Sage Marketplace Privacy Notice

Last Updated: 13 January 2020

1. About this Notice

This Privacy Notice (“Privacy Notice”) sets out how we handle the information we collect about you (“Personal Data”). Please read this Privacy Notice carefully as it describes the types of Personal Data that we collect, the purposes for which we use it, the types of third parties with which we share it, and any rights you may have with respect to such Personal Data.

This Privacy Notice applies only when you visit the online marketplace operated by us (“Sage Marketplace”), through which we and third parties make products and services available for purchase (“Applications”), or when you contact us, for example with a comment, query or request for support in respect of the Sage Marketplace or Applications. Other Sage services such as websites, products, services or applications may be covered by different privacy notices.

Your use of the Sage Marketplace and any information you provide through it is subject at all times to this Privacy Notice, the Sage Marketplace Terms (or a localised version of such terms) and our Cookies Policy.

If you are accessing and/or using the Sage Marketplace on behalf of another person, company, entity or organisation whether in your capacity as an officer, director, employee, consultant, agent or otherwise) (“Subscriber”), you represent and warrant that you have the authority to act on behalf of the Subscriber and that you have provided this Privacy Notice to the Subscriber, and for the purposes of these Terms “you” and “your” shall include such Subscriber.

Where you provide us with or we collect your personal information in any of the ways described in this Privacy Notice, we may collect, store and use it: (a) in order to perform our contractual obligations to you; (b) to comply with our legal obligations; (c) based on our legitimate interests for processing (i.e. for internal administrative purposes, data analytics and benchmarking, direct marketing, maintaining automated back-up systems or for the detection or prevention of crime); or (d) based on your consent, which you may withdraw at any time, as described in this Privacy Notice.

2. Who collects and controls your Personal Data?

Unless, stated otherwise in this Privacy Notice, the data controller of your Personal Data is:

(i) Sage Global Services Limited, in respect of the operation and provision of the Sage Marketplace; and

(ii) any applicable Sage entity described the schedule to this Privacy Notice, where you purchase an Application,

and for the purposes of this Privacy Notice, “Sage”, “we”, “us” or “our” shall be construed accordingly.

The portals and websites which make up the Sage Marketplace are hosted by AppDirect Inc (“AppDirect”) on our behalf, who is an independent data controller in respect of any Personal Data it collects pursuant to its own privacy notice hosted at https://www.appdirect.com/about/privacy-notice.

3. What Personal Data do we collect and how do we collect it?

We collect your Personal Data in three ways:

(i) Personal Data you voluntarily provide

Registration and account information: If you register to use the Sage Marketplace, set up an account and/or purchase Applications, we will ask you to provide information such as your title, name, address, telephone number and email address.
Payments: If you make payments for Applications through the Sage Marketplace, we will ask you to provide your payment information, such as your credit card number or bank account details so that we can process your payment.
Communications: We may collect information you provide if you interact with other users through the Sage Marketplace (for example, reviews of Applications or participation in any forums). We may also collect information through your communications directly with us, for example, with our customer support team.
Enquiries: If you make an enquiry or express an interest in respect of an Application, or request to be referred to a third party to make such an enquiry or expression of interest, we will ask you to provide information such as your title, name, address, telephone number and email address.
Surveys: If you voluntarily submit certain information to us by filling out a survey about the Sage Marketplace, any Applications, your user experience or otherwise, we will collect the information you have provided as part of that request.

(ii) Personal Data we collect through your use of the Sage Marketplace

We automatically collect certain technical information through your use of the Sage Marketplace from your device (e.g. your computer or mobile phone).

Device and Usage Information: This is information that is automatically generated as you use the Sage Marketplace. It may include Personal Data such as IP Address, information about the device or browser you are using to access the Sage Marketplace, the website or URL you visited us from and the third party sites you visit when you click on links to exit the Sage Marketplace.
Cookies: When you use the Sage Marketplace, we may send one or more cookies to your computer or use similar tracking technologies (“Cookies”). More information about our use of Cookies can be found under the “Do we use cookies or similar technologies?” section below and our Cookies Policy. This helps us to ensure the Sage Marketplace works properly and to improve your experience.

