GDPR Compliance

Our Commitment to Data Protection

At AMZ Prep, we are committed to protecting and respecting your privacy. We comply with the General Data Protection Regulation (GDPR) (EU) 2016/679 and ensure that personal data is processed lawfully, fairly, and transparently.

What is GDPR?

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on May 25, 2018. It applies to all companies processing personal data of EU residents, regardless of the company's location. GDPR enhances individuals' control over their personal data and simplifies the regulatory environment for international business.

Your Rights Under GDPR

As an EU resident, you have the following rights regarding your personal data:

1. Right to Access

You have the right to request access to your personal data and obtain information about how we process it.

2. Right to Rectification

You can request correction of any inaccurate or incomplete personal data we hold about you.

3. Right to Erasure ("Right to be Forgotten")

You may request deletion of your personal data when it's no longer necessary for the purposes for which it was collected.

4. Right to Restrict Processing

You have the right to request restriction of processing your personal data under certain circumstances.

5. Right to Data Portability

You can request to receive your personal data in a structured, commonly used, and machine-readable format.

6. Right to Object

You have the right to object to processing of your personal data for direct marketing purposes or based on legitimate interests.

7. Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing, including profiling.

How We Protect Your Data

Security Measures

• Encryption: All data transmissions are encrypted using industry-standard SSL/TLS protocols
• Access Controls: Strict access controls and authentication mechanisms for all systems
• Regular Audits: Periodic security assessments and vulnerability testing
• Employee Training: Regular GDPR and data protection training for all staff members

Data Minimization

We only collect and process data that is necessary for providing our fulfillment services. We do not collect excessive data or use your data for purposes other than those specified.

Privacy by Design

We incorporate data protection principles into the development of all our business processes and systems from the outset.

Legal Basis for Processing

We process personal data based on the following legal grounds:

1. Contract Performance: Processing necessary to fulfill our service agreements
2. Legal Obligations: Compliance with legal and regulatory requirements
3. Legitimate Interests: Processing necessary for our legitimate business interests
4. Consent: Where you have given explicit consent for specific processing activities

Data Processing Activities

Types of Data We Process

• Contact information (name, email, phone number)
• Business information (company name, VAT number)
• Shipping and fulfillment data
• Payment and billing information
• Communication records

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal obligations. Our standard retention periods are:

• Customer account data: Duration of business relationship plus 7 years
• Transaction records: 7 years for tax and accounting purposes
• Marketing communications: Until consent is withdrawn

International Data Transfers

As a global fulfillment service provider, we may transfer your data between our locations:

Our Processing Locations

We ensure all international data transfers comply with GDPR requirements through:

• Standard Contractual Clauses (SCCs)
• Appropriate technical and organizational measures
• Data processing agreements with all third-party processors

Third-Party Data Sharing

We may share your data with:

• Shipping carriers for order fulfillment
• Payment processors for transaction processing
• Cloud service providers for data storage
• Professional advisors (lawyers, accountants) when necessary

All third parties are required to maintain appropriate security measures and process data only according to our instructions.

Data Breach Procedures

In the event of a personal data breach, we will:

1. Notify the relevant supervisory authority within 72 hours
2. Inform affected individuals without undue delay if the breach poses high risk
3. Document all breaches and remedial actions taken
4. Implement measures to prevent future occurrences

Cookie Usage

We use cookies and similar technologies to enhance your experience on our website. For detailed information about our cookie practices, please refer to our Cookie Policy.

Your Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with your local supervisory authority. For UK residents, this is the Information Commissioner's Office (ICO).

Data Protection Officer

While we are not legally required to appoint a Data Protection Officer, we have designated a privacy team responsible for overseeing GDPR compliance.

How to Exercise Your Rights

To exercise any of your GDPR rights or if you have questions about our data processing activities, please contact us:

We will respond to your request within one month of receipt. If we need more time due to complexity, we will inform you within the initial one-month period.

Updates to This Notice

We may update this GDPR compliance notice periodically to reflect changes in our practices or legal requirements. We will notify you of any material changes through our website or direct communication.

Contact Information

For all GDPR-related inquiries: