Privacy and Data Handling Policy

Effective Date: April 30, 2025

This Privacy and Data Handling Policy ("Policy") explains how Zhangpu Naxiao E-Commerce Co., Ltd. ("we", "our", or "us") collects, processes, stores, uses, shares, and disposes of Amazon data through its integration with Amazon Services APIs. We are committed to protecting your data in accordance with Amazon policies, applicable laws, and industry standards.

1. Data Controller and Processor Responsibilities

We act as a data processor for Amazon customer data and as a data controller for developer-related data. Data is only processed with the authorization of Amazon Authorized Users through proper third-party authorization.

2. Types of Data Collected

• Order information and shipping details
• Product listing and pricing data
• Buyer-Seller messaging content
• Inventory, fulfillment, and financial reports
• Customer PII (e.g., name, address) only as required for fulfillment or legal reasons

3. Legal Basis for Processing

We process data based on contractual necessity, user consent, compliance with legal obligations, and legitimate business interests such as security and performance monitoring.

4. Purpose of Use

Data is used only to support Authorized User operations with Amazon, including order fulfillment, messaging, compliance, analytics, and technical support. We do not use data for marketing or resale purposes.

5. Data Storage, Retention, and Deletion

• PII is encrypted using AES-256 or RSA-2048+
• Data in transit is protected with TLS 1.2+ or SFTP
• PII is deleted within 30 days after order delivery unless legally required
• Full deletion within 90 days upon Amazon request, following NIST 800-88

6. Data Security Measures

We implement role-based access control, MFA, logging, real-time monitoring, regular security audits, and incident response procedures. Staff receive annual training and access is revoked within 24 hours upon departure.

7. Data Sharing

We do not share data with third parties except:

• To comply with laws or Amazon's policies
• With approved subcontractors under strict agreements
• To Amazon when requested

8. Cross-Border Transfers

We comply with standard contractual clauses and Amazon’s DPP for any cross-border data transfers, ensuring full encryption and legal safeguards.

9. User Rights

Authorized Users may request access, correction, or deletion of their data by contacting us. Requests will be honored within 30 days after verification.

10. Cookies

Cookies are used only to maintain session state and improve performance. No tracking or marketing cookies are used.

11. Protection of Minors

Our services are not directed to users under 18. We do not knowingly collect data from minors.

12. Compliance and Audit

We maintain compliance logs and are open to audits by Amazon or designated third parties.

13. Policy Changes

We may update this policy from time to time. Material changes will be announced at least 15 days in advance.

14. Contact Us

Company: Zhangpu Naxiao E-Commerce Co., Ltd.
Email: xuyifan012@outlook.com
Phone: +86 13299216452
Address: Room 205, Unit 2, Building 42, Meilun Qinghuayuan, No. 4, Ximei Middle Road, Suian Town, Zhangpu County, Fujian, China