(iii) Personal Data we receive from third parties

We may receive Personal Data from third parties depending on how you choose to interact with the Sage Marketplace. This includes Personal Data from third parties who sell Applications via the Sage Marketplace, AppDirect and our business partners who resell Applications to their customers or introduce customers to us. Such Personal Data may then be combined with other Personal Data we already hold. We only use Personal Data supplied by a third party where we are legally permitted or required to do so.

4. Why do we process your Personal Data and on what legal basis?

The ways in which we may process your Personal Data and the legal basis upon which rely on are set out below:

(a) Personal data which is necessary for the performance of the services we provide to you.

Services. We may use your Personal Data to deliver services to you or carry out transactions you have requested, including, but not limited to:

(i) facilitating the use of the Sage Marketplace;
(ii) processing orders for Applications;
(iii) provisioning Applications you have purchased to you;
(iv) referring you on to third parties to enquire about, and/or purchase Applications; answering customer service requests;
(v) displaying reviews, images and other content and media you submit to us or upload to the Sage Marketplace; and
(vi) maintaining and administering your account with us and ensuring it is kept up to date and is accessible.

Communications. We use your Personal Data to communicate with you, in accordance with your communication preferences. For example, we will use the email address you have supplied to contact you for information purposes such as account management, customer service, or system maintenance.

(b) Personal Data which is necessary to comply with our legal obligations.

We may use your Personal Data to comply with our legal obligations, including compliance with applicable laws, regulations, requests from the government or other regulatory bodies or court orders.

(c) Personal Data which is necessary to meet our legitimate interests.

Analytics. We may also use your Personal Data to improve your experience of the Sage Marketplace, Applications and other products and/or services. We use such Personal Data to understand and analyse the usage trends and preferences of our users, to improve the way the Sage Marketplace works and looks, and to create new features and functionality. For example, we may use the Personal Data collected to: (a) personalise our services, such as remembering your information so that you will not have to re-enter it during your visit or the next time you use the Sage Marketplace; (b) monitor aggregate site usage metrics such as total number of visitors and pages viewed; and (c) help us identify potential new products and services.

Fraud prevention and other infringements. We may use the personal information we collect to detect, prevent and respond to fraud, intellectual property infringement, violations of our terms and conditions, violations of law or other misuse of the Sage Marketplace.

(d) When we have your consent.

Marketing. We may use Personal Data for marketing purposes, such as providing you with promotional or advertising materials that may be useful, relevant, valuable or otherwise of interest to you, in accordance with your marketing preferences, including customised third party advertisements, content and information. We may also monitor and analyse the effectiveness of such marketing activities. Where required under applicable law, we will obtain your prior opt-in consent to send you electronic marketing communications. You will have the ability to opt-out of receiving any such communications, either through unsubscribe links provided in communications, by updating your account preferences, or by contacting us using the contact details provided at the end of this Privacy Notice.

5. When is your Personal Data shared with or collected by third parties?

We share your Personal Data only where you ask us to, where it's a necessary part of doing business with you and providing you with the services, or where we need to for legal reasons.

Where you purchase, or you make an enquiry about, an Application which is provided by a third party (“ISV”), we will share your Personal Data with the ISV who will collect and process your Personal Data in accordance with their own privacy notices and policies.

We share your Personal Data with AppDirect, who hosts the Sage Marketplace on our behalf. AppDirect is an independent controller in respect of such Personal Data and processes such Personal Data pursuant to its own privacy notice hosted at https://www.appdirect.com/about/privacy-notice.

We share your Personal Data with providers of tracking tools and data aggregation and analytical software services that enable us to carry out the ‘Analytics’ referred to in paragraph 4(c) of this Privacy Notice and to otherwise effectively monitor and optimise the delivery of our services.

We share your Personal Data with payment processors engaged by us to securely store and handle payments information, such as credit card and debit card details, required to purchase Applications – for example. When you provide us with your credit or debit card details, we store these in a PCI-compliant data vault provided by a third party payment processor.

We may also share your data with our other group companies, including The Sage Group plc and the companies set out in the schedule to this Privacy Notice, for the purposes set out in this Privacy Notice.

6. How long do we store your Personal Data?

We may retain your Personal Data for a period consistent with the original purpose of collection (see the "Why do we process your Personal Data and on what legal basis?” section above). We determine the appropriate retention period for Personal Data on the basis of the volume, nature and sensitivity of your Personal Data processed, the potential risk of harm from unauthorised use or disclosure of your Personal Data and whether we can achieve the purposes of the processing through other means, as well as on the basis of applicable legal requirements (such as applicable periods in which legal claims may be brought).

Retention periods are set as a baseline, based on statutory/regulatory provisions and relevant limitation periods. They can be adjusted by Sage as needed to address local laws and regulations specific to individual countries. If deemed necessary by Sage, a review will be carried out at the end of the relevant retention period. The review will assess whether the information should be deleted as planned or further retained. Further retention may be, for example, the purpose of litigation or to meet another legal requirement.

If there is any data that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further use of such data.

For further information on applicable data retention periods, please contact us by using the information listed at the bottom of this Privacy Notice.

7. How do we keep your Personal Data secure?

Your Personal Data is important to us. We take organisational, technical and physical measures to help safeguard against the accidental or unlawful destruction, loss, alteration and unauthorised disclosure of, or access to your Personal Data.

While we take steps to protect your Personal Data, no method of storage or transmission is 100% secure. It is your sole responsibility to protect your password, limit access to your devices and sign out of the Sage Marketplace after your sessions. If you have any questions about the security of the Sage Marketplace, please contact us by using the information at the bottom of this Privacy Notice.

To ensure that we maintain high levels of security, we provide data protection and data privacy training to all Sage employees. We aim to use and store the minimum amount of Personal Data possible and we use anonymisation and pseudonymisation. We also conduct data privacy impact assessments (DPIAs) to ensure that we understand and reduce any high risks associated with processing Personal Data.

8. Do we use cookies or similar technologies?

We use tracking code in the Sage Marketplace to collect information to help deliver, optimise, personalise and analyse our services and for advertising purposes. Tracking codes are snippets of code placed in the Sage Marketplace to measure things like visits, activities and transactions. AppDirect also use cookies in the Sage Marketplace to deliver the Sage Marketplace to you.

Please see our Cookie Policy for more information.

9. Do we transfer information internationally?

Your Personal Data may be collected in, transferred to and accessed by Sage, our group companies, suppliers, distributors and other business partners and/or agents located in countries outside of your country or residence. Please be aware that the privacy protections and legal requirements, including the rights of authorities to access your Personal Data, in some of these countries may not be equivalent to those in your country of residence. However, we will take steps to protect your privacy and to provide a level of protection of Personal Data that is comparable to that of your country of residence.

Users Located in the European Economic Area and/or the UK (EEA)

Where required, we have put in place appropriate safeguards with our group companies, service providers, contractors, distributors and other business partners and agents to ensure that transfers of Personal Data outside the EEA and/or the UK are adequately protected. These safeguards typically comprise the EU Standard Contractual Clauses. For more information on the appropriate safeguards in place to protect your Personal Data, please use the contact details listed at the bottom of this Privacy Notice.

10. What are your choices and rights?

In respect of your Personal Data, you may have one or more of the following rights, depending on applicable data protection laws:

(a) to access your Personal Data (right to access);

(b) to rectify inaccurate Personal Data and supplement incomplete Personal Data (right to rectification);

(c) to erase/delete your Personal Data (right to erasure);

(d) to restrict our processing of your Personal Data (right to restriction of processing);

(e) to transfer your Personal Data to another controller (right to data portability);

(f) to object to any processing of your Personal Data carried out on the basis of our legitimate interests (right to object). Where we process your Personal Data for direct marketing purposes or share it with third parties for their own direct marketing purposes, you can exercise your right to object at any time to such processing without having to provide any specific reason for such objection;

(g) not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects ("Automated Decision-Making"). Automated Decision-Making currently does not take place on the Sage Marketplace;

(h) to withdraw your consent at any time, without affecting the lawfulness of the processing based on such consent before its withdrawal; and

(i) to complain to a relevant data protection authority if you are dissatisfied with how your Personal Data is handled by Sage. Contact details for such authorities can be found at https://edpb.europa.eu/about-edpb/board/members_en.

