Play your partSUPPORTLOGINGET STARTED →
EXPLOREWHY GRAJAGENTSLEARNFEESPIONEER
GETREADYANDJUMP.COM · BUILT IN DETROIT
Guide

DATA PRIVACY
FOR SELLERS.

Reference

The moment you sell to a consumer you are processing personal data, and the rules follow the person rather than your address. A brand in one country selling to a customer in another is subject to the customer's law, which is the part that surprises people.

What to know
The obligations that apply almost everywhere
The details differ by jurisdiction; the shape does not. Collect what you need, say what you are doing with it, keep it safe, and let people see and delete it.
  • A lawful basis for processing, decided before you collect
  • A privacy notice that says what you actually do
  • Access and deletion requests answered within a deadline
  • Breach notification, often within 72 hours
Transfers across borders
Moving personal data out of the EU or the UK needs a specific legal mechanism. Using a US-hosted tool for European customer data is a transfer, whether or not it feels like one.
Wholesale is not exempt
Business contacts are still people. A buyer's name, work email and phone number are personal data in most regimes, and a marketing list built without a basis is the most common enforcement case.
The practical minimum
Know what you hold and why, do not collect what you will not use, and be able to find everything about one person when they ask. Most of the cost of compliance is retrofitting it onto data you never mapped.
Where to go next
GRAJ

READY TO
RUN YOUR GAME ON GRAJ.

Free to join. Participants keep 95% of every transaction; GRAJ takes 5%. Built for 195 countries — payments live in the United States.