Data Processing Agreement
Last updated 2026-10-04
Parties and scope
This agreement forms part of the terms between ResellerGate and each approved reseller. It covers personal data that the reseller provides about its own customers or staff while using the portal, for example a customer's email address entered when assigning a product to them.
Roles
For that data, the reseller is the controller and ResellerGate is the processor. ResellerGate is a controller of its own reseller account, verification and order records, which our Privacy Policy covers.
What we do with the data
We process it only to provide the portal and deliver and support the reseller's orders, on the reseller's documented instructions (using the portal counts as instructions), and never for our own marketing.
Categories: names and email addresses of the reseller's customers and staff, and related order and support details. We do not ask for special categories of data; please do not enter them.
Confidentiality and security
Only staff who need access have it, under confidentiality obligations. We use encryption in transit, encryption of sensitive fields at rest, role-based access with two-factor authentication for staff, audit logging, private storage with no public links, and regular backups.
Sub-processors
We use Cloudflare for network security and delivery, our hosting provider for servers and storage, and an email delivery provider for notifications. We impose equivalent data protection obligations on them and will announce changes to this list on this page before they take effect; the reseller may object for a legitimate reason.
Payment providers process payment data as independent controllers under their own terms.
Personal data breaches
We notify the reseller without undue delay, and in any case within 72 hours of becoming aware of a breach affecting its data, with the information we have, and we help it meet its own obligations.
Assistance and audits
We help the reseller answer requests from people exercising their data rights, and provide the information reasonably needed to show compliance with this agreement on written request.
End of service
When the account closes, we delete the reseller's customer data within 90 days, or return it first if the reseller asks before closure, unless the law requires us to keep it (for example order and tax records).