These terms state how Metzia and a seller handle personal data under the seller agreement. Metzia is the trade name of OpenWebShop LLC, a Florida limited liability company. The seller agreement defines every other word that these terms use.
1. The roles of the parties
Metzia and the seller each decide, for their own purposes, why and how they use the personal data they hold. Each party is an independent controller of that data, and neither party processes personal data on behalf of the other.
Metzia sends the seller no personal data about a buyer. A tracked link carries a random identifier, not a name or an email address. What a buyer gives the seller on the site of the seller is the data of the seller, under the privacy policy of the seller.
When a later version of the service makes Metzia process personal data on behalf of a seller, Metzia publishes a new version of these terms first.
2. The data and the purposes
| Data | Who it is about | Why Metzia uses it |
|---|---|---|
| The name, email address, and sign in identifier of each seller user | The staff of the seller | To run the seller account and to send notices under the seller agreement |
| The listing, the affiliate program record, and the seller profile | The seller | To show the listing, rank it, and route a referral |
| Referral records: the click identifier, the product, the time, and the commission a network or the seller reports | No named person | To count referrals and reconcile commissions |
| The audit record of each staff action on the seller | The staff of Metzia and of the seller | To keep evidence of each decision on the account |
The seller does not send Metzia personal data about a buyer. A commission report names an order reference or a click identifier, and no buyer name, email address, or payment detail. When a report holds such data by mistake, Metzia deletes it.
3. Security measures
Metzia protects the data with the measures that the security policy states. These measures include HTTPS on every connection, secrets in an encrypted store, sign in through an identity provider, and an append only audit log of staff actions.
4. Subprocessors
Metzia uses the vendors on the subprocessor list to run the service. The list names each vendor, its purpose, the data it receives, and the region that hosts the data. Metzia gives each vendor only the data its job needs, under a written contract with that vendor.
Metzia gives notice 30 days before a new vendor starts to receive data. The
notice is a dated entry on the list and one email to each owner of the seller
account. GET /api/legal/subprocessors returns the same list, so a seller can
watch it for a change. A seller that objects can end the seller agreement under
its clause on term and end.
5. Breach notice
Metzia tells the seller within 72 hours after Metzia confirms a breach that affects the data in section 2 about that seller. The notice goes by email to each owner of the seller account. It states what happened, which data it affects, what Metzia did, and what the seller must do.
The seller tells Metzia within 72 hours after the seller confirms a breach that affects data the seller received from Metzia. Send that notice to security@metzia.ai.
6. Deletion when the agreement ends
When the seller agreement ends, the seller can ask Metzia to delete the data in section 2 about that seller. Send the request to legal@metzia.ai from the email address of an owner of the seller account. Metzia deletes the data within 30 days after the request.
Metzia keeps these records after a deletion:
- a record that the law requires Metzia to keep;
- a commission record, while a network or the seller can still report or reverse that commission;
- the acceptance record of each version of the seller agreement, because it is the evidence of the contract;
- the audit record of each staff action, without the email address of a seller user.
7. Requests from a person
When a person asks Metzia for access to, a copy of, a correction of, or the deletion of their personal data, Metzia answers under the privacy policy. When the request concerns data that the seller holds, Metzia tells the person to ask the seller.
8. Changes to these terms
Metzia publishes a new version of these terms with a new version date. The older version stays readable. A change that gives a seller fewer protections takes effect 30 days after Metzia sends the notice in section 4.