Connectivity application policy
This policy applies to the Waadby application connected to Amazon SP-API, which serves professional sellers who authorise account access. The corporate website does not perform that connection or receive orders or buyer data through that integration.
Professional work by WAADBY staff in Seller Central is a separate service modality, subject to the contracted service and the specific authorisations and permissions applicable to staff. Its scope is described in the general privacy policy.
The seller determines the purposes of order processing. Waadby acts as processor under the agreement and the seller’s documented instructions.
Data and purpose
The application uses catalogue and order data needed for authorised features. Buyer information, such as identification, contact or delivery details present in orders, is restricted to necessary fields and authorised permissions.
Order information is made available to the seller to manage orders. The seller determines and manages subsequent operations.
Use limits
Access depends on seller authorisation and Amazon roles. Information is not sold or used for buyer marketing, advertising, profiling or unrelated databases. Support access is restricted to information needed to resolve incidents.
Access and protection policy
The service policy requires individual accounts, least privilege, multifactor authentication, credential protection, encrypted connections and protection of stored data and backups under the DPP. It requires customer data separation, access reviews and removal, activity logging, vulnerability and incident management and applicable security testing.
Credentials and buyer data are restricted to authorised personnel and are not published on this website.
Retention and deletion
Buyer personal data retention is limited to the authorised purpose and a maximum of 30 days after order delivery. Only a specific legal obligation justifies longer retention in separate, restricted, encrypted storage. Non-personal data remain only while needed for the permitted purpose.
The policy requires deletion within 30 days of revocation, termination, loss of authorisation or Amazon’s deletion request, except where legally required. Deletion covers operational instances and is coordinated with backup lifecycles to prevent inappropriate restoration.
Providers and recipients
Hetzner Online GmbH provides hosting in Germany. Its subprocessor role is subject to the processing agreement and applicable seller authorisation. Sellers receive their order information. Providers do not receive access for their own purposes and data are not sold.
Buyer rights
Buyers can contact the seller, as controller of order data, to exercise their rights. Waadby assists the seller with requests. Requests concerning data processed on the seller’s behalf are referred to that seller. Contact: info@waadby.com.
Incident management
The policy requires documenting, containing and investigating incidents and notifying Amazon within 24 hours of detection where Amazon information is affected. Waadby notifies the seller of personal-data breaches without undue delay and assists with GDPR notification obligations.
Applicable Amazon terms
The service is governed by the Data Protection Policy, Acceptable Use Policy and applicable SP-API agreements, alongside the GDPR and LOPDGDD. This policy incorporates purpose, access, retention and deletion limits. Mentioning Amazon does not imply certification, sponsorship or endorsement of Waadby.
Amazon SP-API: Data Protection Policy, Acceptable Use Policy, Solution Provider Portal Agreement
Document review: 19 October 2026. Contact: info@waadby.com.