GDPR Compliance
How AMZ Prep handles EU and UK personal data, and what you can ask of us
This page was updated to confirm that ICO registration is now complete. Earlier versions only named the ICO as the UK complaints authority without stating registration status. Everything below reflects AMZ Prep's actual entity structure, facility locations, and data handling practices under GDPR (EU) 2016/679 and UK GDPR.
Company & Legal
The entity processing your data
AMZ Prep Inc. is the entity you're dealing with. It operates facilities in three countries, each relevant to how data moves through the business.
- Legal entity: AMZ Prep Inc.
- Registered address (US): 238 Bay Ridge Parkway, Brooklyn, NY 11209
- Headquarters (Canada): 9 Van der Graaf Crt, Brampton, ON L6T 5E5, Canada
- UK facility & UK GDPR representative: AMZ Prep, Unit 3, Mountpark, 5 Wide Ln, Southampton SO18 2FA, United Kingdom
- Processing locations: Brooklyn, NY (US); Southampton (UK); Brampton, ON (Canada headquarters)
- Data protection contact: info@amzprep.com. All GDPR correspondence, from data subject requests to general privacy questions, goes to this one address.
Compliance Status
Where AMZ Prep stands under GDPR and UK GDPR
AMZ Prep is fully GDPR compliant, processing personal data lawfully, fairly, and transparently under GDPR (EU) 2016/679. UK GDPR compliance runs alongside it, since the UK facility handles data for individuals covered by both regimes.
Compliant. Personal data is processed lawfully, fairly, and transparently, with the legal bases and safeguards the regulation requires.
Compliant. The Southampton facility serves as AMZ Prep's UK GDPR representative, and ICO registration is completed.
A designated privacy team is responsible for overseeing GDPR compliance. This isn't a formal Data Protection Officer role, since AMZ Prep isn't legally required to appoint one, but the function exists and is staffed.
Your Rights
What EU and UK individuals can ask AMZ Prep to do
If AMZ Prep holds your personal data, GDPR and UK GDPR give you a set of rights over it. You can exercise any of these by submitting a request, covered in the next section.
| Right | What it means |
|---|---|
| Access | Request a copy of the personal data AMZ Prep holds about you. |
| Correction | Ask that inaccurate or incomplete data be corrected. |
| Deletion | Request that your personal data be deleted, subject to any legal retention requirements described in the Data Retention section below. |
| Restriction | Ask AMZ Prep to limit how your data is processed while a dispute or correction is being worked through. |
| Portability | Request a copy of your data in a portable, machine-readable format. |
| Objection | Object to certain kinds of processing, such as processing based on legitimate interest. |
Submit a Request
How to actually exercise these rights
There's one path in, and it's the same for every right listed above.
- Email: info@amzprep.com, with the subject line "GDPR Request - [Your Name]".
- Include: your full name, contact details, the specific rights you're exercising, and any relevant details about where your data is located.
- Response time: within one month of receipt.
Data Retention
How long AMZ Prep keeps your data
Retention periods differ by data type. Tax and accounting rules drive most of them, not an internal policy choice.
| Data type | Retention period |
|---|---|
| Customer account data | Duration of business relationship plus 7 years |
| Transaction records | 7 years, for tax and accounting purposes |
| Marketing communications | Until consent is withdrawn |
International Transfers
When data leaves the EU or UK
AMZ Prep runs facilities in the US, UK, and Canada, so data collected in the EU or UK can end up processed outside those regions. When it does, one of three mechanisms applies.
- EU Standard Contractual Clauses (SCCs) govern transfers out of the European Economic Area.
- UK International Data Transfer Agreement (IDTA) covers transfers out of the United Kingdom.
- Adequacy decisions apply where the destination country has one in place.
Certifications
What backs this up operationally
GDPR compliance sits alongside AMZ Prep's broader quality and facility certifications.
FAQ
Common questions about GDPR at AMZ Prep
What GDPR rights do EU and UK individuals have with AMZ Prep?
Individuals in the EU and UK can request access to their personal data, ask for corrections, request deletion, restrict how their data is processed, request a copy in a portable format, and object to certain processing. AMZ Prep processes personal data lawfully, fairly, and transparently under GDPR (EU) 2016/679.
How do I submit a data subject request to AMZ Prep?
Email info@amzprep.com with the subject line "GDPR Request - [Your Name]". Include your full name, contact details, the specific rights you're exercising, and any relevant details about where your data is located.
How long does AMZ Prep take to respond to a GDPR request?
AMZ Prep responds within one month of receiving the request.
Who is AMZ Prep's UK representative under UK GDPR?
AMZ Prep's UK facility and UK GDPR representative is located at Unit 3, Mountpark, 5 Wide Ln, Southampton SO18 2FA, United Kingdom.
Is AMZ Prep registered with the ICO?
Yes. ICO registration is completed. The Information Commissioner's Office is the UK's data protection authority and the body EU and UK individuals can complain to if they believe their GDPR rights haven't been respected.
How long does AMZ Prep retain personal data?
Customer account data is retained for the duration of the business relationship plus 7 years. Transaction records are kept for 7 years for tax and accounting purposes. Marketing communications data is retained until consent is withdrawn.
How does AMZ Prep transfer data outside the EU and UK?
International transfers run under EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), and adequacy decisions where applicable.
Does AMZ Prep have a Data Protection Officer?
No, not a formal Data Protection Officer, since AMZ Prep's processing activity doesn't legally require appointing one. AMZ Prep has designated a privacy team responsible for overseeing GDPR compliance instead.
Have a GDPR request or question?
Send it to the privacy team directly, and expect a response within one month.
