Privacy Policy

Definitions

• “Personal Information” or “Personal data”

  Is any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

• “Process” or “Processing”

  Means any operation which is performed upon Personal Information, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Consent

By using the Services, or registration with our website (www.selzy.com), you signify your agreement to the terms and conditions of this Policy and to our collection, use and disclosure of your personal data as set out herein. By giving your consent to us, you retain the right to have your personal data rectified, to be forgotten and/or to be erased.

You may change or withdraw your consent to the collection, use or disclosure of your personal data at any time by contacting us via email at privacy@selzy.com. In some circumstances, a change or withdrawal of consent may affect your ability to use the Services.
You also agree and accept that we may contact you by email, phone or SMS in relation to your subscription.

Privacy Laws/GDPR Compliance

Selzy is responsible for personal data under our control. We have established policies and procedures to effectively safeguard any confidential personal data that we collect and to deal with complaints and inquiries. We are committed to maintaining the accuracy, confidentiality, and security of your personal data, and we will ensure that you have access to information regarding the policies and procedures that we use to manage your personal data.

Selzy has designated a Privacy Officer/Data Protection Officer (“DPO”) who is accountable for our compliance with this Policy and for ensuring that information about our policies and practices relating to the management of personal data is easily accessible. All questions or concerns regarding this Policy and our compliance with it should be directed to the Privacy Officer in writing and sent by email or postal mail to:

ECOMZ Holding Limited
Attn: Data Privacy Officer
Gladstonos 12-14, 8046, Paphos, Cyprus
Email: privacy@selzy.com.

Every complaint or challenge regarding our compliance with this Policy will be investigated, and where a deficiency is found to exist, we will take appropriate measures to address it. This may include amending our policies and procedures as necessary. We will also cooperate with regulatory authorities to resolve any complaints that cannot be resolved between us and an individual User.

Scope

Except where otherwise indicated, this Privacy Policy applies to individuals who: (a) visit our Site, (b) use Selzy email delivery platform and related Services through the Site, Selzy API or otherwise; or (c) use any other, present or future, online or offline, programs, services, or offerings of Selzy (“Offerings”). When we refer to the “Customer” or “User” we are referring to the individual or entity that is registered with us to use the Service or Offerings. When we say “you,” we are referring to Customers and/or to some other individual who visits our Site.

Selzy provides the Services to Customers so they may provide information to, and stay in contact with their subscribers and other individuals (“Contacts”) through email. When we Process Personal Information of Contacts (“Contacts Personal Information”) on behalf of our Customers, we Process such Personal Information only as a data processor and in accordance with our Customers’ instructions. If you are a Contact of one of our Customers, you should review that Customer’s privacy policy, terms, or other notices to learn how that Customer collects and uses information about you, including through our Services. If a Customer has submitted Personal Information pertaining to you as an individual to us as Contact Personal Information and you wish to exercise any rights you may have to access, correct, port, or delete such Personal Information, please inquire with the applicable Customer directly. Because Selzy personnel have limited ability to access Contacts Personal Information, if you wish to make your request directly to Selzy, please provide the name of the applicable Selzy Customer. We will refer your request to that Customer and will support them as needed in responding to your request within the timeframe required by applicable law.

Сustomer’s Data

Personal Data Collected

1. Identity and contact details of the data processor

Personal data is collected through our Site and Services by ECOMZ Holding Limited, a company registered under the laws of Cyprus under number 309897 with its registered office at Gladstonos 12-14, 8046, Paphos, Cyprus.

2. Personal Information Collected Through our Site and the Services

Selzy collects certain Personal Information, as follows:

• Information Customers Provide to Us:

  You may provide personal information to us through the Site or Services – for example, when you subscribe to our Services, register a Selzy account, contact customer support, send us an email, or otherwise access or use Selzy. The following That Personal Information may include your email, title, first name, last name, country, time zone, Intracommunity VAT number where applicable, login & password, postal address, telephone number, IP address(es) and domain name. Selzy will also maintain your Services history and usage, record of your purchases, Selzy account balance, transactional information and any communications and responses logs.

