1. Data Controller

The controller of personal data is Semavo sp. z o.o., registered office: Al. Armii Krajowej 54, 50-541 Wrocław, Poland, entered in the National Court Register (KRS) under no. 0000876438, Tax ID (NIP) 8971887079, REGON 387816374 (the "Controller").

Data protection contact: biuro@semavo.pl, phone (+48) 690 677 551.

2. Scope

This policy covers:

1. the semavo.pl website (contact forms, cookies, analytics),
2. the Semavo Amazon integration application - the Controller's software connecting to Amazon APIs (Amazon Ads API and Selling Partner API) for the purpose of analysing and optimising sales and advertising campaigns on the Amazon marketplace, operated for the Controller and its clients.

3. Data processed within the Amazon integration

Within the integration application the Controller processes only:

• advertising data from the Amazon Ads API: campaign structures, keywords, bids, budgets and performance metrics (impressions, clicks, spend, attributed sales),
• sales and catalogue data from the Selling Partner API: listing details, inventory levels, aggregated order and session data, business reports,
• OAuth authorisation tokens (Login with Amazon) required to maintain the connection with the Amazon account.

The application does not retrieve or process buyers' personal information (names, shipping addresses, e-mail addresses of end customers). The Controller does not use SP-API Restricted Roles covering buyer personally identifiable information.

Authorisation is performed exclusively through the official Login with Amazon mechanism. The Controller never asks for, and has no access to, Amazon account passwords.

4. Purposes and legal bases (GDPR)

PurposeLegal basisAnalysis and optimisation of Amazon advertising and sales (own accounts and clients' accounts under contract)Art. 6(1)(b) and (f)Handling contact-form enquiriesArt. 6(1)(f)Direct marketing of own servicesArt. 6(1)(f)Website analyticsArt. 6(1)(f)

Data obtained from Amazon APIs is used solely for the purposes authorised, in accordance with Amazon's Acceptable Use Policy and Data Protection Policy. It is never used for third-party advertising purposes or resold.

5. Data security

• Authorisation tokens are stored encrypted at rest (AES symmetric encryption); encryption keys and other secrets are kept in a dedicated secret manager, outside application code and repositories.
• All data in transit is protected with TLS/HTTPS.
• Access to data is limited to authorised staff and contractors of the Controller, to the extent necessary to provide the services.
• Application infrastructure is hosted in data centres located in the European Economic Area.
• Login and data-entry areas of the website are protected with an SSL certificate.

6. Recipients and processors

Data is not sold or shared with third parties for their own purposes. The Controller uses the following infrastructure processors:

• Google Cloud (Google Ireland Ltd.) - hosting of the integration application (EU region),
• Supabase - application database (EU region),
• Webflow, Inc. - hosting of the semavo.pl website,
• website analytics and marketing tool providers (Google Analytics, Meta Pixel) - as described in the cookies section.

7. Retention

• Amazon API data: for the duration of the service / integration.
• Authorisation tokens: until authorisation is revoked or the service ends, after which they are permanently deleted.
• Form data: for the time necessary to handle the enquiry.

Revoking access: the application's authorisation can be withdrawn at any time in the Amazon account settings (Seller Central: Settings -> Manage your apps / Login with Amazon: Manage apps). Upon revocation the Controller deletes the related tokens.

8. Data subject rights

Every data subject has the right of access, rectification, erasure, restriction of processing, data portability, objection, and the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland). To exercise these rights contact: biuro@semavo.pl.

9. Forms, logs and cookies

Data submitted in website forms is processed for the purpose indicated by the form (e.g. handling an enquiry). The website stores standard server logs (IP address, request time) for administration and security. The website uses first-party cookies (site functionality) and third-party cookies (Google Analytics - statistics, Meta Pixel - remarketing). Cookies can be controlled in browser settings; restricting them may affect some site features.

‍