Data Processing Agreement
How AMZ Prep processes your data, set out in writing
This DPA governs the processing of personal data under AMZ Prep's fulfillment and related services. It covers who AMZ Prep shares data with, where that data is processed, how it's protected, and what happens if something goes wrong. Version 2.0, effective January 1, 2025.
Parties & Scope
Who this agreement covers, and where
AMZ Prep Inc. acts as the data processor for customer personal data handled in connection with fulfillment, prep, and related logistics services. This section lays out the legal entity, its addresses, and where processing physically takes place.
- Legal entity: AMZ Prep Inc.
- Registered address (US) / Legal Department: AMZ Prep Legal Department, 238 Bay Ridge Parkway, Brooklyn, NY 11209, United States
- Headquarters (Canada): 9 Van der Graaf Crt, Brampton, ON L6T 5E5, Canada
- UK office: Unit 3, Mountpark, 5 Wide Ln, Southampton SO18 2FA, United Kingdom
- Processing locations: United States (Brooklyn, NY), United Kingdom (Southampton), and Canada (Brampton, ON headquarters)
- DPA contact: info@amzprep.com, subject line "DPA Inquiry - [Company Name]"
Compliance Frameworks
The laws this DPA is built around
This DPA reflects the parties' agreement on the processing of personal data in accordance with the requirements of applicable data protection laws.
Governs processing of personal data belonging to individuals in the European Union, including the roles and obligations that apply when AMZ Prep acts as processor for a customer's data.
The UK's retained version of GDPR, applying to processing tied to the UK office in Southampton and to UK-based data subjects.
The California Consumer Privacy Act, covering the personal information of California residents that AMZ Prep processes on a customer's behalf.
Canada's Personal Information Protection and Electronic Documents Act, relevant given AMZ Prep's Brampton, Ontario headquarters and Canadian operations.
Sub-processors
Third parties AMZ Prep authorizes to process data
AMZ Prep engages sub-processors to run infrastructure, handle payments, move shipments, and support day-to-day operations. Below are the categories and the named vendors within each.
| Category | Vendors |
|---|---|
| Infrastructure & cloud | AWS, Google Cloud Platform, Microsoft Azure, Cloudflare, Cherry Servers |
| Business operations | HubSpot, Salesforce, DocuSign, Adobe Sign, Slack, Microsoft 365 |
| Content & productivity | QuillBot |
| Payment & financial | Stripe, PayPal, Square, Authorize.net |
| Shipping & logistics | FedEx, UPS, DHL, USPS, ShipStation |
| Analytics & marketing | Google Analytics, Segment, Mixpanel, Facebook/Meta, LinkedIn, Marketo |
| Customer support | Zendesk, Intercom, Freshdesk, Typeform, Front |
| Security & monitoring | Datadog, Sentry, Auth0, Okta, 1Password |
International Transfers
Getting data across borders legally
With processing split across the United States, the United Kingdom, and Canada, personal data regularly crosses jurisdictional lines. Three mechanisms cover that movement.
- Standard Contractual Clauses (SCCs), approved by the European Commission, apply to transfers originating in the European Economic Area.
- UK International Data Transfer Agreement (IDTA) applies to transfers originating in the United Kingdom.
- Adequacy decisions are relied on where a destination jurisdiction has one in place.
Security Measures
What protects the data once it's in AMZ Prep's systems
The DPA commits AMZ Prep to specific technical, physical, and organizational measures, not general assurances.
| Category | Measures |
|---|---|
| Technical | Encryption of data in transit and at rest, access controls and multi-factor authentication, regular vulnerability assessments, firewalls and intrusion detection systems, role-based access controls |
| Physical | 24/7 monitored access control systems, CCTV surveillance at all facilities, visitor management protocols |
| Organizational | Employee data protection training, confidentiality agreements with staff, incident response procedures, business continuity planning |
Audit Rights
How customers can verify what's written here
The DPA doesn't ask customers to take these commitments on faith. It gives them a defined process for checking.
Customers may request compliance information covering AMZ Prep's data protection practices.