• Information Collected Automatically Through our Services:

  By using our Services, the following Personal Information is also collected automatically and managed by us: log-in and browsing data, order history, information on subscriptions and support ticket messages, Customer’s ID with Selzy, third-party API/services integrations, API key, IP addresses, including dedicated IP usage history, browser types, log files, information on payment methods, PIN code for creating the messages, payment transaction IDs, and other information regarding Your system and connection. Some data is collected automatically by reason of your activity on the site.

  We also collect and process information regarding the performance of the Services, including metrics related to the deliverability of emails and other electronic communications You send through the Selzy platform. This information allows us to improve the content and operation of the Services, and facilitate research and analysis of the Services.

  The data you submit should not include any sensitive personal data, such as Government identifiers (i.e. social security, driving licence, or taxpayer identification numbers), complete credit card or complete personal bank card numbers, medical records or particulars connected with applications for care or treatment associated with private individuals.

  In addition, and in the context of using our services, namely creating and sending emails and campaigns, Selzy has access to the information contained in the subject and content of the emails that you send out, as well as the email contacts you send to via our services.

  This data is stored on secure servers and only a limited number of people are authorised to access your contact lists, in particular for the purpose of providing support services.

  You are easily able to recover your contact lists from your Selzy account at any time, by clicking on the “export” button. You may also modify and or delete contacts at any time from your account.

Google Workspace Data and Artificial Intelligence Features

If you connect your Google Workspace account to Selzy, we may access and process certain Google Workspace data solely for the purpose of providing, maintaining, securing, and supporting the specific functionality requested by you. Access to such data is limited to authorized personnel, subprocessors, and systems only when necessary to provide the requested services, maintain security, comply with legal obligations, or with your explicit consent.

To comply with the Google API Services User Data Policy, including the Limited Use requirements, Selzy does not use Google Workspace data obtained through Google Workspace APIs to develop, improve, fine-tune, or train generalized artificial intelligence (AI) models or machine learning (ML) models. Google Workspace data is not used for profiling, advertising, sale to third parties, or any purpose unrelated to the user-facing functionality requested by the customer.

Selzy may provide AI-powered features that assist users with creating, optimizing, analyzing, or managing marketing content and campaigns. When you use these features, Selzy may process information that you submit in order to generate the requested output. AI-generated outputs are produced automatically and may be inaccurate, incomplete, or inappropriate. Users remain responsible for reviewing and approving any AI-generated content before use.

Use of Data to Train and Improve AI-Powered Features

Selzy uses certain categories of data to develop, test, train, validate, and improve the artificial intelligence and machine learning models that power features on our platform, including send-time optimisation, subject line suggestions, campaign performance predictions, and other AI-assisted tools.

Data Used for AI Training and Improvement

The categories of data that may be used for these purposes include:

• Aggregated campaign statistics, including delivery rates, open rates, click rates, bounce rates, and unsubscribe rates at campaign level, where such data is not linked to identifiable individuals.
• Technical and behavioural usage data, including information about how users interact with the Selzy platform, features used, session data, device information, browser information, and service performance metrics.
• Subject line structural metadata, including characteristics such as length, word count, use of punctuation, use of emojis, and similar attributes, together with their correlation to campaign performance. Unless otherwise stated, Selzy does not use the full text of customers' email subject lines for AI training where such text contains personal data.
• Aggregate, anonymised, or pseudonymised analytics data derived from cookies and similar technologies, as described in our Cookies Policy.
• De-identified, aggregated, statistical, and operational data generated through use of the Service.

Data Not Used for AI Training

Selzy does not use the following categories of data for training generalized AI or ML models:

• Google Workspace data obtained through Google Workspace APIs.
• Personal data of customers' subscribers or contacts.
• Individual-level engagement records identifying whether a specific subscriber opened, clicked, replied to, or interacted with a particular message.
• The full content of emails sent through the Service on behalf of customers, except where such content has been appropriately de-identified and no longer constitutes personal data under applicable law.
• Payment, billing, or financial account information.
• Data collected pursuant to consent obtained for a different purpose.

