Data Processing Addendum (DPA)

1. Scope and Purpose

This DPA governs the processing of Personal Data by iBuy on behalf of the Controller in connection with Amazon Seller Account Management and related operational services.

iBuy processes Personal Data solely for the purpose of providing the agreed Managed Services and only in accordance with the Controller’s documented instructions and applicable law.

2. Definitions

• “Personal Data” means any information relating to an identified or identifiable natural person.
• “Processing” means any operation performed on Personal Data.
• “Controller” means the seller or customer determining the purposes of processing.
• “Processor” means iBuy, processing data on behalf of the Controller.

3. Categories of Data and Data Subjects

Depending on the services authorized by the Controller, iBuy may process:

• Seller account identifiers and business contact details
• Customer order information provided via Amazon Seller Central or APIs
• Shipment, return, and fulfillment data
• Customer communication metadata (excluding payment credentials)

Data subjects may include end customers, business contacts, and authorized seller personnel.

4. Processing Instructions

iBuy shall process Personal Data only on documented instructions from the Controller, including those provided through Seller Central permissions, API authorizations, written agreements, or other documented communications.

iBuy does not independently determine the purposes of processing and does not sell, license, or use Personal Data for its own marketing purposes.

5. Confidentiality

iBuy ensures that all personnel authorized to process Personal Data are subject to appropriate confidentiality obligations and receive data protection training relevant to their role.

6. Security Measures

iBuy implements appropriate technical and organizational measures designed to protect Personal Data against unauthorized access, loss, alteration, or disclosure.

• Access limited to authorized personnel
• Use of Amazon-approved access mechanisms (e.g., Seller Central permissions, SP-API)
• Role-based access controls and authentication
• Secure storage and transmission practices

7. Subprocessors

iBuy may engage subprocessors (such as hosting or infrastructure providers) solely as necessary to provide the services.

iBuy remains responsible for ensuring that any subprocessors are bound by data protection obligations consistent with this DPA.

8. Data Subject Rights

iBuy shall assist the Controller, to the extent legally required and commercially reasonable, in responding to data subject requests relating to access, correction, or deletion of Personal Data.

iBuy does not respond directly to data subject requests unless instructed by the Controller or required by applicable law.

9. Data Breach Notification

In the event of a confirmed Personal Data breach affecting data processed under this DPA, iBuy will notify the Controller without undue delay after becoming aware of the breach and will provide reasonable information available to assist the Controller.

10. Data Retention and Deletion

iBuy retains Personal Data only for as long as necessary to provide the services or as required by applicable law.

Upon termination of the services, iBuy will delete or return Personal Data in accordance with applicable law and contractual obligations.

11. International Data Transfers

Where applicable, Personal Data may be processed in jurisdictions other than the Controller’s, subject to appropriate safeguards and in compliance with applicable data protection laws.

12. Liability and Precedence

This DPA forms part of the governing services agreement. In the event of conflict, the terms of the primary services agreement shall prevail, unless otherwise required by applicable law.

13. Contact

For questions regarding this DPA or data protection practices, please contact:

iBuy Managed Services
Email: privacy@ibuy.com