Data Protection and Governance

Our standards for classifying, processing, retaining and securely disposing of data

This document describes the data governance policies of Eticaretiz for classifying, processing, storing, protecting, sharing and disposing of customer, integration and transaction data.

We hold data in three main classes:

  • Public data: Corporate marketing content and publicly available product and module features.
  • Internal data: General usage statistics, application logs and system metrics.
  • Confidential / restricted data: Customer API keys, marketplace authorization tokens (OAuth), order records, buyer addresses and billing details. Restricted data is subject to our strictest security controls.

We manage data from collection to deletion through these steps:

  • Collect: Data is retrieved only from authorized accounts, over encrypted HTTPS API connections.
  • Process: Only the fields needed for the service are processed; unnecessary personal data is not processed.
  • Store: Data is stored in database structures separated per customer.
  • Protect: Data is encrypted in transit with TLS 1.2 or TLS 1.3, and access is restricted under the principle of least privilege.
  • Share: Data is never sold; it is shared only with authorized systems, and only as needed.
  • Retain: Data is kept for as long as its classification, contracts and legal obligations require.
  • Delete: Data whose retention period has ended or whose authorization has been revoked is securely deleted.
  • Least privilege: Access to infrastructure management panels and credentials is restricted to authorized system engineers.
  • Access logging: Critical read and write operations on the database and APIs are logged with identity and timestamp details.

The data of each customer or integration seller is separated through logical schemas or isolated server structures.

The retention period of each data class is set according to its classification, contractual terms and legal obligations.

When a membership ends or an integration authorization is revoked, the marketplace data of that connection is permanently deleted from our systems.

System backups are taken automatically every day. Backup files are protected with security controls in line with our data classification policies and are kept for recovery purposes only.

You can send requests to access, correct or delete your data to bilgi@eticaretiz.com.

  • Classification: Buyer personal data received from Amazon (name, address, phone number, billing details) is in the confidential / restricted class.
  • Purpose limitation: This data is processed only to ship and invoice the order and to meet legal obligations.
  • Access: Access to Amazon data is restricted under the principle of least privilege.
  • Deletion: When the seller revokes the Amazon authorization, the Amazon data of that connection is deleted.
  • Incident notification: Security incidents affecting Amazon data are reported to Amazon at security@amazon.com.
Message us on WhatsApp