Last updated 15 October 2026
This policy sets out how Prolisto Ltd ("Prolisto", "we", "us") meets Amazon's requirements for the receipt, storage, use, transfer and disposal of data retrieved from the Amazon Selling Partner API. It applies to every system that stores, processes or otherwise handles that data.
It supplements the Amazon Selling Partner API Developer Agreement and Amazon's Acceptable Use Policy. We understand that failing to comply with them may lead to the suspension or termination of our Selling Partner API access.
Prolisto Ltd is a company registered in Scotland, company number SC878108. Questions about this policy can be sent to info [at] prolisto.com.
Definitions
These terms have the meanings Amazon gives them:
- "Application" means Prolisto's software as it interfaces with the Amazon Marketplace APIs or the API materials.
- "Amazon Information" means any information that Amazon exposes through the Marketplace APIs, Seller Central or Amazon's public-facing websites. It includes public and non-public information, and Personally Identifiable Information about Amazon customers.
- "Authorized User" means a user of Amazon's systems or services who has been specifically authorised by Amazon to use them.
- "Customer" means any person or entity who has bought items or services from Amazon's public-facing websites.
- "Developer" means any person or entity that uses the Amazon Services API or the API materials for a permitted use on behalf of an Authorized User. In this policy, the Developer is Prolisto.
- "Personally Identifiable Information" (PII) means information that can be used on its own or with other information to identify, contact or locate an individual (such as a Customer or an Authorized User), or to identify an individual in context. This includes, but is not limited to, a name, address, email address, phone number, gift message content, survey response, payment details, purchases, cookies, digital fingerprint (such as browser or device), IP address, geolocation and internet-connected device product identifier.
- "Security Incident" means any actual or suspected unauthorised access to, or collection, acquisition, use, transmission, disclosure, corruption or loss of, Amazon Information. It also means any breach of an environment that either contains Amazon Information, or is managed by us with controls substantially similar to those protecting Amazon Information.
1. General security
We maintain physical, administrative and technical safeguards, and other security measures, in line with industry-leading security standards and Amazon's requirements for the classification and sensitivity of Amazon Information. They are designed to:
- keep Amazon Information that we access, collect, use, store or transmit secure and confidential
- protect it from known or reasonably anticipated threats or hazards to its security and integrity, from accidental loss, alteration or disclosure, and from all other unlawful forms of processing
In particular, we meet the requirements below.
1.1 Network protection
All our servers have network protection controls, including network firewalls. Public access is not allowed, and access is only permitted to specific systems based on IP address.
1.2 Access management
Access to Amazon Information is strictly limited to people who need it to carry out specific tasks, and wherever possible only to the data those tasks require. Everyone with access has a unique user ID. We never create or use generic, shared or default logins or user accounts.
We review the list of people and services with access every 90 days and remove any account that no longer needs it. Storing Amazon Information on personal devices is strictly restricted. When someone leaves the company, their access and permissions are revoked immediately.
We enforce account lockout. Suspicious activity, such as repeated failed logins or an unusually large number of requests, causes the account's permissions to be revoked immediately and investigated by our IT administrators.
1.3 Encryption in transit
All Amazon Information is encrypted in transit using HTTP over TLS (HTTPS) whenever it crosses a network or moves between hosts. This applies to every relevant internal and external endpoint. Where TLS would terminate on untrusted multi-tenant hardware, such as an untrusted proxy, we also encrypt at message level.
1.4 Incident response
We maintain an incident response plan for Security Incidents and for interruptions to, or degradation of, our services and systems. It defines procedures for each type of incident according to its impact and urgency, and an escalation path for reporting Security Incidents to Amazon.
We review the plan every 6 months, and after any major change to our infrastructure or systems. For every Security Incident we investigate and record a description of the incident, the actions taken to fix it and any controls put in place to stop it happening again. We maintain the chain of custody for all records collected, and make this documentation available to Amazon on request.
In line with Amazon's Data Protection Policy, we will tell Amazon by email to [email protected] within 24 hours of detecting any Security Incident.
