my account

Privacy Policy for Amazon Customers

Information on the Processing of Personal Data in Connection with Orders Placed through Amazon Marketplace and the Amazon Selling Partner API (SP-API)

Last updated: October 29, 2026

1. Data Controller

The entity responsible for processing personal data in connection with the fulfillment of our Amazon orders is:

HCS Ausrüstungs GmbH
CEO: Mathias Himstedt und Ludwig Himstedt
Am Heiligenholz 8
38667 Bad Harzburg
Germany

E-Mail: info@hcs-ausruestung.de
Website: hcs-ausruestung.de

 

Data Protection Officer, if appointed: Mathias Himstedt

2. Scope of This Privacy Policy

This Privacy Policy applies to the processing of personal data of customers who purchase products from us through Amazon Marketplace or contact us in connection with an Amazon order.

It specifically covers the processing of order and customer information made available to us through Amazon Seller Central or the Amazon Selling Partner API (SP-API).

The processing of personal data carried out independently by Amazon is governed by Amazon's own privacy policies.

3. Collection and Categories of Personal Data

When you place an order with us through Amazon, Amazon provides us with the information necessary to process and fulfill your order.

Depending on the order and the information made available, this may include:

  • First and last name

  • Shipping and, where applicable, billing address

  • Contact information provided by Amazon

  • Amazon order number

  • Products ordered and quantities

  • Purchase prices and applicable tax information

  • Shipping methods and delivery information

  • Shipment tracking numbers

  • Information relating to cancellations, returns, and refunds

  • Order-related customer inquiries

This information is obtained through the interfaces and administrative functions provided by Amazon.

We process only the personal data necessary to fulfill the respective order and comply with applicable legal obligations.

4. Purposes and Legal Bases for Processing

We process your personal data exclusively for specified and lawful purposes.

a) Order Processing and Fulfillment

This includes:

  • Receiving and processing your order

  • Verifying ordered products

  • Organizing shipment and delivery

  • Preparing invoices and shipping documents

  • Transmitting shipping information to Amazon

  • Processing returns, cancellations, and refunds

  • Communicating with you regarding your order

The legal basis for this processing is Article 6(1)(b) of the General Data Protection Regulation (GDPR), as processing is necessary for the performance of a contract.

b) Compliance with Legal Obligations

We process and retain certain personal data where necessary to comply with applicable commercial, tax, accounting, and other statutory obligations.

The legal basis is Article 6(1)(c) GDPR.

c) Security and Proper System Operation

Where necessary, we process technical information to maintain the security and proper functioning of our order management systems and prevent unauthorized access.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to protect our IT systems and the personal data processed within them.

5. Processing through the Amazon Selling Partner API (SP-API)

To manage and fulfill Amazon orders, we use the official Amazon Selling Partner API (SP-API).

This interface enables secure and authorized data exchange between Amazon and our order management systems.

The API may be used to retrieve orders, process shipping information, and update order statuses.

We access and process Amazon customer information only to the extent necessary for legitimate and authorized business operations.

When using the API, we comply with applicable Amazon data protection and security requirements, particularly the Selling Partner API Data Protection Policy (DPP) and Acceptable Use Policy (AUP).

Personal data obtained through the SP-API is not used for independent advertising, the sale of customer information, or the creation of marketing profiles.

6. Use of Technical Service Providers

We may use qualified technical service providers and software solutions to manage and fulfill orders.

These services may support activities such as:

  • Order processing and management

  • Invoice generation

  • Shipping and fulfillment

  • Secure storage and technical protection of necessary information

Where service providers process personal data on our behalf, this is carried out under appropriate data processing agreements in accordance with Article 28 GDPR.

Service providers are granted access only to the personal data necessary to perform their assigned tasks.

We implement appropriate contractual, technical, and organizational measures to protect personal data processed by such providers.

7. Disclosure of Personal Data

We disclose personal data only where necessary for contract fulfillment or where required by law.

Potential recipients include:

Shipping and Logistics Providers

We transmit the recipient information necessary to deliver your order to the shipping company responsible for fulfillment.

Technical Service Providers

External service providers supporting our order management systems or IT infrastructure may have access to personal data to the extent required for their services.

Tax Advisors and Public Authorities

Where required by law, relevant information may be disclosed to tax advisors, financial authorities, or other competent public authorities.

We do not sell or disclose personal customer data to third parties for advertising purposes.

8. Data Security

We implement appropriate technical and organizational security measures to protect personal data against unauthorized access, loss, alteration, and unlawful disclosure.

These measures include, in particular:

  • Encryption of data during transmission

  • Secure storage of personal data

  • Restricting access to authorized personnel

  • Appropriate authentication and authorization mechanisms

  • Protection of IT systems and infrastructure

  • Regular reviews of data security measures

  • Procedures for detecting and responding to security incidents

Our security measures are reviewed and adjusted in accordance with applicable legal and contractual requirements.

9. Data Retention and Deletion

We retain personal data only for as long as necessary to fulfill the relevant lawful purposes or comply with statutory retention obligations.

For Amazon customer information processed through the SP-API, we observe Amazon's specific data retention restrictions.

Where applicable, personal customer data obtained through the SP-API is generally deleted no later than 30 days after delivery of the respective order, unless a longer retention period is required by law.

Data that must be retained to comply with statutory recordkeeping or documentation obligations will be stored only to the extent necessary and used exclusively for those purposes.

This applies in particular to tax-relevant invoices and accounting records.

Once the applicable retention periods have expired, the relevant personal data will be deleted unless another lawful basis requires its continued processing.

10. No Use of Customer Data for Advertising

We do not use personal data obtained in connection with Amazon orders for unsolicited advertising.

In particular, we do not:

  • Add Amazon customers to marketing or newsletter mailing lists solely based on their purchases

  • Disclose customer information to data brokers

  • Create personalized advertising profiles

  • Use Amazon customer data for external advertising campaigns

  • Use customer data to train artificial intelligence systems

Order-related communications are limited to legitimate customer service and transaction-related purposes.

11. International Data Transfers

Personal data may be transferred to countries outside the European Union (EU) or European Economic Area (EEA) only where the applicable legal requirements are satisfied.

Where such transfers occur, we ensure compliance with Articles 44 et seq. GDPR.

Appropriate safeguards may include an adequacy decision by the European Commission or suitable contractual protections, such as the European Commission's Standard Contractual Clauses.

12. Rights of Data Subjects

Subject to the applicable legal requirements, you have the following rights regarding your personal data:

  • Right of Access: Article 15 GDPR

  • Right to Rectification: Article 16 GDPR

  • Right to Erasure: Article 17 GDPR

  • Right to Restriction of Processing: Article 18 GDPR

  • Right to Data Portability: Article 20 GDPR

  • Right to Object: Article 21 GDPR

  • Right to Withdraw Consent: Article 7(3) GDPR, where processing is based on consent

You may exercise these rights by contacting us using the contact information provided in Section 1.

If your request concerns information processed exclusively by Amazon, you may also need to contact Amazon directly.

13. Right to Lodge a Complaint

Under Article 77 GDPR, you have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection laws.

14. Automated Decision-Making

We do not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR in connection with our processing of Amazon order data.

15. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy when necessary due to changes in applicable laws, technical processes, or Amazon's data protection and security requirements.

The current version will be made available on our website.

16. Contact Information

If you have any questions regarding the processing of your personal data in connection with an Amazon order, please contact:

HCS Ausrüstungs GmbH

Email: info@hcs-ausruestung.de
Website: hcs-ausruestung.de