SELLPY PRIVACY NOTICE

This Privacy Notice is applicable to customers of Sellpy, including current, former, potential customers, sellers, buyers, users and recipients of a product or service offered by us, visitors to our official websites, apps or pop-up stores or members of our loyalty programs or communities. Sellpy consists of Sellhelp AB and its subsidiaries.

What is personal data?

Personal data is any kind of information that can be directly or indirectly attributed to you. Examples of personal data are name, address, e-mail address, telephone number, payment information and purchase order. Usage history, IP address, user id are also examples of personal data, so can be other types of information you provide when contacting our customer service.

Who is responsible for processing your personal data?

The Swedish company Sellhelp AB, Götgatan 74, 118 26 Stockholm, Sweden is responsible for the processing of personal data described within this Privacy Notice as the Controller. Sellhelp AB is throughout this Privacy Notice referred to as “we” or “us”.

When can we process your personal data?

We will only collect, process, use or store personal data if we have valid and lawful reasons to do so. Your personal data may be processed by us based on reasons derived from the following factors:

How do we process your personal data and why?

Depending on how you interact with us or what type of service you are using we will process your personal data for the following purposes:

Selling Service

Purpose for processing: To be able to process your Sellpy bag and the items therein, including e.g. deliver and receive your Sellpy bag, verify your identity, your ownership as well as collect, sort, describe, photograph, store and/or potentially send for recycling or donate your items. To enable your service requests, facilitate and fulfil any sale of your items as well as manage payment transactions via our third-party payment service providers. To manage deliveries, claims, warranty matters, returns and refunds of the items in a secure and effective manner. To contact you when needed and to notify you about sales, donations/recycling and other essential updates.

Type of personal data:

Lawful basis: When providing you with selling services, we will process your personal data necessary for fulfilment of a contract with you. This includes fulfilment of any obligations derived from that contract, whether it involves management of Sellpy bag items, payment, return, or the use of other services provided by us or by third parties. For any other purpose referred to herein, the process of your personal data is based on our legitimate interest as a business.

Retention time: We will keep and process your personal data no longer than necessary for us to perform our contractual and consumer obligations.

Online Shopping

Purpose for processing: To enable your order placement or service requests and manage payment transactions via our third-party payment service providers. To manage your deliveries, claims, warranty matters, returns and refunds in a secure and effective manner. To contact you when needed and to notify you about order status and other essential updates.

Type of personal data:

Further info. We collaborate with Klarna Bank AB to provide you with a “buy now pay later” checkout option in some markets. Klarna Bank AB is an independent payment service provider who acts as a lender and conducts its own credit checks. This means if you choose to use Klarna credit payment method(s), data such as payment related information, contact details as well as data related to your shopping history may be shared with Klarna.

Lawful basis: When providing you with products and services, we will process your personal data necessary for fulfilment of a contract with you. This includes fulfilment of any obligations derived from that contract, whether it involves purchase order, payment, return, or the use of other services provided by us or by third parties. For any other purpose referred to herein, the process of your personal data is based on our legitimate interest as a business.

Retention time: We will keep and process your personal data no longer than necessary for us to perform our contractual and consumer obligations.

Marketing and Promotions

Purpose for processing: To generate and distribute marketing materials, such as newsletters, style and shopping recommendations, push notifications and marketing surveys, through multiple communication channels. To provide you with tailored online contents, including sending you advertisements. To ensure our direct marketing communications to you are effective and in line with your preferences.

