, provide a service, verify a transaction or handle a request. We explain relevant consequences and do not adopt an incompatible new purpose without a suitable lawful basis.

• Contract or requested pre-contract steps: account setup, store operation, domain connections, plan administration, service communications and payment checks.
• Necessary and proportionate legitimate interests: fraud and attack prevention, security, troubleshooting, investigating misuse and establishing or defending claims, with consideration of your rights.
• Legal obligations: required documents and records, lawful orders and personal data rights requests.
• Consent where required: optional marketing or non-essential technologies, if introduced. Consent is requested separately from necessary services and can be withdrawn without invalidating earlier lawful processing.

6. Recipients and external providers

Only necessary information is shared with recipients who have a legitimate need and authority, such as assigned administrators and infrastructure, domain, email, payment verification or security providers actually used. Appropriate terms and safeguards depend on each party’s role.

A dispute may require relevant details to be shared with a store or reported party for a response, taking redaction and reporter safety into account. Evidence is not ordinarily made public. Disclosures to authorities, courts or advisers require a lawful basis and are limited to what is necessary.

We do not sell personal data. An external integration may involve processing under that provider’s own policy, which should be checked for the selected service.

Legal names, addresses, phone numbers and identity documents received for account administration or complaint investigation are not automatically made public. These are separate from contact details designated for public display. Disclosure requires a purpose and lawful basis, such as mandatory notices or lawful orders. Filing a report alone does not entitle anyone to the other party’s private information.

When you contact us by email, we may receive your sender name, email address, message and attachments. Email providers may process data under their own policies. Send only relevant information and redact unnecessary personal data. If more information is needed, we explain why and how to provide it.

7. International processing and transfers

Processing locations depend on the infrastructure and providers used. If data is transferred abroad, we must assess applicable conditions and provide safeguards or a valid exception required by law, with further information where relevant.

8. Retention

Retention follows the purpose, service relationship, legal duties, fraud risks and relevant limitation periods. Closing an account does not require every record to disappear immediately.

• Account and store records: during service and as necessary for closure, permitted exports and outstanding obligations.
• Transaction records and documents: as required for accounting, tax, checks, duplicate-payment prevention and relevant claims.
• Security logs and complaints: including delivery, account recovery, warranty and store suspension evidence, as necessary for investigation, harm prevention, legal obligations and disputes. Suspension does not immediately erase relevant evidence.
• When no longer needed: deletion, destruction or de-identification using appropriate methods. Backups may age out under their management cycle, with use restricted in the meantime.

9. Security and personal data incidents

We use technical and organizational measures appropriate to the risk, including account/store permissions, protection of authentication information, restricted access to private data and important activity records. Store owners must also protect their credentials, administrators and devices. No system is entirely risk-free.

When aware of an incident, we assess, contain and investigate it, and notify the Office of the Personal Data Protection Committee and affected individuals where required, according to the applicable conditions, risk threshold and statutory deadlines. Mitigation guidance is provided where necessary.

10. Cookies and browser storage

Sessions and security mechanisms support sign-in and protect requests. Display choices such as language, theme and text size may be stored in your browser. Blocking or clearing this information may sign you out or reset preferences.

This policy does not grant permission for advertising tracking. If optional analytics, marketing or technologies requiring consent are introduced, information and appropriate choices must be provided before use. Store owners are responsible for notices and consent for their own tracking tools.

11. Your rights and requests

The following rights are subject to legal conditions and exceptions; not every right applies in every situation.

• Access and copies, and information about sources for data collected without consent where the law provides.
• Correction of inaccurate, outdated or misleading information.
• Deletion, destruction, de-identification or restriction where the relevant conditions apply.
• Objection, data portability where applicable and withdrawal of consent for processing based on consent.
• A complaint to the Office of the Personal Data Protection Committee about unlawful processing.

Use the email address below without registering for an account. Identify the relevant account or store, requested right and enough information to locate the records. Proportionate identity verification may be required before disclosure or changes. A full identity document is not required with an ordinary initial request.

We assess and respond within applicable legal deadlines. If a request is refused or some records must be retained, we explain the reason where legally permitted. Other people’s rights, legal obligations and legal claims may limit a request.

12. Minors and sensitive information

Where a minor’s service use or consent requires authorization from a person with parental responsibility, applicable law must be followed. Anyone lacking contractual capacity must act through the appropriate authorized person.

Ordinary services do not request sensitive data such as health, religious or biometric information. Avoid sending it or unnecessary full identity numbers. A genuinely necessary exceptional case requires an appropriate basis and additional safeguards.

13. Policy changes

The updated date and version are shown. Material changes are communicated through appropriate channels before or within applicable statutory deadlines. Publishing a revised policy does not replace consent where a new purpose requires it.