In short: the seller is in charge of the personal data it puts into NVDRA Bazaar. NVDRA Technologies processes that data only to provide the Service on the seller’s instructions, keeps it confidential and secure, uses vetted service providers, helps with requests and incidents, and returns or deletes the data when the seller leaves.
Scope and roles
These Data Processing Terms form part of the Terms of Service between NVDRA Technologies (“we”) and each seller that uses NVDRA Bazaar. They apply to personal data that the seller or its Users put into NVDRA Bazaar (“Seller Data”).
- The seller decides why and how Seller Data is processed (it is the “controller”).
- NVDRA Technologies processes Seller Data on the seller’s behalf (it is the “processor”).
- Data we use for our own purposes (NVDRA accounts, billing, security logs), and data people keep in their personal use of NVDRA Bazaar, is covered by our Privacy Policy, not by these terms.
Details of the processing
| Subject matter | Providing NVDRA Bazaar and the connected NVDRA applications chosen by the seller. |
|---|---|
| Duration | While the seller’s account is open, plus the return and deletion period below. |
| People concerned | Shoppers who buy from the seller, the seller’s team, and people named in delivery addresses. |
| Types of data | Names, mobile numbers and delivery addresses of the seller’s buyers, items ordered, chats and return requests. |
| Operations | Collecting, recording, storing, organising, displaying, transmitting (including by email and push notification), backing up, exporting and deleting. |
Processing only on the seller’s instructions
We process Seller Data only to provide, secure and support the Service, as set out in the Terms, these Data Processing Terms and the settings the seller chooses, or as required by law. If the law requires us to process it in another way, we will tell the seller first unless the law forbids it. If we think an instruction breaks the law, we will say so.
We do not sell Seller Data, use it for advertising, or combine it with other data to build profiles of people.
The seller’s duties
- Have a lawful basis, and consent where needed, for the data it enters.
- Tell its people clearly how it uses NVDRA Bazaar (it may link to our Privacy Policy).
- Enter only the data it needs, keep it accurate, and set roles so that each person sees only what they need.
- Keep its own sign-in details and devices secure, and remove access promptly when someone leaves.
Confidentiality and our staff
Only NVDRA staff who need access to provide support, maintain the Service or keep it secure may access Seller Data. They are bound by confidentiality and their access is recorded. Signing in as a User from the NVDRA Admin Panel is limited to senior administrators, needs a recorded reason, shows a visible banner, ends by itself and is kept in the audit log.
Security measures
- Encrypted connections (HTTPS) for all access, and one-way hashing of passwords.
- Role-based access within each seller, and separation of each seller’s data from others’.
- Private files stored outside the public web folder; signed and verified connections between NVDRA applications.
- Regular backups, security updates and monitoring, and audit logs of sensitive actions.
Service providers (sub-processors)
The seller authorises us to use service providers to help provide the Service, currently in these categories: hosting and backup; email delivery; and browser and phone push notification services. We give each provider only the data it needs, require it to protect the data, and remain responsible for its work. We will update the list in the Privacy Policy before adding a new category of provider, and a seller that objects on reasonable grounds may close its account and receive a refund of the unused part of its paid year.
Helping with requests
If someone contacts us directly about Seller Data, we will refer them to the seller and, where appropriate, tell it. The seller can answer most requests itself in NVDRA Bazaar. Where it cannot, we will help within a reasonable time.
Security incidents
If we become aware of a breach of security leading to accidental or unlawful loss, alteration, disclosure of or access to Seller Data, we will notify the seller without undue delay, and in any case within 72 hours of confirming it, with what we know about what happened, the data affected and what we are doing about it. We will help the seller inform the people affected and any authority where required.
Return and deletion of data
- While its account is open, the seller can export its records and delete records and files.
- When the seller closes its account, the data stays available for export for 30 days. We then delete it from the live system within a further 60 days. Backups are overwritten within 90 days.
- We may keep data longer only where the law requires us to, and only for that purpose. On request we will confirm deletion in writing.
Requests from authorities
If a court or authority asks us for Seller Data, we will check that the request is lawful, disclose only what is required, and tell the seller before disclosing, unless the law forbids it.
Information and audits
We will give the seller the information reasonably needed to show that we meet these terms, for example by answering a security questionnaire once a year. Any on-site audit must be agreed in advance, be reasonable in scope, and respect the confidentiality of other organisations’ data.
Contact
NVDRA Technologies
Email: support@nvdra.com