Type of personal data:

Further info. Marketing and promotions will be sent and displayed to you according to your preferences through email and text messages as well as displayed in your mobile app, social media channels or web browser. We also enhance your online experience by providing you with personalized marketing based on your engagement with us and analytics of your customer behaviour on our websites, such as your purchase and browsing history. You will receive product recommendations from us based on your interactions with us, regardless if you have subscribed to our newsletter. Advertising partners. To be more efficient in our marketing we collaborate with different social media, search engine and advertising network providers ("Advertising Partners"). We collaborate with advertising partners such as Meta, Snapchat, Pinterest, TikTok and YouTube for advertising on social networks and with Google for online advertising networks such as Google Ads and Google Marketing Platform. We also collaborate with affiliate marketing partners in some markets, such as Awin, to drive traffic to our web sites. How this works: Advertising partners use data provided by us and collected from cookies and other tracking technologies to predict your preferences and interests and take this into account when creating your personalized ad. This is standard industry practice commonly known as "retargeting". Retargeting allows us to run relevant advertising campaigns to you and to measure the efficiency and reach of the advertising materials. It also helps us to measure the advertising partners’ performance and efficiency of campaigns. Advertising partners use cookies and similar technologies to trace your usage of our websites and services by accessing data stored on your device or in apps. Our Advertising Partners enable us to identify and engage with the right target audience, to create and distribute personalized marketing content across platforms and services. To be able to choose the content that fits your interests, we can use information obtained from you when you signed-up for newsletter or created a user account or made a purchase with us. We may share this information and a customer identifier, e.g. an encrypted email address, phone number or device id, with our Advertising partners. The purpose is to show relevant ads to you on third party websites and apps. In order to do this, your data is matched with the database of the Advertising partner. If a match is found, you will receive relevant promotional content in your feed or search engine. If no match is found your data is securely destroyed. Your personal data is handled in a secure manner using a technique called hashing. This ensures your data is scrambled in a manner that makes it unreadable to anyone other than the recipient for the explicit given purpose. Each Advertising Partner is responsible for their part of the processing as controllers, including (if any) transfers of personal data to non-EEA countries.

Lawful basis: When we send you direct marketing material via newsletters, we rely on your consent to receive personalised newsletters and text messages. We use pixels in newsletter emails to gauge recipients' engagement metrics, to which we rely on your consent given to receive direct marketing. Additionally, the use of cookies or similar tracking technologies on your browser/device is based on your consent collected via cookie banner. We may use your personal data to improve targeted marketing campaigns through our advertising partners, relying on our legitimate interest as business to carry out these activities. When we send personalized service and product recommendations in connection with our services, we rely on our legitimate interest as a business and you may at any time object and opt-out of the emails by contacting our customer service or deactivating notifications by following Profile - Change Profile Settings - Email / Change Email Preferences.

Retention time: We will process your data no longer than necessary to provide you with marketing and promotions. We will cease processing your data for marketing purposes once you have closed your user profile/customer account and/or actively rejected further marketing communication from us.

My Sellpy User Profile

Purpose for processing: To be able to create and administrate your user profile, such as identify and certify you as the user of the profile. To be able to make your purchase information and history available to you and to bring you a personalized account experience. To provide you with the services, benefits and tailor-made experiences and notify you of your benefits such as offers, promotions and recommendations, services, events and much more organized by us or our partner companies. To manage your balance of Sellpy Credits and any share of sales owed by Sellpy via our third-party payment service providers. To detect and address non-compliance with our Terms & Conditions or fraudulent behaviour.

Type of personal data:

Lawful basis: The processing of your personal data to create and manage your profile and to provide you with the personalized services of the profile is necessary to fulfil the contract. Processing your personal data to email you offers, product recommendations, style updates, bonus vouchers, birthday offers and special invites to sales and events is based on our legitimate interest as a business and you may at any time object and opt-out of the emails by contacting our customer service or deactivating notifications by following Profile - Change Profile Settings - Email / Change Email Preferences. For any other purpose referred to herein, the process of your personal data is based on our legitimate interest as a business.

Retention time: We will use your personal data no longer than necessary for making the user profile/customer account available to you. We keep and continue to process your personal data for as long as necessary to fulfil the agreement. We will keep your personal data for a longer period of time if there are any legal requirements or if there is an ongoing dispute.

Sellpy First (if applicable)

Purpose for processing: To provide you with the services and benefits included in your Sellpy First subscription. To communicate with you of important updates and changes to your Sellpy First Terms & Conditions. To detect and address non-compliance with our Sellpy First Terms & Conditions or fraudulent behaviour.

