Privacy Policy & Data Protection Statement

1. Who we are

成华区华特新百货店 (Chenghua Huatexin Store) is a cross-border e-commerce retailer registered in the People's Republic of China. We sell general merchandise to overseas consumers on Amazon, and we operate our own internal reporting tools to manage our own selling and advertising operations.

This policy covers the internal applications we build for our own business use, including our private Selling Partner API (SP-API) application and our Amazon Ads API application. These applications are not offered, licensed, or sold to any third party, and they are used solely to access our own Amazon seller and advertising accounts.

2. Data we access

Our applications access only the minimum data needed to run our own business.

We do not access shopper personal information beyond the shipping addresses required to fulfil our own orders. We do not access data belonging to any other seller or advertiser.

3. How we use the data

All accessed data is used exclusively for our own internal business operations:

• Inventory planning, replenishment and stock-value reporting
• Sales, traffic and profitability analysis
• Advertising performance review, bid and budget optimisation for our own campaigns
• Listing optimisation and financial reconciliation

The data is never sold, rented, published, or used to provide services to any third party. It is not used to train or fine-tune machine-learning models, and it is not transferred to any external AI service.

4. Where data is stored and processed

Processing takes place on a dedicated Ubuntu server in a private VPC on Tencent Cloud (Guangzhou region, People's Republic of China), used only for this purpose and not shared with any other business system.

API credentials (LWA client identifiers, client secrets, refresh tokens and AWS access keys) are stored in a single configuration file with file permissions restricted to 600. Credentials are never committed to version control, never embedded in source code, and never transmitted anywhere except to Amazon API endpoints over TLS.

5. Security measures

• Firewall: the Tencent Cloud firewall applies a default-deny policy. Inbound traffic is restricted to SSH (port 22) for administration only; all other inbound traffic is blocked. The server does not serve any public web application.
• Network segmentation: the server sits in an isolated VPC (10.1.0.0/16) with no peering to our office network or any other business host, so there is no lateral access path.
• Intrusion detection and prevention: Tencent Cloud Host Security (basic edition) is enabled and in protected state, providing host-level trojan detection, brute-force detection, anomalous-login alerting and security event handling.
• Anti-malware: malicious-program detection on the server is covered by the host security capability described above. The workstation used for administrative operations runs the operating system's built-in anti-malware (XProtect / MRT) with automatic updates, together with Gatekeeper and System Integrity Protection.
• Encryption in transit: all communication with Amazon APIs uses TLS (HTTPS).
• Access control: multi-factor authentication is enabled on both the cloud account and the Amazon seller account. Credentials are readable only by the authorised operator.

6. Data retention

Reports and records retrieved through the APIs are retained locally for a maximum of 12 months for internal reporting and historical comparison, after which they are deleted. Personally identifiable information, such as shipping addresses, is purged within 30 days of the related order being fulfilled, unless a longer retention period is required by tax or accounting law.

7. Sharing with third parties

We have granted access to the following third-party services in the past or present, and we disclose this openly:

• LINGXING (Shenzhen Lingxing Network Technology Co., Ltd.) — ERP system for order and inventory synchronisation. This authorisation is currently disabled in Amazon Seller Central and no longer has access.
• 妙手 / Miaoshou (Shenzhen Xingyun Network Technology Co., Ltd.) — listing creation tool. This authorisation is currently disabled and no longer has access.
• WorldFirst (World First UK Ltd) — Amazon's official payment services partner, currently active. It is used only to receive settlement and payment information and does not involve buyer personal information.

Apart from the above, we do not share Amazon data with any other external party, and we do not sell or transfer Amazon data to anyone.

For product research we consult publicly available marketplace information on a third-party research website (SellerSprite). That website is an independent platform with no connection or authorisation to our Amazon accounts. We provide it with no account credentials, and it does not receive buyer personal information, order data, or any non-public data.

8. Data subject rights

Our applications do not provide a customer-facing service and do not collect data directly from Amazon shoppers. Where a data subject wishes to exercise rights under applicable data protection law (including GDPR where applicable), an enquiry may be sent to the contact address below and we will respond within 30 days.

9. Compliance

Our applications are operated in compliance with the Amazon Selling Partner API Developer Agreement, the Amazon Services Business Solutions Agreement, the Amazon Ads API License Agreement and Data Protection Policy, and applicable data protection laws.

Security incidents affecting Amazon Information are reported to security@amazon.com within 24 hours of discovery.

10. Changes to this policy

Material changes will be reflected in the "Last updated" date above.

11. Contact

For any question or data request relating to this policy:

Email: zihua074@aliyun.com
Contact person: ZiHua Li
Entity: 成华区华特新百货店 (Chenghua Huatexin Store)