1. Section Scope & Legal Intent
2. Mandatory Standards & Operating Requirements
All participants subject to this policy must strictly adhere to the following mandatory standards:
- Processing must have a recognized lawful basis: performance of a contract (Article 6(1)(b) GDPR), compliance with legal/AML obligations (Article 6(1)(c)), legitimate interests in fraud detection (Article 6(1)(f)), or explicit user consent.
- All registered entities must disclose accurate legal contact information for corporate privacy officers or representative agents.
- Users must be transparently informed of data collection points at registration, checkout, and storefront creation.
3. Explicit Prohibitions & Violation Triggers
The following actions constitute direct non-compliance and trigger automatic intervention by the Warning and Violation System:
- Collecting, harvesting, or scraping customer personal data from marketplace listings or order communications without express authorization.
- Using customer order data (names, physical addresses, phone numbers) for off-platform direct marketing or third-party resale.
- Circumventing platform communication channels to gather unencrypted buyer contact credentials.
4. Warning & Violation System Enforcement Matrix
Each violation under this section is mapped directly to the automated warning and sanction ladder:
| Violation Code | Offense Description | Detection Method | Severity Tier | Cure Window | Mandatory Sanction |
|---|---|---|---|---|---|
VIOL-311-01 |
Unauthorized harvesting or scraping of user personal directories. | Automated WAF & Rate Limiting Telemetry | Tier 3 (High) | Immediate | IP address blacklisting, API key revocation, account freeze. |
VIOL-311-02 |
Misuse of buyer dispatch address for unsolicited direct marketing. | Buyer Privacy Report & Ticket Log | Tier 2 (Moderate) | 24 Hours | 1 Strike Point, formal compliance warning, seller outreach audit. |
VIOL-311-03 |
Failure to appoint or verify Data Protection Officer / Representative. | Compliance Audit Review | Tier 1 (Advisory) | 7 Days | Temporary onboarding hold until privacy representative confirmed. |
5. Platform Safe Harbor & Limitation of Liability
Platform Intermediary Status: ePaisay provides the technological marketplace venue connecting independent counterparties. ePaisay is not a vendor, retailer, agent, or guarantor of any product, service, or transaction governed herein.
Total Disclaimer of Warranties: The platform disclaims all warranties of merchantability, fitness for particular purpose, and non-infringement to the fullest extent permissible by applicable law.
Limitation of Damages: In no event shall ePaisay, its officers, directors, or employees be liable for incidental, indirect, punitive, or consequential damages. Aggregate liability is strictly capped at the lesser of $100 USD or platform fees paid in the preceding three months.
Participant Indemnification: The participant agrees to defend, indemnify, and hold harmless ePaisay against any third-party claims, regulatory penalties, legal fees, or damages arising out of violations of this Section.