Legal Basis

Where required by applicable law, Selzy relies on its legitimate interests under Article 6(1)(f) GDPR as the legal basis for improving, developing, testing, and maintaining its AI-powered features and services. Selzy has conducted an assessment of its legitimate interests and considers such processing proportionate and appropriately balanced against the rights and freedoms of affected individuals.

Right to Object

Where applicable law provides such right, you may object to the use of your data for AI training and improvement purposes at any time by contacting privacy@selzy.com. Upon receiving a valid objection, Selzy will assess and respond to the request in accordance with applicable data protection laws.

Certain AI-powered features may be provided through third-party service providers acting as Selzy's subprocessors. Such providers process data solely on Selzy's instructions and are subject to contractual confidentiality, security, and data protection obligations. These providers may process data in jurisdictions outside the customer's country, and where required by law, appropriate safeguards, including Standard Contractual Clauses or equivalent transfer mechanisms, are implemented.

Selzy may use automated processing to generate recommendations, predictions, classifications, insights, or similar outputs. Such processing is intended to support user decision-making and does not produce legal or similarly significant effects on individuals without human involvement.

AI prompts, inputs, outputs, and related metadata may be retained for a limited period for security, abuse prevention, troubleshooting, billing, service improvement, and compliance purposes.

Customers may choose whether to use AI-powered features and, where technically available, may disable such features through account settings or administrative controls.

Users should not submit sensitive personal data, special categories of personal data, trade secrets, or other highly confidential information to AI-powered features unless such processing is necessary for the requested functionality and permitted under applicable law and contractual obligations.

Your Contacts’ Data

As creator of the contacts and associated emails, you are considered the data controller of the Contacts Personal Information within the meaning of the GDPR, and Selzy is acting only as a data processor. In this capacity, you are responsible in particular for:

• making all the declarations necessary to the relative data protection authority,
• complying with all current regulations in force, including the data protection laws,
• obtaining the explicit consent of the Contacts concerned when collecting their personal data,
• ensuring your authority to use the personal data collected in accordance with the defined end purposes and refraining from any unauthorised use.

If a recipient of your emails sent via our services requests us to modify or delete his/her personal data, we will honor that request after proper verification and will inform you of it.

In no case does Selzy sell, share or rent out your Contacts Personal Information to third parties, nor does it use them for any purpose other than those set forth in this policy. We will use the information from your contacts only for legal requirements, to invoice and collect summaries for our own statistics and for the purposes of providing you with customer support services.

Use of Personal Data

We may use your Personal Data and information we collect through the Services for a range of reasons, which include:

• To provide, operate, optimize and maintain the Services;
• To deal with Customer enquiries and support requests, and to provide information and access to resources or services that they have requested from us;
• To manage the Selzy platform, system administration and security;
• To process and complete transactions;
• To compile aggregated statistics about the operation and use of the Services and to better understand the preferences of our Customers;
• To send our Customers technical alerts, reports, updates, security notifications and other Service-related communications;
• To process and complete transactions;
• To send You marketing communications (where this is in accordance with Your communication preferences);
• Investigate and prevent fraud, unauthorized access or use of Services, breaches of terms and policies, and other wrongful behavior;
• To carry out other legitimate business purposes, as well as other lawful purposes about which we will notify You

Legal Basis for Processing

Our legal basis for collecting and using the Personal Data described above will depend on the Personal Data concerned and the specific context in which we collect it.

However, we will normally collect Personal Data from You only where we have Your consent to do so, where we need the Personal Data to perform a contract with You, or where the processing is in Our legitimate interests and not overridden by Your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect the Personal Data in question.

If we ask You to provide Personal Data to comply with a legal requirement or to perform a contract with You, we will make this clear at the relevant time and advise You whether the provision of Your Personal Data is mandatory or not (as well as of the possible consequences if You do not provide Your Personal Data).

Similarly, if we collect and use Your Personal Data in reliance on our or a third partys legitimate interests and those interests are not already listed above (in the “Use of Personal Data” section), we will make clear to You at the relevant time what those legitimate interests are.

