Data Processing Addendum — Summary
1. Roles
- Customer = data controller for personal data in its Customer Data — for example its buyers, recipients, creators (KOLs), suppliers, contacts and its own staff. The Customer decides why and how that data is processed.
- Wellion = data processor for that data. We process it only to provide the Service to the Customer and on the Customer's instructions, in line with section 40 of the PDPA.
- For Account Data about the people who use SellerTiger, Wellion is a controller, as described in the Privacy Policy.
2. Details of the processing
| Item | Description |
|---|---|
| Subject matter | providing the SellerTiger e-commerce operations platform |
| Duration | the term of the Customer's subscription, plus the deletion periods in section 8 |
| Nature and purpose | storage and hosting; importing and syncing orders, products, stock, prices and chats from platforms the Customer connects; order processing, printing and shipping; customer chat inbox; tasks, calendar and collaboration; reports; AI features requested by the Customer's users; support |
| Data subjects | the Customer's buyers and recipients; its Members and staff; creators and influencers; suppliers and business contacts |
| Types of personal data | names, usernames on platforms, phone numbers, email addresses, shipping and billing addresses, order and payment-status details, chat messages and attachments, notes, contract and commission details for creators |
| Sensitive data | not expected; the Customer should not upload it unless strictly necessary and lawful |
3. Our commitments as processor
- Instructions: we process Customer Data only on the Customer's documented instructions, which are the Terms, this addendum and the Customer's use and configuration of the Service. We tell the Customer if we believe an instruction breaks the PDPA.
- Confidentiality: people we authorise to process Customer Data are bound by confidentiality and access it only when needed (for example to provide support the Customer requested, or to keep the Service secure).
- Security: we keep appropriate technical and organisational measures, including encryption in transit, hashing of passwords, encryption of stored credentials and API keys, separation between Workspaces, role-based access, audit logging and backups.
- Sub-processors: we use only the sub-processors in section 4, under written terms that give at least the same level of protection. We inform the Founder at least 14 days before adding or replacing a sub-processor; the Customer may object on reasonable data-protection grounds and, if we cannot address the objection, may terminate the affected service with a prorated refund of prepaid fees.
- Assistance: we help the Customer, through the Service's features (search, export, edit and delete) and through support, to respond to requests from data subjects and to meet its obligations on security, breach notification and impact assessments.
- Breach notification: we notify the Customer without undue delay and, where feasible, within 48 hours after becoming aware of a personal data breach affecting Customer Data, with the information available, so that the Customer can notify the PDPC within 72 hours where required.
- Records: we keep records of processing activities as required for processors.
- Audits: we make available information needed to show compliance with this addendum. Customers on paid Plans may request one audit per year, by written request with 30 days' notice, at their own cost, carried out in a way that protects other customers' data and our security.
4. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloud hosting provider ([HOSTING — to be completed]) | servers, database and file storage | [HOSTING — to be completed] |
| Anthropic, OpenAI, Google (Gemini), DeepSeek | AI features, only when a user runs one; the Founder can choose providers where the Service allows | United States / global; DeepSeek: China |
| Tavily | web search for AI features that look up public information | United States |
| Email delivery provider | sending system emails (invitations, password resets, notifications) | per provider |
Platforms the Customer connects (for example Shopee, Lazada, TikTok Shop, LINE, Google, Lark, BigSeller, PEAK) are not our sub-processors: data is exchanged with them on the Customer's instruction and under the Customer's own agreements with them.
5. Customer commitments
The Customer is responsible for: having a lawful basis for the personal data it puts into the Service; giving privacy notices to its buyers and other data subjects; making sure its instructions are lawful; managing who has access to its Workspace; keeping the credentials of its connected platform accounts secure; and handling requests from its own data subjects (with our help).
6. International transfers
Where Customer Data is transferred outside Thailand (for example to AI providers or the hosting region), we rely on the mechanisms in sections 28 and 29 of the PDPA, such as adequacy, appropriate contractual safeguards with the recipient, or necessity for performing the contract with the Customer.
7. Requests from authorities
If an authority asks us for Customer Data, we will refer it to the Customer where possible and, unless prohibited by law, notify the Customer before disclosing it. We disclose only what we are legally required to.
8. Return and deletion
During a paid subscription the Founder can export Customer Data at any time. When a Workspace is deleted or the subscription ends, the Workspace can be restored for 30 days; after that we delete Customer Data from live systems, and backups are overwritten within a further 35 days, except where Thai law requires us to keep certain data.
9. Liability
Each party's liability under this addendum is subject to the limitations in the Terms of Service, except where the law does not allow it to be limited.