Data Processing Policy

1. Purpose

We understand that Amazon store data, operating reports, order information, inventory information, advertising data and internal business materials can be commercially sensitive. This policy describes the processing boundaries and core principles followed by JAZEAL HONGKONG LIMITED when providing relevant services.

2. Categories of Data

Depending on the cooperation model and authorized scope, we may process Amazon platform authorization data, store identifiers, order and fulfillment data, inventory and replenishment data, advertising and keyword data, sales and profitability reports, product and listing data, client-uploaded operating materials, collaboration documents and necessary system logs or debugging information.

3. Processing Roles

In most projects, the client controls its business data and determines the purpose of processing. We typically process relevant data as a service provider within the scope of the contract, authorization and client instructions for system integration, feature presentation, report calculation, role collaboration, troubleshooting and service delivery.

4. Processing Principles

We process data on a lawful, proper, necessary and minimization basis. We access, store, transfer, analyze or display data only to the extent needed to perform the agreed service; only personnel who need the data to perform tasks are granted access; and unnecessary copying, exporting or prolonged retention beyond service needs is avoided where practical.

5. Use Restrictions

Unless expressly authorized by the client, required by law or otherwise agreed in writing, we do not use client data for competitive analysis, resale, unrelated marketing, public display or other purposes unrelated to the cooperation. We also aim to follow applicable platform rules and access requirements for Amazon platform data.

6. Sub-processors and Third-Party Services

To support hosting, notifications, logging, infrastructure operations or functional integrations, we may use necessary third-party services. Where client data is involved, we select such third parties based on business need and expect them to carry appropriate security and confidentiality obligations within the applicable scope.

7. Security and Access Control

We apply reasonable technical and administrative safeguards according to the business scenario, including authentication, permission isolation, environment separation, logging, backup management, least-privilege allocation and internal approval controls to reduce the risk of unauthorized access, misuse, leakage, alteration or loss.

8. Cross-border and Storage Arrangements

Because client operations, team collaboration and technical infrastructure may involve different regions, data may be stored or transmitted within authorized service environments across locations. If the client has explicit requirements on data residency, private deployment or specific compliance conditions, these can be addressed separately during the project stage.

9. Retention and Deletion

We retain data according to contract performance, continuing service, backup cycles, dispute handling, audit needs and applicable law. After cooperation ends, authorization is terminated or a reasonable client request is received, we may delete, archive or restrict access to relevant permissions, cached data, exported files and retained copies according to the agreed arrangement, except where continued retention is legally required.

10. Security Incident Response

If an incident affects the security of client data, we will take reasonable steps to contain the impact, assess risk, remedy the issue and, where applicable, inform the relevant client or assist it in meeting necessary response obligations.

11. Client Responsibilities

The client should ensure that it has a lawful basis to provide or authorize access to the data shared with us, and remains responsible for its account management, internal authorization, staff actions, interface permission applications and intended data use. If stricter protection arrangements are required, a dedicated data processing agreement is recommended for formal cooperation.

12. Contact

For questions about processing boundaries, retention arrangements, permission management or special compliance requirements, please contact chengrun3@outlook.com.