Privacy & Data Security Policy

1. Overview

Sky WHS ("we", "us") provides warehouse management and order-fulfilment software. This policy describes how we handle personal data, with particular care for buyer information we receive to pick, pack and ship orders — including data obtained from the Amazon Selling Partner API. We treat all personal data as confidential and process it only for the purposes described here.

2. Information we collect

To fulfil orders we process the minimum personal data required, which may include: buyer name, shipping address, order and item details, and order-related contact information used to generate a shipping label and tracking. We do not collect payment card numbers, and we do not use buyer information for advertising or marketing.

3. Sources of data

Amazon Information is retrieved exclusively and directly from Amazon's Selling Partner API. We do not obtain Amazon Information from any external, non-Amazon source.

4. How we use personal data

Personal data is used only to operate the fulfilment service on behalf of the seller: importing orders, generating pick/pack tasks, producing shipping labels and tracking, and providing order support. We do not sell personal data and do not share it for third-party marketing.

5. Data classification & handling

We maintain documented data-handling, classification and privacy policies together with records of processing activities. Personally Identifiable Information (PII) is classified as confidential and is subject to the strictest access, storage and disposal controls in this policy.

6. Security measures

• Encryption in transit: all traffic is served over HTTPS/TLS 1.2+.
• Encryption at rest: PII is encrypted at rest using AES-256, with encryption keys held separately from the data and managed through a controlled key-management process.
• Access control: fine-grained, role-based access restricts PII to authorised personnel on a strict need-to-know basis; each user has an individual, uniquely identified account.
• Audit logging: security-relevant events are logged, retained for at least 12 months, and reviewed on a regular (at least bi-weekly) basis to detect and investigate incidents.
• Secure application environment: the platform runs on a hardened Laravel environment — secrets kept out of source control in environment configuration, CSRF protection, hashed credentials, enforced HTTPS, and least-privilege service accounts.
• Change management: application changes are reviewed and validated in a dedicated test environment before release to production, under a defined change-approval process.
• Vulnerability management: dependencies and application code are scanned for vulnerabilities, with critical findings remediated promptly.

7. Data retention & disposal

We retain buyer personal data only for as long as needed to fulfil and support the order, and in any case no longer than 31 to 90 days after the order has been shipped. After this period the data is securely and permanently deleted from our systems and backups.

8. Sharing & sub-processors

We do not sell personal data or share it for third-party marketing. It is shared only with sub-processors strictly to run the service:

• Cloud hosting — for secure infrastructure hosting of the application and data.
• Shipping/label provider and the chosen carrier (e.g. USPS, UPS, FedEx) — solely to generate the shipping label and tracking for the buyer's order.

Access by sub-processors is least-privilege and data is encrypted in transit.

9. Your rights

Buyers and sellers may request access to, correction of, or deletion of personal data we hold, subject to legal and contractual retention obligations. Requests can be sent to the contact below.

10. Incident response & contact

We maintain an incident-response process to contain, investigate and remediate security incidents and to notify affected parties as required. For privacy questions or to report a security incident, contact our Incident Management Point of Contact at privacy@skywhs.com.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected on this page with a revised "Last updated" date.