1 Scope and instructions
Seller determines the lawful purposes of its goods sales, fulfilment, customer service and statutory business records. ReelMart supplies storage, catalogue/order administration, communications and integration functions for those activities as instructed through the agreement and authorised feature use. ReelMart independently determines its own account administration, billing, fraud/security and legal-compliance processing, explained in the Privacy Policy.
| Processing detail | Scope |
|---|---|
| People | Buyers, recipients, seller representatives, authorised staff and support contacts |
| Data | Names, contacts, addresses, order/return details, relevant transaction references and support correspondence |
| Operations | Receive, store, organise, retrieve, transmit to authorised recipients, support, export and delete as necessary for the enabled service |
| Duration | Contract term and limited exit, retention or legal-hold period for the specific purpose |
| Instructions | The accepted agreement, enabled settings and lawful written instructions from authorised Seller personnel |
Seller must not upload unnecessary sensitive data, identity documents or payment secrets into customer notes or product/AI fields. New categories or purposes require an appropriate assessment and, where required, amended instructions and notices.
2 Seller responsibilities
Seller must supply a clear privacy notice, establish a lawful ground and obtain required consent before collecting, importing or messaging people. Seller is responsible for the lawful source of imported lists and may not assume that possession of a phone number authorises marketing. Seller must restrict staff access, use secure devices, protect exports, respect retention limits and answer requests concerning its independent processing.
Seller must not instruct ReelMart to access another store's records or misuse personal data. ReelMart may suspend an apparently unlawful instruction and explain why, unless prohibited by law.
3 ReelMart responsibilities
For processing on Seller's behalf, ReelMart will act on documented lawful instructions; limit access to authorised personnel under confidentiality duties; maintain reasonable security appropriate to the data and risk; and avoid using the information for unrelated advertising, sale or model training. Disclosure required by law is permitted, with notice to Seller where lawful.
ReelMart will reasonably assist Seller with access, correction, deletion, consent-withdrawal and regulatory requests, considering the processing and information available. Neither party may delete legally preserved evidence merely because the other requests it. If a request involves ReelMart's independent processing, ReelMart will handle that part itself.
4 Providers and transfers
Seller authorises providers reasonably necessary for the enabled service, subject to appropriate written privacy/security obligations. ReelMart remains responsible for its contracted processing obligations when using such providers. An independent payment provider or carrier may have its own statutory role rather than acting only as a subprocessor.
ReelMart will maintain and make available an up-to-date provider register stating name, function, relevant locations and role. Material new subprocessors for Seller-controlled processing will be notified at least fifteen days in advance where practicable. Seller may raise a reasonable data-protection objection; parties will seek a workable alternative. If none exists, Seller may stop the affected optional feature or terminate the affected service with a proportionate unused-fee refund where appropriate.
Cross-border processing must meet applicable transfer restrictions and safeguards. An India-only processing commitment applies only where expressly agreed for the relevant service and its providers.
5 Incidents and cooperation
Either party discovering a confirmed or reasonably suspected personal-data breach affecting the other's relevant records will notify the other without undue delay and, where feasible, within twenty-four hours of awareness. An initial notice may be incomplete; follow it with the known scope, likely impact, containment, contact and updates. This contractual target does not extend any shorter statutory reporting period.
Parties will preserve relevant evidence, contain harm and coordinate notices, without delaying an independent legal duty to notify authorities or affected people. Neither may make misleading assurances or admissions on behalf of the other. Each bears costs according to responsibility, agreement and law.
6 Assurance exit and deletion
On a reasonable request, ReelMart will provide relevant information about its safeguards and compliance with these terms. Where insufficient, parties may agree a proportionate confidential audit, normally no more than annually unless an incident or regulator requires more. Audits must protect other customers' data and security and must not involve unauthorised penetration testing. No unsupported certification is implied.
At exit, Seller may request an available-data export within thirty days. ReelMart will then delete or return data processed solely for Seller when no longer needed, except lawful retention, dispute holds and controlled backups. Retained data remains protected and restricted to its continuing purpose. Seller must likewise delete unnecessary downloaded records. Request deletion confirmation through support; backup expiry and retained categories should be explained.
The accepted agreement's liability provisions apply to the extent lawful. Nothing transfers a regulator's statutory powers or allows either party to contract out of its own legal duties.