Privacy Policy

1. Who we are and how to contact us

2. The data we collect

2.1 Amazon Advertising data (obtained via Amazon Ads API authorization)

When you authorize us to access your Amazon Advertising account through Amazon’s Login with Amazon consent screen, we obtain access (via Amazon Ads API) to:

• Your Amazon Seller or Vendor profile name and profile ID.
• Campaign, ad group, keyword and bid configuration.
• Performance metrics including spend, impressions, clicks, sales, and conversion data.
• ASIN-level performance data.
• Inventory and product data limited to what is required to optimize your advertising.

We do not request or use Amazon Personally Identifiable Information (PII) about end shoppers. Where Amazon Data we receive incidentally contains PII, we treat it in accordance with Amazon’s Data Protection Policy and delete it within the timeframes that policy requires.

2.2 Website and contact data

• Information you provide via contact forms, sales enquiries, or email correspondence (name, company, email, phone, message content).
• Standard web log data (IP address, browser type, page accessed, timestamp) and cookies as described in our cookie notice.

2.3 Client engagement data

• Service agreements, invoices, and communication records necessary to deliver and bill for our services.

3. Why we use this data

We do not sell, rent, trade, or share your data with third parties for their independent marketing.

4. Sharing and sub-processors

We share data only with:

• Amazon — by virtue of the Ads API integration itself, and where required to report security incidents or comply with Amazon’s Data Protection Policy.
• Service providers acting on our instructions under written contracts (for example, hosting, email, productivity, and accounting providers). Each is bound to confidentiality and security obligations consistent with this policy.
• Authorities where required by law.

5. International transfers

Our team and some of our service providers operate outside Taiwan. Where personal data is transferred internationally, we ensure an appropriate level of protection through contractual safeguards and by selecting providers who maintain recognized security certifications.

6. Retention

• Amazon Advertising data: retained only while you are an active client. Within 90 days of the end of our engagement we delete or aggregate-and-anonymize the data we hold, unless we are required by law or by Amazon’s policies to retain it longer.
• Personally identifiable order data received from Amazon: deleted within 30 days of order delivery, in line with Amazon’s Data Protection Policy.
• Client engagement and accounting records: retained for the period required by Taiwan tax and commercial law.
• Website logs: retained for up to 12 months for security and operational purposes, then deleted.

7. Security

We protect personal data with a documented security program that includes:

• An Incident Response Plan, approved by senior management and reviewed every six months.
• A designated Incident Management Point of Contact reachable on a 24×7 basis for security incidents affecting Amazon Data.
• A Security Incident Reporting Procedure, including notification of Amazon within 24 hours of becoming aware of any incident affecting Amazon Data, via the channel specified in Amazon’s Data Protection Policy.
• Access controls including least-privilege user accounts, multi-factor authentication on all systems that process Amazon Data, and removal of access for departing personnel within 24 hours.
• Encryption of personal data in transit (TLS) and at rest where supported by the underlying platform.
• Vulnerability management with remediation of critical-risk vulnerabilities within 7 days and high-risk vulnerabilities within 30 days of discovery.
• Audit logging of access to systems holding personal data, with regular review.

A summary of our incident response and reporting procedures is available to clients and to Amazon upon request.

8. Your rights

Under Taiwan’s PDPA you have the right to (i) ask whether we hold personal data about you, (ii) request a copy, (iii) request correction or supplementation, (iv) request that we stop collecting, processing or using your data, and (v) request deletion. To exercise these rights, contact admin@essentialmarketing.com.tw. We respond within the timeframe required by the PDPA.

If you believe we have processed your data unlawfully, you may also lodge a complaint with the competent Taiwan authority.

9. Reporting security or privacy concerns

If you believe you have discovered a security vulnerability in our services, or that personal data — including Amazon Data — has been misused, please report it to us via security@essentialmarketing.com.tw or via the intake form at https://essentialmarketing.com.tw/security/. We acknowledge reports within one business day and respond in line with the timelines published on that page.

10. Changes to this policy

We will update this policy from time to time. Material changes will be noted on this page with a revised “Last updated” date. Where required by law we will also notify affected clients directly.

Document control