If You have questions about or need further information concerning the legal basis on which we collect and use Your Personal Data, please contact us using the contact details provided in “Contact Us” section below

Third-Party Platforms and Automated Messaging

The Service may integrate with third-party platforms, including social media, messaging, and communications services. Such platforms operate under their own terms, privacy notices, data handling practices, and technical limitations that are outside Selzy's control.

You acknowledge and agree that:

• Selzy may process information received from or transmitted through third-party platforms solely to provide the functionality requested by you and to operate the relevant integration.
• Selzy does not access, collect, transfer, or otherwise obtain personal data from third-party platforms except to the extent required to provide the functionality you enable, or where such information is supplied by you, your end users, or the applicable platform in connection with the requested integration.

Instagram (Meta) Integration

If you connect an Instagram Professional Account to the Service, you authorize Selzy to access and process information made available through Meta's APIs, including account identifiers, profile metadata, Direct Message content, message-related metadata (such as timestamps, sender identifiers, and delivery status), and technical credentials necessary to maintain the integration.

Selzy processes such information solely for the purpose of providing omnichannel automation features, routing and managing Instagram Direct communications on your behalf, displaying conversations within your account, maintaining the integration, and providing related customer support and service functionality.

Selzy does not sell data obtained from Meta or use such data for purposes unrelated to the functionality requested by the customer.

Customers may disconnect the Instagram integration at any time through the relevant account settings or by contacting Selzy support.

• You are solely responsible for configuring and managing any third-party platform integration, obtaining all necessary notices, consents, permissions, and legal authorizations from end users, and complying with applicable laws and the terms and privacy requirements of the relevant platform.
• Selzy is not responsible for any loss, disclosure, misuse, or unlawful processing of personal data arising from your configuration, use, or management of third-party platform integrations, except to the extent required by applicable law.

Third Party Transfers and Subprocessors

We may share and disclose Your Personal Data to our vendors and other third-party service providers who require access to Your Personal Data to assist in the provision of the Services, and other business-related functions

We use Google Analytics to provide statistics of campaigns effectiveness. This Service is our subprocessor in respect to the processing of Contacts’ Personal Information in the course of Your use of the Services. The basis for data processing is to perform the Agreement with You (in accordance with para 1 (b) Art 6 GDPR).

We use third party analytics tools, such as Bing (Microsoft Ads), Google Analytics and Amplitude, which collect and process User data when using the Service, including device ID, IP address, cookies and others. Data received by third party services is not available to us: we receive and use information from third party services only in aggregate and anonymized form. You can learn more about the data is collected by these services and the relevant privacy policies by visiting the links below:

https://privacy.microsoft.com/en-us/privacystatement
https://policies.google.com/privacy
https://amplitude.com/privacy

We use Hotjar in order to better understand our Users needs and to optimize our Service and users experience. Hotjar is a technology service that helps us better understand our Users experience (e.g. how much time they spend on which pages, which links they choose to click, what Users do and dont like, etc.) and this enables us to build and maintain our Service by means of user feedback. Hotjar uses cookies and other technologies to collect data on our Users behavior and their devices (in particular the IP address of the device (captured and stored only in anonymized form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), preferred language used to display our website). Hotjar stores this information in a pseudonymized user profile. Neither Hotjar nor we will ever use this information to identify individual users or to match it with further data on an individual User. For further details, please see Hotjars Privacy Policy. If you do not want to be recorded by Hotjar, you can disable it by setting the DoNotTrack header in your browser. For more information and more about Hotjars data processing, please visit: www.hotjar.com/legal/compliance/opt-out.

All data we obtain through analytics tools is used only to analyze how the Service, Site and social media or Internet pages are used, and to improve our products and customer-driven advertising. The objective for the use of analytics tools is to improve the quality of our Service, Site and content thereof. Through the use of analytics tools, we are able to learn exactly how the Service and Site are used, and to continually optimize the delivery of information and improve the Service. Our legitimate interest for the processing of Personal Data in accordance with para 1 (f) of Art 6 GDPR also derives from these objectives.