Type of personal data:

Further info. Further details regarding the Sellpy First subscription are described in the Sellpy First Terms & Conditions on our official websites. Sellpy First subscription is voluntary to enter and can be terminated at any time via your user user profile page.

Lawful basis: The processing of your personal data to manage your Sellpy First subscription is necessary to fulfil the Sellpy First agreement. For any other purpose referred to herein, the process of your personal data is based on our legitimate interest as a business.

Retention time: We will use your personal data no longer than necessary for making the user profile/customer account available to you. We keep and continue to process your personal data for as long as necessary to fulfil the Sellpy First agreement. We will keep your personal data for a longer period of time if there are any legal requirements or if there is an ongoing dispute.

Customer Service

Purpose for processing: To be able to manage your questions, handle complaints and warranty matters and to provide technical support as well as to improve customer experience. To be able to contact you, if needed, through email, telephone, social media, or any other means in response to your enquiries regarding order, delivery or return questions or to request your participation in a customer survey.

Type of personal data:

Lawful basis: The processing of your personal data to provide you with the best possible Customer Service is based on our legitimate interest as a business.

Retention time: We will keep your data for as long as we need to be able to support you regarding your case and, to be able to handle potential legal claims from you as a customer. We may continue to keep and use your data if we have outstanding obligations to you or by any other reasons are prevented from erasure.

Competitions & Events

Purpose for processing: To be able to administrate and follow up on competitions and events, such as confirming participation, contact winners, deliver, and follow up on prize deliveries, reach out to you with relevant information about the competition and/or event and grant you access to the venue where the event is held. To be able to market our events improve our services, marketing, customer relationships and experiences and to plan better future events and attendee experience.

Type of personal data:

Lawful basis: The processing of your personal data in order to make a competition or an event available to you is based on our legitimate interest as a business.

Retention time: We will keep your personal data for as long as necessary for us to fulfil the purposes mentioned above and to fulfil any legal obligations connected.

Business Development & Analytics

Purpose for processing: To be able to evaluate, develop and improve our products, services, customer experience and supply chain. This includes analysis to make our services more user-friendly, such as modifying the user interface to simplify the flow of information or to highlight features that are commonly used by our customers. To be able to reach out to you to respond to enquiries and surveys. In such case, any personal data used and obtained from you will only be processed for the specific purpose described therein. To contact you via phone or similar method to receive feedback on how our services can be improved. To invite you to rate our services via third party platforms, such as Trustpilot. To be able to perform analytics and segmentation to provide you with personalised shopping experience. To be able to share personal data with our Advertising Partners for the purpose of optimizing ad targeting.

Type of personal data:

Lawful basis: The processing of your personal data for the purpose to develop and improve our services and products, is based on our legitimate interest as a business.

Retention time: We will process your personal data no more than necessary for us to fulfil the purpose. Thereafter the data will be immediately erased for this type of use.

Compliance with Laws

Purpose for processing: To comply with certain legal obligations. In order to comply with local law, we are obliged to process certain personal data. Such obligations may vary from country to country stipulated in for example tax, accounting, book-keeping, sanction, and consumer legislations.

Type of personal data:

Further info. Sellpy shall for instance comply with local DAC 7 legislation, which requires Sellpy to request reportable sellers to supply information related to their taxation jurisdiction and other information.

Lawful basis: The processing of your personal data is necessary for Sellpy to fulfil its legal obligations of the country of operation.

Retention time: The data retention time will vary depending on the purpose, context and specific local legal requirements.

Security & Safety

Purpose for processing: To ensure online safety for our customers, users, visitors, assets and business against cyber-attack, fraud, misuse and other malicious activities. To assess, investigate, document, and report individual incidents/accidents. To generate security analysis and reports on aggregated level. To establish, exercise, and/or defend legal claims or disputes.

