Information notice for sellers (English)

Version 1.5 · Other languages: FRDEESIT

Version 1.5, 1er octobre 2026. Available in French, English, German, Spanish and Italian; the English version is also intended for sellers on marketplaces located outside Europe. In case of divergence, the French version prevails.

You sell on an Amazon marketplace in France, Germany, the United Kingdom, Spain, Italy, the United States, Canada, Japan, Mexico, Brazil or India. We observe that marketplace and we keep information about your selling activity. This notice tells you which information, where it comes from, how long we keep it, and how to object to it. We did not ask you for it: we obtained it indirectly, and Article 14 of the GDPR therefore requires us to inform you.

Who processes this data

WhoHeld, société par actions simplifiée unipersonnelle, 49 cours Mirabeau, 13100 Aix-en-Provence, France, Trade and Companies Register (RCS) Aix-en-Provence 130 164 783, publisher of the WhoHeld service.

Write to us at privacy@whoheld.com, in French or in English.

What we keep

  • your trading name and your seller identifier on the marketplace;
  • your country of establishment, not your address;
  • your public rating and the number of public reviews;
  • your fulfilment method (shipped by the marketplace or by you);
  • the prices you have displayed over time on the tracked products, and the characteristics of your offers (condition, minimum quantity, pre-order, country of dispatch);
  • calculated indicators: share of time during which you held the Buy Box, number of competitors facing you, catalogue size, brands distributed, dates of first and last observation.

No personal contact details retained or used. Your full postal address, if present in our data provider's technical response, transits in memory during processing: we retain only the country (line above), and everything else is discarded before any database write and is never used. No email address or phone number is retained or used. No data about your private life, no sensitive data.

Where it comes from

From publicly accessible sources: the product pages and seller pages of the marketplaces, as they are displayed to any visitor.

We do not browse these pages ourselves. We obtain them through the programming interface of a specialised market data provider, which collects them and which is, for its own collection, an independent controller. We add no other source: no register, no social network, no purchased file.

Why

To produce, for business customers, analyses of competition on marketplaces: who held the Buy Box, at what price, for how long, in which countries.

Legal basis: our legitimate interest (Article 6(1)(f) of the GDPR) and that of our customers, which is to understand a market on which they sell, based on information that sellers expose publicly there. We have weighed this interest against your rights; the outcome is available on request. The public nature of this information is not, on its own, sufficient for us: it is one element of the balancing test, not an exemption.

Who receives it

Our business customers, only in the form of analysis results and under a contractual prohibition on opening automated access to a third party; the third parties to whom they are contractually authorised to disclose results (companies in their group, advisers, e-commerce agencies and service providers, contacts within the marketplaces): these are always processed results, never the raw data or anything from which it could be reconstructed, and those third parties are bound by equivalent confidentiality; our technical service providers (hosting, database, email sending, email messaging, artificial intelligence analysis on pseudonymised data and on the questions asked by our customers), who act on our instructions; the competent authorities, upon lawful request. We neither sell nor rent this data.

Where it is processed

Hosted in the European Union. Observing a marketplace located outside the Union is not a transfer: the data is collected into the Union and hosted there. Three of our providers are established outside the European Union (Supabase Pte. Ltd. in Singapore; Resend and Vercel Inc. in the United States) and may access it from those countries; a fourth, Anthropic Ireland, Limited (Ireland), has the data processed in the United States by its parent company, Anthropic, PBC. Anthropic, which helps us analyse the data with artificial intelligence, processes what we send it in the United States: of our data, it only receives pseudonymised data, without your name or country; a customer may, however, mention your name in a question it asks our assistant, and that question is transmitted as it was typed. Our email exchanges, including your requests, go through Google Workspace (Google Cloud France SARL), which may process them outside the Union. These transfers are governed by the European Commission's standard contractual clauses (Decision (EU) 2021/914). Ask us for a copy of the safeguards at privacy@whoheld.com.

For how long
Name, country 24 months after the last observation, then erased
Seller identifier, dates of first and last observation 36 months rolling: the identifier is the key that links the data below, and it goes when they do
Buy Box holding, shares, prices linked to you, fulfilment method, characteristics of your offers 36 months rolling
Profile indicators (rating, reviews, catalogue, brands) 12 months, replaced at each update, with no history
Mentions of your name in the questions our customers ask our assistant and in the answers kept in its log 12 months after they are recorded, then deleted

After that, the data is deleted or aggregated in such a way that you can no longer be identified.

Automated analysis

We analyse your public selling activity to derive indicators from it: this is profiling within the meaning of Article 4(4) of the GDPR, limited to that activity. We take no automated decision concerning you, and none of our indicators is designed to constitute, on its own or in a determining way, the basis of a decision producing legal effects concerning you or similarly significantly affecting you (Article 22). Our indicators help professionals decide; they trigger nothing concerning you.

▶ Your right to object

You can ask us to stop processing your data. It is free of charge, requires no form, and requires no justification other than stating the grounds relating to your particular situation (Article 21(1) of the GDPR).

Write to privacy@whoheld.com with your seller name and the marketplace concerned.

  1. We acknowledge receipt and, if you request it, we freeze the processing while it is examined (Article 18(1)(d)).
  2. We may continue only if we demonstrate compelling legitimate grounds which override your rights, or the need to keep the data for the establishment or defence of legal claims. Otherwise, we stop.
  3. If we stop: we erase your identifying data, we prevent it from being reintroduced in subsequent collections, and we notify each of our recipient customers, who relay the information to the third parties to whom they have passed results still identifying you, where that relay is reasonably possible (Article 19). Mentions of your name in the questions asked by our customers and in the answers kept in the log are deleted no later than twelve months after they are recorded.
  4. We reply within one month, extendable by two months for a complex request, in which case we tell you.

Your other rights

Access (receiving a copy of what we hold), rectification, erasure, restriction of processing: same address, same time limits. The right to data portability does not apply here: it presupposes processing based on your consent or on a contract concluded with you.

We may ask you for evidence establishing the link between you and the observed seller account: for example a reply sent from the contact address published by the marketplace, or a certificate of registration (Article 12(6)). We keep these elements only for the time needed to handle your request.

Complaint

You may lodge a complaint with the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr) or with the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement (Article 77 of the GDPR). In the United Kingdom: the Information Commissioner's Office.

Updates

This notice is published permanently and free of charge. Any substantial change (a change of purpose, retention period or recipients) is published here before it takes effect.