Privacy statement

Our role

For this website, the contact form and user accounts, Section11 is the controller.

For the data our customers bring into the platform, such as product, offer and order data, the customer is the controller and we process that data on its behalf, under our agreement with that customer.

This website

This website uses no analytics, no tracking and no advertising cookies, and loads nothing from other parties: fonts and images come from our own server.

When you visit a language section, the site sets a functional cookie, s11_lang. It holds only the language code, so your next visit opens in that language, and it expires after one year.

The contact page sets one more functional cookie, s11_form. It holds only the time you opened the page, so we can recognise a form sent by a bot within seconds, and it expires after one day.

To deliver pages and protect the site against abuse, our server processes your IP address and browser details. Technical logs that may contain them are kept for a short period for security and troubleshooting.

The contact form

When you send the form we receive your name and email address and, if you fill them in, your phone number, company, marketplaces and message. We use them only to answer your request and, if you want one, to arrange a demo. The legal basis is taking steps at your request before a possible agreement.

Your request is delivered to our team's Slack workspace. We do not store it anywhere else, and we delete it when we no longer need it to handle your request, at the latest twelve months after our last contact unless it leads to an agreement.

Using the Section11 platform

For your user account we process your email address, a hashed version of your password, your language preference, your role and the accounts you have access to. We need these to provide the service under the agreement with your organisation.

We keep a record of activity, such as changes to members and roles, data access, imports, enrichments and pushes, and of AI usage per account, to run, bill and secure the service and to help you when you ask for support. Each activity record contains your email address, IP address and browser details. We keep these records as a security and accountability trail, also after an account is deleted, for as long as that purpose requires.

Catalogue, offer and order data that your organisation imports is processed on its behalf. Order data is reduced on import to limited buyer details (email address, postcode and city), which we store encrypted and use only to provide the service.

Marketplace credentials you enter are stored encrypted and are used only to connect to the marketplaces you choose.

AI processing

To generate and check product content, Section11 sends product information to the AI model provider DeepInfra. We send the product data the task needs, not your account details. The results are stored in your account, and nothing is published to a marketplace until you or your organisation chooses to.

Claude, ChatGPT and other AI assistants

You can connect Section11 to an AI assistant such as Claude or ChatGPT. The assistant can then read data from the accounts you grant, within your permissions in Section11, and it takes an action only after you confirm it. You can revoke the connection at any time.

What you type into the assistant and the answers it gives are processed by the assistant's provider, such as Anthropic or OpenAI, under that provider's own privacy policy. To secure the connection and support you, we record which tools the assistant used, for which account, a short summary of what it asked for, the outcome (not the content of the answer), and the IP address and browser details of the connection. We also store your consent and the access tokens of each connected assistant, in hashed form.

The Section11 plugin for Claude only adds instructions for the assistant. It contains no code that collects data, and it uses the same connection.

Who receives data

We use the following processors, bound by data processing agreements: UpCloud for hosting, the database and file storage, in Amsterdam, the Netherlands; DeepInfra for AI models, in the United States; and Slack for delivering contact requests, in the United States.

When you connect a marketplace, we send it the data you choose to publish, on your instruction. We do not sell personal data.

Transfers outside the European Union

DeepInfra and Slack are based in the United States. Where personal data is transferred there, we rely on a safeguard the GDPR recognises, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

How long we keep data

Account data is kept for as long as your account exists and is deleted after the agreement with your organisation ends, except the activity records described above, unless the law requires us to keep it longer, such as invoices, which Dutch tax law requires us to keep for seven years.

Customer data is kept as agreed with the customer and deleted after the agreement ends.

Security

Data travels encrypted over HTTPS. Passwords are stored hashed and marketplace credentials encrypted. Access within the platform follows the roles your organisation assigns, and only staff who need it for support or operations can see customer data.

Your rights

You can ask us for access to, correction or deletion of your personal data, ask us to restrict or stop processing it, or ask for a copy to take elsewhere. Email hello@section11.com and we will respond within one month. If your data was imported by one of our customers, we pass your request on to that customer.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the authority in your own country.

Changes

We update this statement when our processing changes. The date at the top shows when it last changed.