We use Google AdSense to display ads on our Site. Thus, some HTTP cookies are installed on your device and some information about your use of the Site is transmitted to Google, which may combine it with other data you provided to them. For more information, please visit this link.

We use AdRoll for remarketing purposes. You can opt out of remarketing AdRoll by visiting this AdRoll advertising settings page: http://info.evidon.com/pub_info/573?v=1&nt=1&nw=false/

We also use Slemma for processing statistics on the campaigns of the Customer, on the basis of and in accordance with para 1 (f) Art 6 GDPR. For more details, please refer to Slemma Privacy Policy here.

You may access the Service through Google+ and Facebook on the basis of the Agreement and in accordance with para 1 (a) Art 6 GDPR. Customer decides whether to use such services or not.

For the purposes of payment processing, we use the services of Stripe and PayPal. The basis for data processing is to perform the Agreement with You (in accordance with para 1 (b) Art 6 GDPR).

We use Intercom to facilitate communications and customer support. For more information about Intercom services and privacy policy, please check Intercom Privacy Policy here.

For the purposes of hosting and storing Customer files, we use Amazon AWS and (TET) Lattelecom, based on the agreements concluded with us. Hetzner is used as a data backup facility.

We may also share certain Personal Data collected through the Services or generated by the System (e.g. online identifiers) with third party companies so that they may offer products and services that we believe will be of interest to You or with third party advertising-serving companies to better target the adverts and other content displayed on our site and to provide offers we think may be of interest to You. You may reject the use of Your Personal Data for marketing purposes anytime by contacting us using the contact details provided in “Contact Us” section below.

Selzy does not disclose your personal data to third parties, except if: (1) you (or your account administrator acting on your behalf) requests or authorizes disclosure thereof; (2) the disclosure is required to process transactions or supply services which you have requested (i.e. to check you are employing best practice in your mailings or for the purposes of processing an acquisition card with credit-card issuing companies); (3) Selzy is compelled to do so by a government authority or a regulatory body, in the case of a court order, a summons to appear in court or any other similar requisition from a government or the judiciary, or to establish or defend a legal application; or, (4) the third party is a subcontractor or sub-processor of Selzy in the carrying out of services (for example: Selzy uses the services of an Internet provider or a telecommunication company).

International Transfers

Your personal information may be stored and processed by us in any country where we have facilities or where we engage service providers, and by reading this Policy and using the Services You acknowledge that Your Personal Data may be transferred to countries outside of Your country of residence, including the counties, which may have different data protection rules to those of Your country. Where we do so, our collection, storage and use of Your personal information will be in accordance with the purposes set out in this Policy.

Our servers and offices are located in the United States, Canada, Germany and Latvia so your information may be transferred to, stored, or processed in that countries. While the data protection, privacy, and other laws of that countries might not be as comprehensive as those in your country, we take many steps to protect your privacy. By using our Sites and Service, you understand and consent to the collection, storage, processing, and transfer of your information to our facilities in that countries and those third parties with whom we share it as described in this Policy.

We will ensure that where other non-EEA affiliates or third-party service providers have access to Personal Data outside of the EEA, that they too commit to provide the same level of protection as the GDPR principles.

Data Retention

We will retain your personal information for the period necessary to fulfil the purposes outlined in this Policy unless a longer retention period is required or permitted by law, for legal, tax or regulatory reasons, or other lawful purposes. Where we have no ongoing legitimate business need to process Your personal information, we will either delete or anonymize it or.

General Personal Data retention period is 30 days, except for the general delivery and open stats data, which are stored for at least 180 days as of the mailing date.

Selzy reserves the right to delete any non-active account, i.e. an account that has not sent any emails for a period exceeding 12 months.

Account and Personal Data Deletion

You have the right to request the deletion of your Selzy account and the erasure of your Personal Data processed by us, in accordance with Article 17 of the General Data Protection Regulation (GDPR) and other applicable data protection laws. Such deletion will result in the irreversible removal of your Selzy account and associated data, except where retention is required for compliance with legal or regulatory obligations, the establishment, exercise or defense of legal claims, or other legitimate business purposes permitted by law.

