Privacy policy

Version 1.0 · in force from [DATE]

1. Who processes the data

The service is operated by [FULL COMPANY NAME], [ADDRESS], company number [REG. NO.], VAT number [VAT], contact info@sellerprotectorapp.com.

Data is stored on servers in [COUNTRY / DATA CENTRE], within the European Union. It is not transferred outside the EU.

2. What the service receives

When a shop with the plugin installed receives an order, its own site turns the customer's details into a hash before sending — a one-way fingerprint from which the original cannot be derived. The service receives only:

• a SHA-256 hash of the name and surname
• a hash of the phone number
• a hash of the e-mail address
• a hash of the delivery address
• a hash of the order number, the date and the delivery outcome (collected or not collected)
• the identifier of the shop that reported the outcome

What the service never receives

• a name, phone number, e-mail or address in readable form
• the contents of the order, the items or the amount
• payment details, card numbers or anything from the payment process
• the customer's IP address or cookies from the shop's site

On the server, the received hashes are hashed again with a secret key that never leaves the server. Even if the database leaked, no name, number or address could be reconstructed from it.

3. Why

The purpose is preventing losses from failed deliveries on cash-on-delivery orders. A shop sees, before packing, whether a customer has collected parcels in the past, and decides for itself what to do with the order.

The legal basis is legitimate interest — Article 6(1)(f) of the General Data Protection Regulation, and Article 12(1)(6) of the Serbian Personal Data Protection Act. The legitimate interest is protecting the merchant's property from costs caused by a small number of customers who systematically fail to collect their parcels.

Processing is kept to the minimum: hashes only, the objective delivery outcome only, with nothing about what was bought.

4. The score and profiling

The service calculates a score from 0 to 5 based on the ratio of collected to non-collected parcels. This is profiling within the meaning of Article 4 GDPR, so it matters what that does and does not mean here:

• The score is information for the merchant, not a decision by the service. The service refuses no order and interrupts no purchase.
• The decision about an order is made by the shop, by a human, in its own panel.
• There is no automated decision with legal effect within the meaning of Article 22 GDPR. A customer can always pay in advance, by card or transfer.
• The score is calculated from outcomes of the last 24 months and repairs itself as the customer collects parcels.

5. How long things are kept

The outcome record is kept without a time limit because a two-year limit would let someone who systematically caused losses return to the network as entirely new. The average still has a 24-month window, so the score of a customer who has changed habits repairs itself.

6. Who sees what

• The score is seen only by a merchant, and only once that customer places an order with them. The customer has no account, receives no notification and never sees a score.
• Merchants do not see each other's shop names, only an anonymous label such as "Seller #B11".
• Data is not sold, rented or passed to third parties. It is not used for marketing, credit scoring or anything outside the stated purpose.

7. How profiles are linked

Four keys are used: name and surname, phone, e-mail and delivery address. Two orders are linked to the same profile when any two keys match. A single match creates no profile, only a note to the merchant.

For accuracy, the same detail written differently — Cyrillic or Latin, with or without accents, in a different word order — is recognised as the same. That is not extra processing but the opposite: it stops one person being recorded as several.

8. Import of earlier orders

When connecting, a shop may send the network hashes of its earlier orders so that changes of details become visible. No outcome is sent for those orders and they affect nobody's score. Only orders from the last 24 months are imported.

A shop running the import must state this in its own privacy policy.

9. Relationship with shops

Each shop is the controller of its customers' data and must name Seller Protector as a recipient in its own privacy policy. Ready-made wording is provided with the plugin.

[FOR THE LAWYER: establish whether Seller Protector acts as a separate controller or as a processor. If a processor, a data processing agreement with every shop is required under Article 28 GDPR.]

10. Customer rights

A customer has the right of access, rectification, erasure, restriction of processing and objection to processing based on legitimate interest.

Since the service stores hashes only, it cannot find any person by name on its own. To act on a request, the person must supply the details a shop would use (name and surname, phone, e-mail, address) so that the same hashes can be computed and the profile found. Those details are used solely to handle the request and are deleted as soon as it is closed.

Requests go to info@sellerprotectorapp.com. We reply within 30 days.

A complaint may be lodged with the Serbian Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, Belgrade, or with the supervisory authority in the customer's country of residence.

11. Security and incidents

• All communication runs over HTTPS. Every request from a shop is signed with that shop's own secret key.
• The database and the secret key are not reachable from the internet.
• In case of a data breach we notify the supervisory authority within 72 hours and the shops in the network without delay.

12. Changes

Changes to this policy are published on this page with a new date. Shops in the network are notified by e-mail at least 30 days before any material change.