EU Seller KitLegal page

Privacy policy

Last updated: 2026-09-24

1. Data controller

The data controller is PRIME NEXUS INTERNATIONAL, contactable at contact@eusellerkit.com. See the legal notice for full contact details.

2. Data collected and purposes

Diagnostic

  • Questionnaire answers: calculation of the EORI, VAT, IOSS or GPSR diagnostic. Legal basis: legitimate interests.
  • Email address: sending and saving the result when requested by the user. Legal basis: consent.

Account, applications and catalogue

  • Business data: company name, tax and customs identifiers, address, contact details and supporting documents required for the service.
  • Product data: descriptions, manufacturers, materials, documents, images and data synced from a connected store.
  • Legal basis: performance of the contract or pre-contractual steps requested by the user.

Payment

We retain transaction identifiers, the plan or service purchased, the amount and payment status. Card data is processed exclusively by Stripe and never passes through our servers. Legal basis: performance of the contract and accounting obligations.

Usage measurement

We record technical and functional events (for example, a completed diagnostic, created application or generated PDF) to operate, secure and improve the service. Legal basis: legitimate interests.

3. Retention periods

  • Empty customer accounts are deleted after 3 years of inactivity. Applications and contract-related data are retained as needed to provide the service, handle claims and comply with applicable law.
  • Invoices and accounting data: 10 years.
  • Documents retained under the GPSR: for the applicable statutory period, which may be up to 10 years.
  • Technical and security logs: up to 12 months, unless an incident requires longer retention.

4. Recipients and processors

  • OVH SAS — hosting of the service and database.
  • Stripe Payments Europe Ltd. — payment processing. Certain transfers may be covered by the EU-US Data Privacy Framework.
  • lws — sending transactional emails.
  • OpenAI, only when artificial-intelligence features are enabled: processing data submitted to those features to produce the requested result.
  • Google Ireland Ltd. and Google LLC: audience measurement with Google Analytics 4 and advertising conversion attribution with Google Ads. Google cookies and identifiers are only used after consent. Before you choose, or if you decline, Google tags may run in “consent denied” mode (Google Consent Mode v2): no cookie is read or written and only identifier-free signals (page viewed, completed action, timestamp, device type) are sent, for aggregated statistical modelling. Transfers outside the EEA may occur under the safeguards offered by Google.
  • Microsoft Ireland Operations Limited and Microsoft Corporation, only after marketing consent: visit measurement and conversion attribution through the Microsoft Advertising UET tag (Bing Ads). Transfers outside the EEA may occur under the safeguards offered by Microsoft.
  • Reddit, Inc. and its applicable affiliates, only after marketing consent: visit measurement and conversion attribution through Reddit Pixel. Transfers outside the EEA may occur under the safeguards offered by Reddit.

We do not sell personal data.

5. Your rights

Subject to the conditions of the GDPR, you may request access, rectification, erasure, restriction, objection or portability of your data, and withdraw consent at any time. Contact contact@eusellerkit.com. You may also lodge a complaint with the CNIL.

6. Cookies

The service uses cookies strictly necessary for sign-in, security and remembering preferences. With your prior consent, Google Analytics 4 may measure viewed pages and successful actions. With your separate marketing consent, Google Ads, Microsoft Advertising (Bing Ads), and Reddit Ads may measure visits and attribute leads, sign-ups, and purchases to advertising campaigns. With this marketing consent, when you sign up, submit a request or pay, and while you are signed in, an irreversible fingerprint (SHA-256 hash) of your email address and customer ID may be sent to Google Ads, Microsoft Advertising and Reddit Ads to attribute the conversion to a campaign (“enhanced conversions”, “advanced matching”); the clear-text address is never sent. Form contents and names are not sent in measurement events.

The “audience measurement” and “marketing and conversions” categories are disabled by default and can be accepted or rejected separately. You can withdraw or change consent at any time using the “Cookies” link in the footer. Your choice is stored for 180 days.

7. Security

We apply appropriate technical and organisational measures, including encrypted communications, access controls and protection of integration secrets and credentials.

8. Updates

This policy may change to reflect legal, technical or functional developments. The update date appears at the top of the page.