How to Request Account Deletion

Selzy account (and associated Personal Data) deletion may be initiated through one of the following methods:

(a) By logging into your Selzy account, accessing the support chat, and submitting a deletion request;

(b) By logging into your personal Selzy account, navigating to Account setup → Personal Information, and selecting the “Delete account” function; or

(c) By sending an email to privacy@selzy.com with your account deletion request.

Data Types and Retention

Upon Selzy account deletion, the following data will be processed as specified:

Data to be deleted:

• Account and profile information (name, email, preferences), as listed in “Customer’s Data” section herein above
• Contact lists and subscriber data, as listed in “Your Contacts’ Data” section herein above
• Email campaigns and templates
• Analytics and performance data
• Support tickets and communications
• Payment method information

Data retained for legal compliance:

• Transaction records and payment history (retained as required by applicable financial regulations)
• Records required for legal dispute resolution

Specific Retention Periods:

With regards to your invoices and Personal Data contained therein, we will hold them for 7 years from the invoice date due to legal obligations. We will delete all invoice data when the 7 year retention period has elapsed.

Processing Timeline

Upon receipt and verification of your request, we will process the deletion without undue delay and, in any event, within thirty (30) days, unless a longer period is required due to the complexity or number of requests, in which case you will be informed of the extension and the reasons for it. Please note that, where permitted or required by law, certain data may be retained for a limited period in order to comply with statutory obligations, resolve disputes, or enforce our agreements.

Data Security

We maintain reasonable and appropriate security measures to protect Your personal information from loss, misuse, and unauthorized access, disclosure, alteration and destruction. We will take all reasonable steps to ensure the safety of Your personal information.

We use data centers around the world from top-notch data center providers to host our systems. They have SOC2 Type 2 reports and provide all the physical security protection measures you would expect.

We understand that software security is very important. We continuously scan our applications for vulnerabilities, using a combination of static source code analysis and dynamic testing. We understand that password reuse is a killer, and offer two-factor authentication for added protection of your account. We also:

• Encrypt all your data in transit using TLS.
• Have an independent penetration test conducted on an annual basis.

Information on how Selzy keeps your data secure can be found here.

Your Data Protection Rights Under GDRP

If you are a resident of the European Economic Area (EEA), you have certain data protection rights. Selzy aims to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data.

If you wish to be informed of what Personal Data we hold about you and if you want it to be removed from our systems, please contact us.

In certain circumstances, you have the following data protection rights:

The right to access, update or to delete the information we have on you. Whenever made possible, you can access, update or request deletion of your Personal Data directly within your account settings section. If you are unable to perform these actions yourself, please contact us to assist you.

The right of rectification. You have the right to have your information rectified if that information is inaccurate or incomplete.

The right to object. You have the right to object to our processing of your Personal Data.

The right of restriction. You have the right to request that we restrict the processing of your personal information.

The right to data portability. You have the right to be provided with a copy of the information we have on you in a structured, machine-readable and commonly used format.

The right to withdraw consent. You also have the right to withdraw your consent at any time where Selzy relied on your consent to process your personal information.

Please note that we may ask you to verify your identity before responding to such requests.

Changes to This Policy

We reserve the right to change or update this Policy from time to time. If material changes are made, we will place a prominent notice on our Site or Services for at least 15 days prior to the change taking effect, or communicate with You directly by email or through the Services, and will update the last revised date at the top of this Policy. We encourage You to regularly check back on this page to ensure You are up to date with any changes.

Data Processing Agreement

Selzy offers a Data Processing Agreement based on the European Union Model Clauses, to meet the adequacy and security requirements for our Customers that operate in the European Union, and other international transfers of Customer’s Data. Selzy Data Processing Agreement is available for signature here.

Contact Us

If You have any questions or concerns regarding the use or disclosure of Your personal information through the Services, You can contact us by sending an email to privacy@selzy.com or sending an official request to the address below:

Ecomz Holding Limited
Gladstonos 12-14, 8046, Paphos, Cyprus
Email: privacy@selzy.com