Privacy Policy

This privacy policy applies to the website https://www.sidcorp.co and the related services provided by SID Corp, including software applications we develop for Amazon sellers. It describes how we handle your personal data when you visit the website, contact us or use our services.

The entity responsible for processing data is Sid Corp JSC. You can reach us about data protection matters at [email protected].

By continuing to use the website and services, you confirm that you have read and understood this policy. If you do not agree with any part of it, please stop using the services and contact us.

We collect two groups of information: information you provide directly and information collected automatically when you use the website.

Information you provide directly

This is data you actively send us, for example when filling in the contact form, requesting a quote, subscribing to updates or exchanging emails. It may include:

• Full name
• Email address
• Phone number
• Company name and job title (if you provide them)
• The content of your message, project brief or any documents you attach

You decide what information you want to provide. If required information is not provided, we may be unable to respond to your request or deliver the service.

Information collected automatically

When you visit the website, some data is collected automatically using standard web technologies:

• Cookies and similar technologies — to store preferences and help recognise your session (see Section 6).
• Log data — IP address, browser type, operating system, pages visited, and the time and date of access.
• Analytics data — on-page interaction such as pages viewed, time on page and traffic source, in aggregated and statistical form.

We do not intentionally collect sensitive data through these automatic channels.

We only use personal data for legitimate purposes necessary for our operations. Specifically, we use your information to:

• Respond to contact requests, provide consultation and send quotes.
• Provide, operate and improve the services agreed with you.
• Send updates, materials or newsletters where you have subscribed (you can unsubscribe at any time).
• Analyse and improve the experience, performance and security of the website.
• Comply with legal obligations and protect the legitimate rights of all parties.

We do not sell your personal data to third parties.

Where the GDPR or similar regulations apply, we process personal data on one or more of the following legal bases: your consent, the performance of a contract with you, our legitimate business interests, and compliance with legal obligations.

We only share personal data where necessary and with partners that have corresponding confidentiality commitments.

Service providers

We may share data with service providers that support our operations, limited to the work they perform for us, including:

• Hosting and infrastructure — storing and operating the website and applications.
• Analytics — measuring and improving website effectiveness.
• Email services — sending transactional emails, replies and newsletters.

These providers only access the minimum data necessary and are bound by confidentiality obligations.

International transfers

Some of our service providers may be located outside your country. Where personal data is transferred internationally, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) to ensure your data remains protected.

Legal requirements

We may disclose information where we believe it is necessary to comply with the law, regulations or a valid request from a competent state authority; to enforce our service terms; or to protect the rights, property and safety of SID Corp, our users and the public.

We apply technical and organisational measures to protect personal data against unauthorised access, use or disclosure.

Security measures

• Encryption in transit — all data exchanged with the website and services is protected using TLS (Transport Layer Security) 1.2 or higher.
• Encryption at rest — sensitive personal data, including any third-party API credentials, is encrypted at rest using industry-standard algorithms (AES-128 or AES-256).
• Key management — encryption keys are held in a dedicated key management system (KMS) with strictly limited access.
• Kubernetes infrastructure — services run on containerised infrastructure with secure configuration and environment isolation.
• Access control — access to personal data is restricted to authorised personnel and protected with strong password policies and multi-factor authentication (MFA) where feasible.

Although we apply reasonable measures, no method of transmitting or storing data is absolutely secure. We do not guarantee absolute security, but we always work to protect your data to the highest degree possible.

Retention period

We only retain personal data for as long as necessary for the purposes described in this policy, or as required by law. When data is no longer needed, we securely delete or anonymise it. If you deactivate your account or ask us to delete your data, we permanently remove or anonymise it from our active systems within a reasonable timeframe, unless retention is required for legal, regulatory or security reasons.

The website uses cookies and similar technologies to operate, remember preferences and analyse traffic. Cookies help the site work correctly and improve your experience.

We may use the following types of cookies:

• Essential cookies — ensure the website runs and provide basic security.
• Preference cookies — remember settings such as language and login session.
• Analytics cookies — measure aggregated traffic and visit behaviour.

Non-essential cookies are only set with your consent, which you can manage or withdraw at any time in your browser settings. Note that disabling some cookies may affect website functionality.

You have rights over your personal data. Depending on applicable law, these rights include:

• Right of access — request to know what data we hold about you.
• Right to rectification — request that inaccurate data be updated or corrected.
• Right to erasure — request deletion of data in appropriate cases.
• Right to data portability — receive a copy of the data you provided in a structured, commonly used format.
• Right to object and restrict — object to or request restriction of certain processing, including receiving marketing emails.
• Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting processing carried out beforehand.

To exercise these rights, please contact us using the details in Section 10. We will respond within a reasonable time as required by law. You also have the right to lodge a complaint with your competent data protection authority.

Our website and services are aimed at business customers and users of legal age, and are not directed at people under 18. We do not knowingly collect personal data from anyone under 18.

If you believe we have inadvertently collected data from a person under 18, please contact us so we can delete that information.

Some of our services help sellers analyse and optimise their Amazon business. Where you connect your Amazon account, we access data through the Amazon Selling Partner API ("SP-API") strictly in accordance with the Amazon Acceptable Use Policy and the Amazon Data Protection Policy ("DPP").

What we access and why

With your authorisation, we access your SP-API access credentials together with advertising, order and seller information, solely to provide analytics, reporting and advertising optimisation to you. We use Amazon-derived data only for these purposes.

Purpose restriction and no sale of data

We do not sell or rent Amazon-derived data, and we never use it for advertising or for any purpose not expressly permitted by Amazon. Any interaction with Amazon (for example, account verification) is handled in compliance with the DPP.

Retention and deletion

We delete personally identifiable information originating from SP-API (for example, customer address information) within 30 days after an order is fulfilled, unless a longer retention period is required by law. When you disconnect your Amazon account, the related credentials and data are revoked and deleted.

Encryption and access control

Amazon data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-128 or AES-256), with encryption keys held in a key management system. Access is restricted to authorised personnel who require it to perform their role.

Incident response

If a security incident involving Amazon data occurs, we notify Amazon within 24 hours and inform affected individuals where applicable. We designate an Incident Management Point of Contact (IMPOC), reachable at [email protected], who is available to coordinate the response to any data leakage or security breach.

Audit cooperation

We cooperate fully with Amazon in the event of any audit or assessment of our data protection practices relating to SP-API data.

We may update this policy from time to time to reflect changes in our operations, technology or the law. Updates will be posted on this page with a new revision date. We encourage you to review it periodically.

If you have questions, requests or complaints regarding personal data, please contact Sid Corp JSC at [email protected]. We will receive and respond within a reasonable time as required by law.

If you would like advice on our software services, please contact the SID Corp team for a solution consultation.