Type of personal data:

Lawful basis: Unless there is a specific legal obligation, the processing of your personal data for security and safety purposes is based on our legitimate interest.

Retention time: We will keep your personal data no more than necessary for each purpose.

Where and with whom do we share your personal data?

Your personal data is available and accessible only by those who need the data to accomplish the intended processing purpose. We may share your personal data within the Sellpy group of companies, with sub-contractors, partners and other third parties whenever needed to fulfil the intended processing purpose. We reserve the right to transfer any personal data we have about you in the event that we acquire a third party, merge with or are acquired by a third party, undergo other business transactions such as a reorganization, or should any such transaction be proposed. The personal data that we collect from you is processed within a country of the European Union or the European Economic Area (“EU/EEA”) but may also, whenever necessary, be transferred to and processed in a country outside of the EU/EEA. Any such cross-border transfer of your personal data will take place only if permitted and carried out in compliance with applicable laws and without undermining your statutory rights. From time to time, we may transfer personal data from the EU/EEA to a third country not being approved by the European commission as a safe country for such transfer. Whenever applicable we will use the European Commission’s Standard Contractual Clauses, e.g. a set of contractual terms and conditions which both the sender and the receiver of the personal data sign up to and ensure that the rights and freedoms of the individual are considered. Whenever appropriate, we also implement additional safeguard measures, such as encryption, pseudonymization and strict access controls to keep your data safe. In the table below you will find the categories of recipients and the countries to where we transmit or otherwise make available personal data for processing.

Purpose of processing Category of recipients Country of processing
IT infrastructure to provide services and products Information Technology, integrated platform and service providers EU
Pick-up and receipt of Sellpy bags as well as order fulfilment and shipping 3rd party logistics and courier EU, Local/regional
Process payments, including refunds and payouts in relation to our services Payment Service Provider, payment processing platform EU, Local/regional
Tailored marketing efforts to specific audiences; leverage external affiliates to promote products and services. Affiliate and Targeted marketing services EU, US
Tools we use by Customer Service centres and survey distribution Customer engagement solutions EU
Compliance with law Courts, law enforcement agencies, government bodies, regulators, auditors EU, Local/regional
Business analysis IT systems EU, US

### What are your privacy rights? Data protection is a fundamental right, and you have several rights in accordance with applicable data protection legislation. These rights are:

Right to access: You have the right to request information about the personal data we hold on you at any time.

Right to portability: Whenever we process your personal data, by automated means based on your consent or based on an agreement, you have the right to get a copy of your data transferred to you or to another party. This only includes the personal data you have submitted to us.

Right to rectification: You have the right to request rectification of your personal data if the information is incorrect, including the right to have incomplete personal data completed.

Right to erasure: You have the right to request erasure of your personal data processed by us at any time. Your personal data may continue to be processed under certain circumstances, we will fully erase your personal data once it is no longer necessary for the purpose for which we originally collected or processed it, or when we are no longer legally required to process it.

Right to restriction: You have the right to request that we restrict the processing of your personal data under the following circumstances: if you object to a processing based on our legitimate interest, we will restrict all processing of such data pending the verification of the legitimate interest.

Right to withdraw your consent For each processing purpose you have given us your consent, you have the right to withdraw your consent at any time. If you do so, we will stop the processing of your personal data for that specific purpose. You can revoke your consent by the following means:

Right to object to processing based on our legitimate interest You have the right to object to processing of your personal data that is based on our legitimate interest. We will not continue to process the personal data unless we can demonstrate legitimate grounds for the process which overrides your interest and rights or due to legal claims.

How do you exercise your rights?

You can send your request via email at any time to: dataprotection@sellpy.se

Right to complain with a supervisory authority: If you have complaints about the way Sellpy processes and protects your personal data and privacy you have the right to make a complaint to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten - IMY) or any other competent a supervisory authority in the country of residence.

Updates to our Privacy Notice: We may need to update our Privacy Notice. The latest version of our Privacy Notice is always available on our website.

August 2025