Trust

Security & Data Protection

HAFA LTD operates SDKECOMSOLUTION with security and privacy controls designed to protect customer and marketplace data, including data obtained via Amazon’s Selling Partner API (SP-API).

Security principles

Least privilege

Access is restricted to the minimum needed to provide and support the service.

Defense in depth

Multiple layers of controls help reduce the impact of a single control failure.

Operational accountability

Logging and monitoring support investigation, change control, and operational oversight.

Encryption

Encryption in transit

Data is transmitted over encrypted connections (TLS) between user devices, SDKECOMSOLUTION, and third-party services (including SP-API) to protect data in transit.

Encryption at rest

Customer and marketplace data stored by SDKECOMSOLUTION is protected using encryption at rest in production storage systems, including backups where applicable.

Access controls

Role-based access controls (RBAC) and separation of duties where appropriate
Administrative access restricted to authorized personnel with a legitimate business need
Secure credential storage; API keys and secrets are not exposed in public website code
Session and authentication controls designed to protect account access

PII handling

SDKECOMSOLUTION may process order-related personal data (for example, shipping recipient details) strictly to provide fulfilment and shipping workflows requested by the seller. Access to personal data is restricted and protected through technical and organizational measures.

Logging, monitoring, and incident response

Operational logs support troubleshooting, security monitoring, and auditability
Monitoring is used to detect abnormal activity and service issues
Incident response processes are in place to assess, contain, and remediate security events

Data retention and deletion

Data is retained only for as long as necessary to provide the service, meet operational needs, and satisfy legal or compliance obligations. Deletion requests can be submitted via info@hafaa.co.uk.

For Amazon SP-API derived data, SDKECOMSOLUTION supports deletion within applicable requirements (including 30‑day deletion requirements) after a valid deletion request or after authorization is revoked, where applicable.

More detail on data use

See our privacy policy for data categories, purposes, sharing, and user rights.