GDPR

We do not sell personal data. We do not share it for advertising. We do not profile anyone, and no machine here decides anything about a person on its own. There is no exception, no affiliate arrangement and no “trusted partner” carve-out behind that sentence.

The complete list of everyone who processes data on our behalf is in section 6 of the Privacy Policy. Each one runs part of the service and may use what it processes only to deliver that service back to us. None of them is an advertising network.

• —A lawful basis per category. Contract, legitimate interests, legal obligation and consent are each recorded against what they cover, rather than one blanket claim over everything — section 4.
• —Minimisation as a design decision. We do not store visitors’ IP addresses. A shop’s visitor count is derived per shop, per day, and written to nobody’s device — section 3.
• —Consent that is real. Analytics on our own pages load only after you agree, and refusing is exactly as easy as agreeing. A seller’s storefront asks its own question only when that seller has connected marketing tools of their own, and those too load only after a yes — section 10.
• —Transfers on Standard Contractual Clauses, with the UK Addendum where the UK GDPR applies — section 7.
• —Article 28 terms for sellers. For their buyers’ data the seller is the controller and we are the processor, and the written agreement that requires is already in force without anything further to sign — section 8.
• —Retention with an actual period, stated per category, including the one we cannot erase on request and why — section 11.
• —Rights answered in 30 days, free — access, correction, erasure, portability, objection — section 12.
• —Breaches reported within 72 hours where the law requires it, and to the people affected without undue delay where the risk is high — section 14.

You are the controller of your buyers’ data and we are your processor. That means the obligation to your buyers is yours, and the obligation to help you meet it is ours.

You do not need to sign a separate data processing agreement. Section 8 is that agreement, it applies to every account, and it binds us to process only on your instructions, to keep the sub-processor list current with notice before it changes, to help you answer a buyer’s request, and to delete on closure. If your own regulator wants it as a standalone document, write to privacy@sailo.store and we will send one.

Write to privacy@sailo.store. We answer within 30 days and never charge. You can also complain to your own supervisory authority — the Information Commissioner’s Office in the UK, or the authority for the country you live in across the EEA. We would ask you to come to us first, but nothing requires you to.

Where we fall short of something on this page, the honest response is to fix it rather than to reword it. A gap reported here is read by the person who can change the code.

Khaleel Musleh, a sole proprietor, trading as Sailo. Privacy enquiries: privacy@sailo.store.