No more than once per year, with 30 days' advance written notice. An independent third-party auditor may be engaged under confidentiality.
Customers may instead receive recent third-party audit reports in lieu of on-site inspections.
Breach Notification
If a Data Breach happens
AMZ Prep commits to notifying customers without undue delay upon becoming aware of a Data Breach affecting personal data. In practice, that typically means well within 72 hours, though the legal commitment is without undue delay rather than a fixed window.
From there, AMZ Prep will investigate the incident, implement remedial measures, provide the information customers need for their own regulatory notifications, and document the breach along with the actions taken in response. Notifications go to designated primary contacts at info@amzprep.com.
Data Return & Deletion
What happens when the relationship ends
Termination doesn't leave customer data sitting indefinitely in AMZ Prep's systems.
| Step | What happens |
|---|---|
| Return | Personal data is returned to the customer in a standard format |
| Deletion | Completed across all systems within 90 days of termination |
| Certification | Written certification of deletion is provided to the customer |
| Legally required retention | Only data required by law is retained, under the same protections as active data |
FAQ
Common questions about the DPA
What is AMZ Prep's Data Processing Agreement?
It's the legal document that governs how AMZ Prep processes personal data on a customer's behalf while providing fulfillment and related services. It reflects the parties' agreement on the processing of personal data in accordance with the requirements of applicable data protection laws, including GDPR, UK GDPR, CCPA, and PIPEDA. Version 2.0 of the DPA took effect January 1, 2025.
What sub-processors does AMZ Prep use?
AMZ Prep relies on sub-processors across eight categories: infrastructure and cloud (AWS, Google Cloud Platform, Microsoft Azure, Cloudflare, Cherry Servers), business operations (HubSpot, Salesforce, DocuSign, Adobe Sign, Slack, Microsoft 365), content and productivity (QuillBot), payment and financial (Stripe, PayPal, Square, Authorize.net), shipping and logistics (FedEx, UPS, DHL, USPS, ShipStation), analytics and marketing (Google Analytics, Segment, Mixpanel, Facebook/Meta, LinkedIn, Marketo), customer support (Zendesk, Intercom, Freshdesk, Typeform, Front), and security and monitoring tools (Datadog, Sentry, Auth0, Okta, 1Password). A complete and current list of all Sub-processors is maintained and available to Customers upon request.
How does AMZ Prep transfer data internationally?
AMZ Prep processes data across the United States, the United Kingdom, and Canada, so cross-border transfers happen under Standard Contractual Clauses (SCCs) approved by the European Commission, the UK International Data Transfer Agreement (IDTA), and adequacy decisions where applicable.
What happens if AMZ Prep experiences a data breach?
AMZ Prep commits to notifying customers without undue delay upon becoming aware of a Data Breach affecting personal data. In practice, that typically means well within 72 hours, though the legal commitment is without undue delay rather than a fixed window. AMZ Prep will investigate the incident, implement remedial measures, provide the information customers need for their own regulatory notifications, and document the breach and the actions taken. Notifications go to designated primary contacts at info@amzprep.com.
Can we audit AMZ Prep's security practices?
Yes. Customers may request compliance information, conduct audits no more than once per year with 30 days' advance written notice, and engage independent third-party auditors under confidentiality. Customers may also choose to receive recent third-party audit reports in lieu of on-site inspections. Audit costs are borne by the customer, unless the audit uncovers material non-compliance, in which case AMZ Prep bears the cost.
What happens to our data if we stop using AMZ Prep?
Upon termination, AMZ Prep will return personal data in a standard format and delete it from all systems within 90 days, then provide written certification that the deletion occurred. AMZ Prep retains only data required by law, and that data keeps the same protections as active data.
How do I request AMZ Prep's DPA or get a signed copy?
Email info@amzprep.com with the subject line "DPA Inquiry - [Company Name]". That's the single contact point AMZ Prep uses for DPA requests, including signed copies and questions about specific clauses.
Need a signed copy for your records?
AMZ Prep's Legal Department can send a signed copy of the DPA, or answer questions about a specific clause, directly to your team.
