Privacy Policy

LoopWay is the trading name of [LoopWay legal entity name], [Registered business address] (“LoopWay”, “we”, “us”). We build and operate e-commerce businesses and sell private-label products through our own seller accounts on Amazon and eBay.

For the personal information described in this policy, LoopWay is the data controller. Amazon and eBay are independent controllers of the information they collect when you use their marketplaces, and their own privacy notices apply to that processing.

Questions or requests about your personal information can be sent to [privacy@your-domain.com].

This policy applies to personal information we process when:

• you buy one of our products on Amazon or eBay and we fulfil your order;
• you contact us, including through marketplace messaging;
• you visit this website;
• you deal with us as a supplier, logistics partner or other business contact.

It also explains how we handle data made available to us through the Amazon Selling Partner API (“SP-API”) and eBay’s developer APIs, which we use solely to operate our own seller accounts.

Order information from marketplaces

When you place an order for one of our products, the marketplace makes limited order information available to us through its seller tools and APIs. Depending on the marketplace and the order, this may include:

• your name and delivery address;
• a phone number, where the marketplace provides one for delivery purposes;
• the order ID, items, quantities, prices, taxes and delivery option;
• shipment, tracking, delivery, return and refund status;
• messages you send us through the marketplace’s messaging service.

We never receive your payment card or bank details. Payments are taken and processed by Amazon or eBay.

Seller account and business information

Through the same APIs we access information about our own seller accounts, such as listings, inventory, pricing, fees, settlements, performance metrics and reports. This is business information about LoopWay and generally does not identify individual customers.

Information you send us

If you email us or contact us another way, we receive your name, contact details and whatever you choose to include in your message.

Website information

When you visit this website our hosting provider automatically records standard technical information, such as your IP address, browser type, the pages requested and the time of the request, to deliver the site and keep it secure. This website does not use advertising cookies or third-party tracking technologies.

We use personal information only for the following purposes:

• Fulfilling your order — picking, packing, labelling and shipping it, arranging courier collection, tracking delivery and handling returns, replacements and refunds;
• Customer service — answering your questions and resolving problems with an order;
• Legal and tax obligations — issuing invoices, keeping accounting records and meeting tax, consumer-protection and product-safety requirements;
• Security and fraud prevention — protecting our accounts, systems and customers;
• Improving our products — using aggregated, non-identifying information such as sales volumes, return reasons and review themes to improve what we make.

We do not sell personal information, use marketplace customer information for marketing, build advertising profiles, or contact marketplace customers other than through the channels and for the purposes the marketplace permits. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Where data-protection laws such as the GDPR or UK GDPR apply, we rely on the following legal bases:

• Contract — to fulfil and support the orders you place with us;
• Legal obligation — to keep tax and accounting records and meet other legal duties;
• Legitimate interests — to secure our systems, prevent fraud, run our website and improve our products, where those interests are not overridden by your rights.

We share personal information only where necessary, and only with:

• The marketplace on which you ordered (Amazon or eBay), for example to confirm shipment, upload tracking or process a return;
• Couriers, carriers and fulfilment partners, who receive the name, address and, where needed, phone number required to collect and deliver your parcel;
• Service providers who host our systems or provide IT, accounting or professional services to us, under written obligations of confidentiality and security, and only to act on our instructions;
• Authorities, where we are required to by law or to protect our rights, customers or others;
• A successor business, if all or part of LoopWay is sold or reorganised, under the same protections described here.

We never sell, rent or trade personal information, and we never disclose marketplace customer data to third parties for their own purposes.

We access Amazon data through the Selling Partner API only to operate our own Amazon seller account. We handle that data in line with the Amazon Services API Developer Agreement, the Acceptable Use Policy and the Data Protection Policy. In particular:

• we use Amazon customer information only to fulfil orders, provide customer service and meet legal obligations — never for marketing or any purpose Amazon does not permit;
• we request access only to the data and API roles needed for those purposes;
• we delete personally identifiable information about Amazon customers no later than 30 days after the order is delivered, unless a law requires us to keep it longer, in which case we keep only what that law requires, only for that purpose, and delete it afterwards;
• we encrypt Amazon customer information in transit using TLS and at rest using AES-256 or an equivalent standard;
• access is limited to people who need it to do their job, protected by unique accounts and multi-factor authentication, and logged;
• we do not share Amazon customer information with third parties except couriers and service providers acting on our behalf to fulfil the order;
• if we become aware of a security incident involving Amazon information, we notify Amazon at security@amazon.com within 24 hours of detection and follow Amazon’s instructions.

We access eBay data through eBay’s developer APIs only to operate our own eBay seller account, in line with the eBay API License Agreement and eBay’s developer policies. In particular:

• we use eBay user information only to list our products, fulfil and support orders, and meet legal obligations;
• we do not sell eBay user information or share it except as described in this policy;
• we receive eBay’s Marketplace Account Deletion and Closure notifications. When eBay tells us a user has closed their account or asked for their data to be deleted, we delete the personal information we hold about that user, except where a law requires us to retain it;
• we protect eBay user information with the same encryption, access-control and incident-response measures we apply to Amazon information, and we notify eBay promptly of any security incident affecting it.

We keep personal information only for as long as we need it:

• Amazon customer information — deleted no later than 30 days after order delivery, except where the law requires longer retention;
• eBay user information — kept only as long as needed to fulfil and support the order, and deleted promptly after an eBay account deletion notification, except where the law requires longer retention;
• Tax and accounting records — kept for the period required by applicable law, limited to what those records must contain;
• Correspondence — kept for as long as needed to resolve your query and any follow-up, then deleted;
• Website logs — kept for a limited period for security and diagnostics.

Aggregated information that no longer identifies anyone, such as monthly sales by product, may be kept for longer to run and improve the business.

We use technical and organisational measures appropriate to the risk, including:

• encryption of personal information in transit (TLS) and at rest (AES-256 or equivalent);
• API credentials and access tokens stored in encrypted secret storage, never in source code, and rotated;
• least-privilege access, unique user accounts and multi-factor authentication for systems holding personal data;
• logging and monitoring of access to personal information;
• regular software updates and vulnerability management;
• a documented incident-response process, including notification of the affected marketplace and, where required, regulators and individuals.

No system is completely secure, but we work to protect your information and review these measures regularly.

Our service providers may process information in countries other than the one you live in. Where the law requires it, we protect such transfers with appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum.

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• have inaccurate information corrected;
• have your information deleted;
• restrict or object to certain processing;
• receive your information in a portable format;
• withdraw consent, where we rely on consent;
• complain to your local data-protection authority.

California residents have the right to know, delete and correct personal information and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined under California law, and we will not discriminate against you for exercising your rights.

To exercise any of these rights, email [privacy@your-domain.com]. We may need to verify your identity before responding, and we will reply within the time the law requires — normally one month, or 45 days for California requests. You can also manage much of your order information directly through your Amazon or eBay account.

Our website and products are not directed at children under 16, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

We may update this policy to reflect changes in our practices, in marketplace requirements or in the law. The effective date at the top of this page shows when it was last changed. Where changes are significant, we will take reasonable steps to let affected people know.

[LoopWay legal entity name]
[Registered business address]

Privacy requests: [privacy@your-domain.com]
General enquiries: [hello@your-domain.com]