Privacy Policy

1. Who we are

Controller/Service Provider: HAFA LTD
Registered Office: 269 Unit 7 Manthar Estate, Wellington Road, Handsworth, Birmingham, England, B20 2QQ, United Kingdom
Email: info@hafaa.co.uk
Phone: +44 20 3393 6833

2. What data we process

The Service is intended for business users managing ecommerce operations. Depending on how you use the Service and which marketplaces you connect, we may process:

• Account data (name, work email, role, authentication and access information)
• Operational data (SKUs, inventory quantities, product/listing attributes, order records)
• Order-related personal data (PII) (shipping recipient name and address and other order fields required for fulfilment/shipping)
• Shipment and tracking data (carrier, tracking numbers, shipment identifiers)
• Technical data (logs, device/browser information, security telemetry)
• Support communications (messages you send to our support channels)

3. Amazon SP-API Data: Collection, Storage, Sharing, Retention & Deletion

3.1 Collection

When you authorize SDKECOMSOLUTION to connect your Amazon seller account through the Selling Partner API (SP-API), we collect data from Amazon to provide service functionality. We only collect data for features you enable and only access the specific API scopes you have authorized.

Data types collected from Amazon include:

• Inventory data: SKUs, quantities, product attributes, availability status
• Order data: Order IDs, status, timestamps, line items, prices, amounts
• Customer information: Shipping recipient names, addresses, and other order-related details needed for fulfillment
• Shipment data: Shipment IDs, carrier information, tracking numbers, dispatch confirmations
• Account identifiers: Seller account IDs and marketplace context

3.2 Storage

Amazon data is stored securely in SDKECOMSOLUTION's production systems using encryption at rest. Access to stored Amazon data is restricted to your user account and authorized service personnel on a need-to-know basis. We maintain access logs to track data retrieval and usage.

3.3 Sharing

Amazon data is not shared with third parties except to the extent necessary for service operation (e.g., hosting providers, backup services). All third-party service providers are contractually bound to maintain confidentiality and security.

We do not sell or monetize Amazon-derived data, nor do we use it for marketing or profiling purposes.

3.4 Retention

Amazon data is retained only for as long as necessary for operational use, dispute resolution, and compliance obligations. Typical retention periods vary based on data type and use case (e.g., order history may be retained longer than temporary inventory snapshots).

30-day deletion requirement: For certain Amazon SP-API data categories, we support deletion of your Amazon-derived data within 30 days of authorization revocation or a valid deletion request, in accordance with Amazon's policies.

3.5 Deletion

You can request deletion of Amazon data at any time by emailing info@hafaa.co.uk. Additionally:

• Revoke authorization: Disconnect your Amazon account from SDKECOMSOLUTION (or revoke in Amazon's authorization manager). This stops all future data collection immediately.
• Request data deletion: Email us with your account details and specify what data you want deleted.
• Delete within required timeframes: We process deletion requests promptly and comply with 30-day deletion requirements for applicable Amazon data categories.

4. Purposes and lawful bases

We process personal data for the purposes below:

• Provide the Service (inventory, orders, fulfilment, shipping and reporting workflows)
• Integration operations (calling marketplace APIs you have authorized, including SP-API)
• Customer support (responding to requests and troubleshooting issues)
• Security (fraud prevention, monitoring, incident investigation)
• Legal/compliance (meeting legal obligations and enforcing terms)

Our lawful bases may include performance of a contract with the customer, legitimate interests, and compliance with legal obligations. Where required, we will obtain consent (for example, for non-essential cookies where applicable).

5. Data sharing and service providers

We may share data with trusted service providers who help us operate the Service (for example hosting, infrastructure, monitoring, email delivery, and customer support tooling). These providers process data under our instructions and are subject to contractual and security obligations.

We may also share data where required to comply with law, protect our rights, or respond to lawful requests.

6. International transfers

Where data is transferred outside the United Kingdom, we use appropriate safeguards (such as contractual clauses) to protect personal data.

7. Retention

We retain personal data only for as long as necessary for the purposes described in this policy, including operational needs, dispute resolution, and compliance obligations. Retention periods may vary by data category and by customer configuration.

For Amazon SP-API derived data, where applicable we support deletion within required timeframes (including 30‑day deletion requirements) after a valid deletion request or after authorization is revoked.

8. Security

We implement technical and organizational measures designed to protect data. These include encryption in transit, encryption at rest in production storage systems, access controls, and monitoring. No method of transmission or storage is 100% secure; however, we work to maintain appropriate controls for the Service.

For more detail, see Security & Data Protection.

9. Your rights

Depending on your location and applicable law (including UK GDPR), you may have rights to access, correct, delete, or restrict certain processing of your personal data, and to object or request portability where applicable.

10. Deletion requests and SP-API authorization revocation

To request deletion of personal data associated with your SDKECOMSOLUTION account, email info@hafaa.co.uk with sufficient information to identify your account and the data you want deleted. We may need to verify the request and confirm authority to act on behalf of the business account.

If you revoke Amazon authorization, SDKECOMSOLUTION stops calling SP-API on your behalf. Where applicable, we can also process deletion of Amazon-derived data in accordance with required timelines after revocation and/or a valid deletion request.

11. Cookies

This public website uses minimal client-side code for basic navigation and usability. We do not intentionally load third-party trackers. If cookies are used in future (for example for analytics), this policy will be updated and appropriate controls will be provided.

12. Contact

If you have questions about this policy or how we handle data, contact HAFA LTD at info@hafaa.co.uk or call +44 20 3393 6833.