Privacy Policy

The data controller responsible for the processing of personal data on this website and within our software integration services in accordance with Article 4(7) of the European General Data Protection Regulation (GDPR / DSGVO) is:

We process information categorized into distinct operational datasets:

• Website Server Data: When accessing our website, our hosting infrastructure automatically logs technical request data (IP address in truncated/anonymized form, browser user agent, HTTP status codes, timestamp, referring URL). This data is strictly required for network reliability and DDoS mitigation.
• Direct Business Inquiries: Contact information voluntarily provided when submitting inquiries via our web form or email (name, business email address, company name, message body).
• Amazon Selling Partner API (SP-API) Data: Operational datasets retrieved via authorized API calls:
  • • Catalog and listing metadata (SKUs, ASINs, titles, bullet points)
  • • Inventory stock figures and FNSKU counts
  • • Order identifiers, quantities, and carrier tracking manifests
• Customer PII (Strictly Limited): In the course of fulfilling seller orders, our application receives destination shipping details (recipient name and postal address). This data is processed exclusively to generate carrier labels and is never retained in permanent storage.

We process data under explicit legal bases established under Article 6(1) of the GDPR:

• Service Delivery & Contract Fulfillment (Art. 6(1)(b) GDPR): Processing orders, synchronizing inventory counts, and communicating order confirmations.
• Legitimate Interests (Art. 6(1)(f) GDPR): Maintaining website security, preventing fraudulent actions, monitoring API rate limits, and ensuring system stability.
• Legal Compliance (Art. 6(1)(c) GDPR): Fulfilling statutory tax, commercial accounting, and mandatory regulatory obligations under German commercial law (HGB / AO).

In alignment with Amazon's Data Protection Policy (DPP) and Acceptable Use Policy (AUP):

• We request only the minimum SP-API roles required for confirmed operational features.
• We do not aggregate or cross-reference buyer data for consumer profiling or targeted marketing.
• We do not disclose, share, or sell Amazon seller or customer data to third-party data brokers.
• Customer shipping details are purged from operational cache once shipping labels have been created.

Personal data is disclosed only to trusted service partners strictly bound by Data Processing Agreements (DPA) under Article 28 GDPR:

• Hosting & Cloud Infrastructure: Secure European server infrastructure providers maintaining ISO 27001 data center facilities.
• Postal & Logistics Carriers: Delivery providers (e.g., DHL, Deutsche Post) receiving package recipient data solely for physical transport.
• Statutory Authorities: Financial, customs, or judicial entities when mandated by binding court orders or statutory European provisions.

We adhere to strict data retention schedules. Data is retained only as long as necessary for the purpose for which it was collected or to satisfy statutory retention requirements:

• Customer PII: Purged within 30 days of dispatch confirmation in accordance with Amazon SP-API Data Protection standards.
• General Business Inquiries: Maintained for 12 months from resolution unless ongoing commercial correspondence necessitates continued retention.
• Commercial & Financial Invoices: Retained for 10 years pursuant to Section 147 of the German Fiscal Code (Abgabenordnung / AO) and Section 257 HGB.

See our dedicated Data Retention & Deletion Policy for detailed workflows.

We enforce state-of-the-art technical and organizational measures (TOMs) as required by Article 32 GDPR, including TLS 1.3 transport encryption, role-based access controls, credential salting/hashing, and periodic security audits. Review our Information Security Policy for further specifications.

Under Chapter III of the GDPR, you possess the following actionable rights:

• Right of Access (Art. 15 GDPR): Confirmation of whether your data is processed and a copy of such data.
• Right to Rectification (Art. 16 GDPR): Immediate correction of inaccurate personal data.
• Right to Erasure (Art. 17 GDPR): Erasure of your personal data ("Right to be Forgotten") where no statutory retention applies.
• Right to Restriction (Art. 18 GDPR): Restriction of processing in defined legal circumstances.
• Right to Data Portability (Art. 20 GDPR): Receipt of your data in a structured, commonly used format.
• Right to Object (Art. 21 GDPR): Right to object at any time to processing based on legitimate interests.
• Right to Lodge a Complaint: Right to complain to a competent data protection supervisory authority (in Hesse: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit).

To exercise any of your rights or request information regarding our privacy practices, contact our designated privacy office directly: