Amazon Data Protection Policy

1. Purpose and scope

This document describes how Aurobica SRL ("we", "the organisation") collects, processes, stores, uses, shares and disposes of the Amazon information received through the Amazon Selling Partner API (SP-API) as a Public Developer / Solution Provider.

Aurobica SRL develops and supplies software for logistics (order management systems OMS, transport management TMS, warehouse management WMS, and the related operational apps) for logistics operators who fulfil and ship orders on behalf of third-party sellers (Selling Partners). In relation to Amazon information we process data on behalf of and on the authorisation of the Selling Partners, to enable the logistics operators who are our customers to fulfil and ship the relevant orders through our software. We therefore act as a data processor with respect to each seller's data.

This policy is specific to Amazon data and complements our general privacy policy. We undertake to process Amazon information in compliance with the Amazon Data Protection Policy (DPP), the Acceptable Use Policy, the API Solution Provider Agreement and the other applicable agreements with Amazon, as well as with Regulation (EU) 2016/679 (GDPR).

2. Amazon data processed

We collect only the data strictly necessary to deliver the software service requested. Specifically, through the SP-API we receive Personally Identifiable Information (PII) relating to orders (for example through the Orders API, orders-v0), which may include:

• the recipient's name;
• the shipping address;
• any contact telephone number needed for delivery;
• details of the order and of the items purchased.

Each data set is associated with the specific Selling Partner on whose behalf it was received. We do not collect or retain Amazon data beyond what is necessary to deliver the service. We do not collect full financial data (card numbers) through the SP-API.

3. Purposes of processing

Amazon information is processed solely to enable the fulfilment and shipment of the Selling Partners' Amazon orders through our software, and for the purposes expressly permitted by the agreements with Amazon: importing orders into the order management system (OMS), processing, preparation and shipment through the warehouse (WMS) and transport (TMS) systems, generating shipping labels, handling returns and order-related support, and meeting any legal obligations connected with the transaction.

We process each seller's data only on their authorisation and within the scope of the agreed service. We do not use Amazon information for marketing, profiling or resale purposes, nor for any purpose other than those authorised. We do not combine one seller's order PII with that of others, nor with data collected through other channels, for purposes that are not permitted.

4. Data segregation between customers

Because we process data relating to several Selling Partners, each seller's data is logically separated and made accessible solely in the context of fulfilling that seller's orders. The access controls described in section 6 ensure that staff and software users can access a seller's data only where necessary to deliver the relevant service, and that one Selling Partner's data is neither accessible to another Selling Partner nor usable for their benefit.

5. Storage

Amazon Information is stored on company servers located at our premises in Italy (within the European Economic Area); hosting is managed directly by Aurobica SRL. Amazon data is not transferred outside the EEA.

Data is protected by encryption in transit (TLS) and encryption at rest. Access is restricted according to the principle of least privilege and is logged (section 6).

6. Access control and security

Access to Amazon information is permitted solely to authorised staff and to software users who need it in order to fulfil orders, on the basis of:

• unique user identification and authentication;
• access control based on the principle of least privilege, with separation by customer;
• monitoring and logging of access and relevant events, with notification in the event of anomalies;
• device protection measures, including control of removable media (for example blocking and monitoring of USB ports).

7. Sharing

We neither sell nor transfer Amazon information and we do not share it for unauthorised purposes. We share data with third parties only where necessary to deliver the service and within the limits permitted by the agreements with Amazon, in particular with:

• the logistics operators who are our customers, who access order data through our software in order to fulfil and ship orders on behalf of the authorising Selling Partners;
• the couriers and carriers handling delivery, limited to the data needed for shipping (recipient name, address and any contact details).

We do not use external hosting providers to store Amazon Information, which remains on our own servers. The parties with whom we share data are bound to process it solely for the purposes of order fulfilment and delivery.

8. Disposal

We securely delete Amazon information within 30 days of the point at which it is no longer necessary for the delivery of the service and for the authorised purposes, save for any shorter term required by Amazon or a retention obligation imposed by law (in which case we keep only the minimum data strictly necessary, for the time strictly necessary). We also delete on request from the Selling Partner on whose behalf we process the data.

Deletion is permanent and irreversible from production systems and from any backup copies according to their rotation cycles, such that the data is no longer recoverable.

9. Security incident management

In the event of a security incident involving Amazon Information, we apply our incident response procedure (detection, containment, investigation, remediation) and notify Amazon within the terms set out in the Amazon Data Protection Policy, in addition to notifying the affected Selling Partners and meeting the requirements of applicable law.

10. Contact

For any request relating to the processing of Amazon information:
Aurobica SRL — info@aurobica.com