Privacy

Prepment is operated by Dual Vertex Ltd (“we”, “us”, “our”), a company registered in the United Kingdom. We are committed to protecting the privacy and security of personal data processed through our warehouse management system (WMS) and logistics fulfillment services.

This Privacy Policy applies to all personal data and operational information received from our client merchants and connected third-party sales channels, e-commerce platforms, and API integrations—including, but not limited to, TikTok Shop, Amazon Selling Partner API (SP-API), eBay,Temu, Shopify, WooCommerce, and any future supported marketplace APIs (collectively referred to as “Connected Marketplaces”).

1. Information We Collect

To provide automated 3PL fulfillment, inventory management, and order execution across Connected Marketplaces, Prepment accesses and processes the following categories of data authorized by sellers via secure API and OAuth protocols:

Merchant Account Information: Contact names, company registration details, and email addresses (info@prepment.com).
Order & Fulfillment Data: Order identifiers, SKUs, inventory counts, package weights, shipping carrier selections, and tracking numbers.
Restricted Personally Identifiable Information (PII): Buyer names, shipping addresses, and phone numbers required strictly to generate physical carrier shipping labels and complete order delivery.

2. How We Use Information

We process personal data solely to execute third-party logistics and software operations on behalf of authorized merchants, specifically to:

Retrieve customer orders from Connected Marketplaces in real time.
Generate carrier-compliant shipping labels, customs documentation, and packing slips.
Synchronize physical warehouse stock levels across all integrated channels to prevent overselling.
Transmit tracking updates and fulfillment statuses back to the applicable Connected Marketplace.

We do not sell, rent, lease, or monetize buyer PII, nor do we use PII for marketing, targeted advertising, profiling, or secondary commercial purposes.

3. Data Storage, Security, and Cloud Architecture

All application data, databases, and API handling services are hosted on Amazon Web Services (AWS) within the United Kingdom (eu-west-2, London) region to maintain strict data residency compliance.

Encryption at Rest: Sensitive data and buyer PII are encrypted at rest using AES-256 encryption via AWS Key Management Service (KMS).
Encryption in Transit: All data transmitted between Connected Marketplaces, our servers, and logistics partners utilizes TLS 1.2 or higher protocols.
Network Segregation: Production databases reside within isolated Virtual Private Clouds (VPCs) inside private subnets, completely shielded from public internet exposure.

4. Data Retention & Mandatory 30-Day Purge Protocol

In strict adherence to the data protection policies of our Connected Marketplaces (including Amazon’s DPP and TikTok’s DSPR):

Restricted buyer PII is retained only as long as necessary to complete physical order fulfillment.
All buyer PII is permanently and programmatically purged from our active databases within 30 days of order completion or delivery.
System logs, anonymized transaction metadata, and financial audit trails are retained in compliance with UK statutory accounting laws.

5. Data Subject Rights & Deletion Requests

Under UK GDPR and global data protection laws, individuals have the right to request access to, correction of, or permanent deletion of their personal data.
- We fully support merchants and Connected Marketplaces in fulfilling Data Subject Access Requests (DSAR) and “Right to be Forgotten” notifications.
- Upon seller request or termination of service agreements, we execute a verified cryptographic purge of all associated tenant data within 30 days.

6. Access Control & Monitoring

- Role-Based Access: Access to data is restricted to authorized personnel on a “need-to-know” basis.
- Authentication: we enforce Multi-Factor Authentication (MFA) and a strict password policy (minimum 12 characters) for all administrative access.
- Audit Logging: All access to PII is logged via AWS CloudTrail. Logs are retained for 12 months and reviewed regularly for suspicious activity.

7. Third-Party Sharing

We do not sell, trade, or share any date with third parties for marketing or advertising. Data is shared only with authorized shipping carriers (e.g., UPS, FedEx, DHL) solely to execute the shipping requested by the user.

8. Incident Response Plan

In the event of a suspected security breach, our Incident Management Point of Contact (IMPOC) will notify the security team of relevant marketplace e.g Amazon Security (security@amazon.com) within 24 hours of detection and initiate containment and forensic analysis procedures.

9. Data Isolation & Compliance Commitment of Brand & Sales Analytics

Prepment provides authorized client sellers with individualized performance dashboards to monitor real-time stock velocity, order fulfillment accuracy, and sales metrics directly from their authorized marketplaces like Amazon, Tiktok,Ebay,Temu etc

Data Isolation & Compliance Commitment (AUP Sections 4.4 & 4.5 of Amazon SP API)

No Data Aggregation (AUP 4.4): Prepment processes all analytical data especially Amazon SP-API analytics strictly on a per-client, isolated basis. We do not aggregate, pool, cross-reference, or combine seller data across multiple merchant accounts.
Confidentiality of Amazon Insights (AUP 4.5): We do not publish, sell, or disclose proprietary insights or macro-analytical reports regarding any market place like Amazon’s store or business performance. All analytical reports generated are strictly private to the authorizing seller.

10. Contact Information / IMPOC / Data Protection Officer

For privacy inquiries, security concerns, or regulatory compliance requests, please contact our Data Protection Officer:

Entity: Dual Vertex Ltd (t/a Prepment)
DPO Contact Email: info@prepment.com
Website: www.prepment.com
Registered Location: United Kingdom