Should you wish to make a request, withdraw consent or discuss any of the above in further detail, please contact us directly using the details provided in the “Contacting Us” section below.

11. Changes and updates to the Privacy Notice

Please revisit this page to stay aware of any changes to this Privacy Notice, which may be revised from time to time. If we modify the Privacy Notice, we will make it available through the Sage Marketplace, and we will update the “effective date” at the top of this Privacy Notice. If the modifications materially alter your rights or obligations hereunder, we will notify you as may be required by law. This will be using the email address provided by you at the point of registration.

We encourage you to revisit this Privacy Notice to stay updated and informed about our collection, processing, sharing and storing of your Personal Data.

12. Contacting Us

You can contact us at:

Sage Global Services Limited
Registered address:
North Park
Newcastle Upon Tyne
NE13 9AA
United Kingdom
UK Registered Company Number: 09506951
Email: globalprivacy@sage.com

Schedule 1

Sage entities

Your principal place of business	Sage entity	Address for notices
United Kingdom	Sage (UK) Limited (CRN: 01045967)	North Park, Newcastle upon Tyne, England NE13 9AA
Ireland	Sage Hibernia Limited (CRN: 300549)	One Central Park, Leapardstown, Dublin 18
Deutschland	Sage GmbH	Franklinstraße 61-63 60486 Frankfurt am Main
Schweiz/Suisse	Sage Schweiz AG	Platz 10, 6039 Root D4, Switzerland
Austria	Sage GmbH	Stella-Klein-Low-Weg 15, 1020 Vienna, Austria
Poland	Sage sp. z o.o.	Aleje Jerozolimskie 132, 02-305 Warsaw
Spain	Sage Spain SL	Moraleja Building One - Planta 1 Parque Empresarial de La Moraleja Avenida de Europa no19, 28108 Alcobendas Madrid, Spain
Portugal	Sage Portugal Software SA	Edifício Olympus II, Av. Dom Afonso Henriques, 1462, 4450-013 Matosinhos, Portugal.
United States Caribbean countries (except French Caribbean) Latin and Central America Mexico	Sage Software, Inc.	271 17th Street NW, Suite 1100 Atlanta, GA 30363
Canada	Sage Software Canada Ltd	120 Bremner Blvd., Suite 1500, Toronto, Ontario M5J 0A1, Canada
France	Sage SAS	10 Place de Belgique La Garenne-Colombes Paris France
Belgium	Sage SA	Buro & Design Center Esplanade 1 1020 BRUSSELS Belgium
Morocco	Sage Software	Tour Crystal 1 Niveau 9 Bd Sidi Mohamed Ben Abdellah Casablanca 20030 Morocco
South Africa Africa	Sage South Africa (Pty) Ltd	Sage Technology Park, 102 Western Services Road, Gallo Manor Ext 6, Johannesburg 2191 South Africa
Middle East	Sage Software Middle East FZ-LLC	Building No.11 Dubai Internet City Dubai
Malaysia	Sage Software Sdn Bhd	Suite 1-B, Level 6, Block 1B, Plaza Sentral, Jalan Stesen Sentral 5, Kuala Lumpur Sentral, 50470 Kuala Lumpue, Malaysia
Singapore	Sage Software Asia Pte Limited	Asia Square, Tower 2, 12 Marina View, #25-02/03, 018961
Australia	Sage Software Australia Pty Ltd (ABN 40 071 007 326)	Level 11, The Zenith Tower B, 821 Pacific Highway, Chatswood, NSW 2067, Australia
Any country or region not mentioned above	Sage will notify you of the relevant Sage entity	Sage will notify you of the address