Skip to main content

GDPR and Data Protection

Selgeo is built privacy-first: attribution is cookieless and server-side, infrastructure is EU-hosted, and the data-subject rights tooling described here is part of the product — not an afterthought. This page covers the compliance tools available to you as a merchant.

Generating a Data Processing Agreement (DPA)​

Under GDPR Article 28 you need a DPA with every processor that handles personal data on your behalf — including Selgeo. You can generate one without involving a lawyer:

  1. Go to Settings → DPA.
  2. Fill in your company name, registered address, and contact email.
  3. Generate — the DPA is produced as a downloadable PDF, pre-filled with your details, Selgeo's role as data processor, the data categories processed, retention periods, and security measures.

If your company details change, generate a new version — earlier versions stay available in the version history on the same page.

Sub-processors​

The DPA references the sub-processors Selgeo uses to deliver the platform (hosting, payments, email, CDN). Selgeo's canonical sub-processor register, with purposes, locations, and transfer mechanisms, is published at selgeo.com/sub-processors.

Partner data erasure (right to erasure, Art. 17)​

Erasure can be initiated from either side:

  • By the partner — partners have a "Delete My Account" action in their portal settings. It requires typing a confirmation phrase before anything is anonymised; once erasure completes, the partner receives a confirmation email as a receipt.
  • By you — open a partner in the Partners list and use Erase Partner Data in the detail panel, for example when a partner emails you an erasure request directly.

In both cases erasure anonymises rather than deletes: name, email, VAT ID, and IP-derived identifiers are replaced with placeholder values, while historical conversion and commission records are retained in anonymised form (legal basis: legitimate interest in financial record-keeping). An erased partner can no longer be paid: marking a payout as paid is refused for erased participants, and no new commissions accrue to them.

Erased partners are hidden from your Partners list by default; a Show erased toggle reveals them with a redacted "Deleted partner" label.

Erasure is permanent

Anonymisation cannot be undone. The partner's personal identifiers are unrecoverable once erasure completes.

Deleting your own account (right to erasure, Art. 17)​

You can erase your entire Selgeo workspace yourself from Account → Danger zone → Delete account. As with partner erasure, it requires typing a confirmation phrase (DELETE) before anything happens, and it is irreversible.

Deleting your account anonymises the whole workspace: your organisation name and sign-up details, every programme's partner data, and your API-key secrets are removed, while historical financial records are retained in anonymised form (legal basis: legitimate interest in accounting and tax record-keeping). You are logged out immediately and receive a confirmation email as a receipt.

Two things must be resolved before you can delete:

  • Cancel your billing subscription first. If you have an active Stripe subscription, erasure is blocked until you cancel it from the billing portal — this prevents an account being erased while still being charged.
  • No payout in flight. If a payout is currently being processed, erasure is blocked until it settles.
Erasure is permanent

Anonymisation cannot be undone, and it covers the entire workspace — every programme and all partner data, not just your login. Export anything you need to keep first.

Data export (right of access and portability, Arts. 15 and 20)​

Partners can export everything the platform holds about them from their portal settings: profile data, participant records, click events, attributed conversions, commissions, and payout history. The export is a machine-readable JSON file, generated asynchronously; the download link expires after 24 hours.

Privacy-first attribution​

Selgeo's tracking uses no cookies and no cross-site identifiers — the snippet stores attribution data in sessionStorage only, and IP addresses are stored as salted hashes. No cookie consent banner is required for Selgeo tracking. See How the snippet works for the technical details.