We will not notify any regulator or customer on Amazon's behalf unless Amazon asks us to in writing. Amazon has the right to review and approve the form and content of any notification before it is given to a third party. Where a notification is required by law, Amazon has the right to review its form and content before it is given to anyone.
We will tell Amazon within 24 hours if its data is sought through legal process or under applicable law.
1.5 Deletion or return on request
Within 72 hours of a request from Amazon, we will permanently and securely delete Amazon Information, in line with the NIST 800-88 standard for media sanitisation, or return it, as Amazon's notice requires. We will permanently and securely delete all live (online or network-accessible) copies of Amazon Information within 90 days of Amazon's notice. If Amazon asks, we will confirm in writing that all Amazon Information has been securely destroyed.
1.6 Passwords
Every person and system with access to Amazon Information must meet our minimum password requirements:
- at least 12 characters
- no part of the user's name
- a mix of upper-case letters, lower-case letters, numbers and special characters, with a minimum number of each
- a minimum password age of 1 day and a maximum of 365 days before it must be changed
1.7 Least privilege
We use fine-grained access controls so that anyone using the Application, and the Application's authorised operators, are given rights on the principle of least privilege. Access to Amazon Information is granted on a need-to-know basis.
2. Additional rules for Personally Identifiable Information
The Application's Amazon data includes both PII and non-PII, so the rules below apply to our entire Amazon data store.
2.1 Data retention
We keep PII only to fulfil orders, and for no more than 30 days after the order has shipped and delivery has been confirmed online. We keep it longer only where the law requires us to, and only to comply with that law. As set out in 1.3 (encryption in transit) and 2.4 (encryption at rest), PII is never transmitted or stored unprotected.
2.2 Data governance
Our asset management policy sets out how software and physical assets are recorded in an inventory and how the inventory is kept up to date when assets are added or reassigned. It also sets out how data is cleansed when assets are reassigned or removed. The policy is reviewed every 6 months, when we also carry out a full asset inventory.
Our privacy policy is publicly available and states our compliance with all applicable data protection laws.
2.3 Data access
Within our organisation, access to data is granted on a need-to-know basis, both to people we employ or contract and among the Application's users. We will tell Amazon at [email protected] within 30 days of any organisational change or event that changes our need for, or use of, Amazon Information.
2.4 Encryption at rest and storage
All PII is encrypted at rest using AES-256. The cryptographic keys and capabilities used to encrypt PII at rest are accessible only to our own system processes and services.
We do not store PII on removable media (such as USB or flash drives), on personal devices or in unsecured public cloud applications (such as Google Drive or Dropbox). Documents containing PII are never printed.
2.5 Secure coding
We never hard-code sensitive credentials, including encryption keys, secret access keys and passwords, and never expose them in public code repositories. We keep separate test and production environments.
2.6 Logging and monitoring
We collect logs to detect security-related events in the Application and our systems, including whether each event succeeded or failed, its date and time, access attempts, data changes and system errors. Logging is in place on every channel that gives access to Amazon Information, and only authorised staff can see the logs.
Logs are reviewed with a security information and event management (SIEM) tool, either in real time or every two weeks. They do not contain PII and are kept for 90 days for reference in case of a Security Incident. Our monitoring also sends real-time email alerts for suspicious activity, such as repeated unauthorised calls or an unexpected request rate. When an alert is raised, we follow our incident response plan (see 1.4).
2.7 Vulnerability management
We maintain a plan for finding and fixing vulnerabilities. We scan physical hardware containing PII for technical vulnerabilities at least every 180 days, and scan our code for vulnerabilities before every release.
2.8 Asset management
We maintain a baseline standard configuration for our information systems. We keep an inventory of software and physical assets (such as computers and mobile devices) with access to PII and update it every quarter, in addition to the full inventory in 2.2. Every physical asset that stores, processes or otherwise handles PII must meet all the requirements of this policy, including the storage rules in 2.4.
3. Audit and assessment
We keep the books and records reasonably needed to verify our compliance with Amazon's Acceptable Use Policy, Data Protection Policy and the Amazon Selling Partner API Developer Agreement, for as long as the agreement lasts and for 12 months afterwards. If Amazon asks in writing, we will confirm in writing that we comply with these policies.