Data Governance Policy for Amazon Data

1. Purpose and Scope

This policy defines how Amazon data received by our company is collected, processed, stored, used, shared, and disposed of. The purpose of this policy is to protect Amazon customers’ data and ensure compliance with Amazon’s Data Protection Policy (DPP) and Acceptable Use Policy (AUP). This policy applies to all departments and employees within the company.

2. Data Collection

Amazon data is collected only for the following purposes:

• Order Fulfillment: Customer order information from Amazon is collected via API for accurate and timely order processing.
• Legal and Tax Obligations: Customer information is collected for VAT calculations and invoicing, as required by law.

The collected data may include customer order details, shipping addresses, and Personally Identifiable Information (PII). Data access is restricted to authorized personnel only.

3. Data Processing

Amazon data is processed within our secure system for the following purposes:

• Order Management: Processing, managing, and tracking orders from Amazon.
• Billing and VAT Calculation: Using Amazon data for invoice generation and tax calculations.
• Personalized Product Production: Customer-provided images and names are used for personalized product creation.

Each processing step is restricted to authorized employees based on role requirements, with strict data security measures in place.

4. Data Storage

Amazon data is stored on MongoDB Atlas with AES-256 encryption. Access to this data is restricted to specific IP addresses within our company. Data storage is managed under the following security protocols:

• Access Control: Access is limited to employees who require it, with individual authentication for each user.
• Encryption: Data is encrypted using AES-256 both at rest and in transit.

Data is stored only for business and legal requirements and is deleted after the specified retention period.

5. Data Usage

Amazon data is used solely for the following purposes:

• Order Fulfillment: Completing and shipping customer orders.
• Legal and Tax Compliance: VAT calculations and invoicing.
• Personalization Services: Customer information is used in the production of personalized products.

Data usage follows the principle of least privilege, where only employees whose roles require it can access the data.

6. Data Sharing

Data received from Amazon is not shared with third parties or external systems. Our company does not integrate Amazon data with any other service, and strict data-sharing restrictions are enforced.

7. Data Disposal

Amazon data is not retained beyond the legally required period. Personally Identifiable Information (PII) is permanently deleted after 30 days, following NIST 800-88 standards. Data disposal is managed through the following processes:

• Permanent Deletion: PII is permanently deleted after the specified period, rendering it unrecoverable.
• Documentation: Deletion processes are recorded, and confirmation of secure deletion is documented.

8. Review and Compliance

This policy is reviewed every six months or when there is a significant change in Amazon’s requirements. Additionally, all employees receive annual training on data security and compliance with these policies. Compliance documentation is reviewed and updated regularly.