Internal Data Protection Policy

1. Purpose and scope

This policy sets out how Seba Agency complies with the GDPR and the German Federal Data Protection Act (BDSG) in everyday work. It applies to everyone working for Seba Agency and to all personal data we process: client and prospect contact data, website visitor data, and data we process on behalf of clients, including the TikTok Shop creator and affiliate integration.

2. Our roles

• Controller (Art. 4(7) GDPR) for our own processing: website, sales and client communication, accounting, and our own team and contractors.
• Processor (Art. 28 GDPR) when we process personal data on behalf of a client, for example when operating the TikTok Shop integration for a seller. In that case we act only on the client’s documented instructions under a data processing agreement (DPA / AVV), and use data received from TikTok only as TikTok’s terms allow.

3. Principles (Art. 5 GDPR)

• Lawfulness and transparency: every processing activity has a legal basis and is described in a privacy notice.
• Purpose limitation: data is used only for the purpose it was collected for.
• Data minimisation: we collect only what we need. The TikTok integration processes creator usernames and IDs, order IDs, SKU quantities and commission amounts, and no buyer personal data.
• Accuracy: incorrect data is corrected without delay.
• Storage limitation: data is deleted according to the Data Classification and Handling Policy.
• Integrity and confidentiality: data is protected according to the Information Security Policy.
• Accountability: we document what we do so we can demonstrate compliance.

4. Records and contracts

• We keep a record of processing activities (Art. 30 GDPR) for our own processing and, separately, for processing we carry out on behalf of clients.
• We sign a DPA with every client for whom we process personal data and with every supplier that processes personal data for us.

5. Processors we use

Clients are informed before a new sub-processor is used for their data, as agreed in the DPA.

6. Transfers outside the EU/EEA

Personal data is transferred outside the EU/EEA only where an adequacy decision applies (including the EU-US Data Privacy Framework for certified companies) or Standard Contractual Clauses are in place.

7. Data subject requests

• Requests for access, rectification, erasure, restriction, portability or objection sent to info@sebaagency.com are logged and answered within one month (Art. 12(3) GDPR).
• Where we act as processor, we forward the request to the client within 3 business days and help the client fulfil it, for example by correcting or deleting a creator’s data in n8n and Notion.
• We verify the requester’s identity before disclosing any data.

8. Data Protection Officer

Under § 38 BDSG, a Data Protection Officer is required once at least 20 people are regularly engaged in the automated processing of personal data, or where processing requires a data protection impact assessment or consists of commercial data transfer. Seba Agency currently falls below these thresholds and is not required to appoint a DPO. The Managing Director is responsible for data protection and is the contact for data protection matters: Joshua Omosebi, info@sebaagency.com. This is reassessed whenever the team grows.

9. Confidentiality and training

Everyone with access to personal data signs the confidentiality commitment in the Annex before receiving access, and receives a short data protection and security briefing at onboarding and once a year.

10. Privacy by design

Before a new workflow or integration goes live, we check: which data it uses and why, whether that is the minimum, where it is stored, who can access it, and when it is deleted. Where processing is likely to result in a high risk, we carry out a data protection impact assessment (Art. 35 GDPR).

11. Data breaches

Data breaches are handled and reported according to the Incident Response and Breach Notification Policy.

12. Review

This policy is reviewed annually and whenever we start a new type of processing.

Annex: Confidentiality commitment

I commit to keeping confidential all personal data and confidential information I access while working with Seba Agency UG (haftungsbeschränkt), to process it only as instructed and for the purpose of my work, and to follow the company’s data protection and information security policies. This commitment continues after my engagement ends.