Retention Highlights: Customer PII is purged within 30 days of dispatch confirmation via automated nightly jobs. API access tokens are ephemeral (60 min). Tax and invoice records are archived for 10 years per § 147 AO. Data is crypto-shredded upon deletion.
1. Policy Mandate & Scope
Ledermode GbR is committed to the principle of storage limitation under Article 5(1)(e) of the GDPR and the data retention requirements established in Amazon's Data Protection Policy (DPP).
Personal data and marketplace operational records are retained only for the duration necessary to fulfill the legitimate purposes for which they were collected, or as mandated by statutory German commercial and fiscal record-keeping regulations.
2. Retention Timetable by Data Category
We enforce specific retention time limits across data categories:
| Data Category | Permitted Retention Period | Governing Standard / Legal Basis |
|---|---|---|
| Customer Shipping PII (Name, Address) | Maximum 30 Days post-dispatch | Amazon DPP Section 2.3 & Art. 5(1)(e) GDPR |
| Temporary Order Fulfillment Cache | Purged immediately upon label generation | Data Minimization Principle |
| SP-API Access Tokens (Short-Lived) | 60 Minutes (Ephemeral in-memory) | OAuth 2.0 Security Specifications |
| SP-API Refresh Tokens | Until Seller Revocation | Seller Authorization Consent |
| Security Audit & Access Logs | 90 Days Rolling Window | Amazon Security Requirements & Art. 6(1)(f) |
| Commercial Invoices & Tax Records | 10 Years | § 147 AO (Abgabenordnung) & § 257 HGB |
3. Automated Deletion Workflows
Deletion is not left to manual intervention. Our backend services execute automated scheduled cron jobs that enforce retention expiration:
- Nightly PII Purge Job: Scans dispatched orders where the fulfillment date exceeds 30 days and permanently purges recipient names, street lines, phone numbers, and delivery notes.
- Log Rotation: Server log volumes are rotated daily and automatically deleted once the 90-day retention horizon is reached.
- Immediate Revocation Purge: When an Amazon seller terminates or revokes authorization, an automated webhook trigger securely deletes the seller's stored refresh tokens and active sync jobs within 15 minutes.
4. Deletion on Request (GDPR Art. 17 & Seller Requests)
Data subjects and authorized sellers may request immediate deletion of their personal or account data:
- Verification: Requests submitted to are verified to confirm identity before execution.
- Turnaround Time: Valid deletion requests are processed without undue delay and confirmed within 14 calendar days, well within the 30-day statutory window of GDPR Article 12(3).
- Statutory Exceptions: Data required to satisfy binding tax or commercial retention requirements under German law (§ 147 AO) will be restricted from active operational use and archived until statutory expiration.
5. Secure Disposal & Media Sanitization
When data reaches its retention limit or deletion is requested, it is securely destroyed:
- Electronic Data Shredding: Database records are overwritten or crypto-shredded (deleting encryption keys), ensuring unrecoverability.
- Hardware Decommissioning: Cloud storage volumes are zero-filled and released back to cloud hypervisors in compliance with NIST SP 800-88 Rev. 1 Guidelines for Media Sanitization.