1. Who we are
OctoMarkets (octo.markets) is part of Geenen ict BV, established at Sint Jansstraat 19, 6071 JG Swalmen, the Netherlands, registered with the Dutch Chamber of Commerce (Kamer van Koophandel) under number 87555840 (VAT: NL864328837B01). OctoMarkets connects webshops to online marketplaces and manages product listings, stock, prices, orders and returns on behalf of our customers (merchants).
Questions about this policy or about your data: privacy@octo.markets, telephone +31 851 091 065.
2. What data we process, and why
a. Data of our customers (merchants). Name, business contact details, login credentials for the OctoMarkets portal and the integration credentials (API credentials) of their shop systems and marketplace accounts. Purpose: delivering the service, support and invoicing. Legal basis: performance of the contract.
b. Product data. Catalogue, stock and price data from the merchant's shop. As a rule, this is not personal data.
c. Order data: personal data of buyers. In order to pass orders from marketplaces and webshops through to the merchant's systems, we process per order: the buyer's name, delivery and billing address, telephone number and (often masked by the marketplace) email address. We process this data solely on the instructions of the merchant (we are the processor; the merchant and the marketplace are the controllers) and solely for order processing, shipping, cancellation and returns handling. We never use this data for marketing, profiling or automated decision-making, and we never sell data to third parties.
d. Website visitors (octo.markets). We use anonymised statistics to improve our website. In addition, we may place marketing cookies (e.g. Google Ads) for conversion measurement and advertising, but only with your consent via the cookie banner; you can change your preferences at any time via “Cookie settings” at the bottom of the page. If you complete the contact/scan form, we process the company and contact details you provide in order to answer your request. Legal basis: consent (marketing cookies), legitimate interest (statistics) and pre-contractual measures (form) respectively.
3. AI processing
OctoMarkets uses AI to enrich product information and to build and validate marketplace integrations (e.g. product texts, translations, category assignments). This AI processing concerns product data: personal data of buyers is not submitted to AI models and is not used to train models.
4. Recipients and subprocessors
We share data only in so far as necessary for the service:
- Marketplaces and shop platforms that the merchant connects (e.g. bol, About You, Zalando, Shopify). They are independent controllers for their own platforms.
- Google (advertising and conversion measurement): only if you give consent for marketing cookies via the cookie banner. For this processing, Google is an independent controller.
- Subprocessors (hosting and infrastructure): Supabase (database, EU), DigitalOcean (application hosting and storage, EU), Vercel (web hosting), Temporal (process orchestration; receives technical IDs only, no personal data), Hookdeck (webhook delivery), Postmark (transactional email), Anthropic (AI processing of product data). Data processing agreements have been concluded with subprocessors; processing takes place within the EU/EEA or under appropriate safeguards (EU Standard Contractual Clauses).
5. Retention periods
We do not retain personal data for longer than is necessary for the purpose:
- Order data of buyers: for as long as necessary for order handling and for providing the service to the merchant. On termination of the integration, or at the request of the merchant or the platform (e.g. a deletion request via Shopify), the data is deleted; such requests are processed and logged automatically.
- Customer data (merchants): for the duration of the contract and thereafter only for as long as statutory (tax) retention obligations require.
- Form submissions: a maximum of 12 months after handling.
6. Security
Encrypted connections (TLS) for all data traffic; storage in managed European data centres with encryption at rest and encrypted backups; strict access restriction (only authorised systems and named personnel, with strong passwords and two-factor authentication); logging of access; separated test and production environments; a documented incident response policy. We report data breaches to the Dutch data protection authority (Autoriteit Persoonsgegevens) and to the customers concerned in accordance with the GDPR.
7. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. Buyers of a webshop or marketplace exercise these rights with the shop or marketplace concerned (the controller); we support our merchants in handling them. Merchants and website visitors can contact us directly via privacy@octo.markets. You may also lodge a complaint with the Dutch data protection authority (Autoriteit Persoonsgegevens).
8. Changes
We may amend this policy; the current version is always available at octo.markets/privacy with the date of the most recent change.