This policy applies to MainwinERP and this website and explains how we collect, use, store, protect, share and delete information. Website requirement summaries are generated in the browser and sent by users through their email client after review.
01 / Scope
The operator is Mainwin Furniture GmbH This policy covers the website requirement tool and ERP service, including customer-provided information and Amazon information obtained within each seller’s authorization.
02 / Information collected and its purposes
Website requirements brief:You voluntarily enter your name, business email, optional company and account count, selected modules and requirements solely to prepare an enquiry. These fields are not automatically uploaded or saved in persistent browser storage. The email action hands the brief to your chosen email app; you confirm sending it to a958965018@gmail.com for a response to your enquiry. Downloading creates a local file on your device.
ERP service:After lawful authorization of the relevant account, catalog, inventory, order, fulfillment, settlement and account information is obtained only as necessary for that customer’s operations, coordination and reconciliation. Customer business data is not used for unrelated marketing or disclosed to other customers.
Restricted data:Names, addresses and invoicing fields necessary for delivery or compliant invoicing are processed only after the relevant permissions are approved, required safeguards are implemented and the customer explicitly authorizes access. No extra buyer personal information is collected for review requests.
03 / Authorization, minimization & exit
Access uses the official Amazon OAuth authorization flow; do not provide Seller Central passwords to this website. Access is separated by organization and legal entity with role-based permissions. Group operations do not give all staff access to every entity’s data.
Revoking authorization prevents future data retrieval within that scope. Previously retrieved data requires a separate deletion process; revocation does not mean every copy has been deleted.
04 / Data storage & security
Website form data is processed only in page memory; refreshing or closing clears undownloaded content. Users manage copied, downloaded or emailed copies on the relevant device or email service. The website uses HTTPS; server access logs support operations and security monitoring.
Amazon business data is stored on Alibaba Cloud servers in the country corresponding to its sales market, for example the US, UK and Germany. Primary data and backups remain in the respective country without cross-country replication. Controls include encryption in transit and at rest, Alibaba Cloud secrets management and KMS, runtime credential injection, least privilege, tenant isolation and audit monitoring. Security logs exclude buyer PII, passwords and tokens and are reviewed at least every two weeks. Incidents involving Amazon information are reported to security@amazon.com within 24 hours of detection. Systems are scanned every 30 days, before each release and after significant network, application or infrastructure changes, with penetration tests every 365 days; critical vulnerabilities are fixed and retested within 7 days and high-severity vulnerabilities within 30 days.
05 / Sharing, processors & limitations
The current requirements brief is not shared automatically. Copies, downloads or transmissions you initiate through external channels follow those channels’ rules.
Only the minimum information needed is transferred through system APIs to the relevant service recipients. Carriers FedEx, UPS, DPD, DHL and Yanwen receive delivery addresses and necessary product information to create shipping labels. Partner warehouses SLMGroup, Cainiao, Yidayun, Spreetail and COUPANG receive relevant product, fulfillment and delivery information for picking, packing and shipping. Alibaba Cloud provides hosting and storage. Each group legal entity accesses only its independently authorized data and does not receive Amazon data belonging to another legal entity. Amazon data is not shared across group legal entities. Buyer information is not shared with external accounting or tax firms, sold or used for unrelated marketing.
06 / Retention, deletion & backups
This website does not persist requirements briefs. Copies you download, copy or send must be deleted separately on your device, clipboard or recipient channel.
ERP data is retained for the shortest necessary period by field and purpose under the applicable Amazon Data Protection Policy. Buyer PII used for delivery is deleted no later than 30 days after order shipment, and earlier when no longer necessary. Statutory retention is limited to necessary fields with a clear legal basis and restricted access and use. Authorization revocation stops further retrieval; deletion processes cover historical data, caches and exports, with backups cleared through lifecycle management. We securely delete the relevant Amazon information, including primary storage, caches, exports and backup copies, within 30 days of the earliest of: an Amazon deletion notice; customer revocation or termination; loss of authorization to process the information; or termination or expiry of our participation in the services. Only necessary fields explicitly required by legal, tax or regulatory obligations are retained separately with restricted access.
Security audit logs without buyer PII are retained for at least 12 months and do not justify retaining buyer PII. Deletion covers primary storage, caches, exports and backup lifecycles, not just frontend records.
07 / Access, correction, processing cessation & deletion requests
You may request access, correction, cessation of processing or deletion through the agreed business contact channel. We should verify your relationship to the relevant entity to prevent unauthorized disclosure, and respond under applicable law and actual processing scope.
Privacy requests can be sent to a958965018@gmail.com. After verifying identity and authorization, we process and respond under applicable law and Amazon policy. Use the contact page to prepare a description without sensitive data. Do not attach identity documents or buyer information to a general enquiry.
08 / Cookies, analytics & external resources
This website itself sets no cookies, does not store forms in localStorage and uses no advertising, third-party analytics or remote fonts. Interface resources are supplied locally with the site. Changes to hosting, business forms or analytics should be accompanied by updated recipient disclosures and necessary user choices.
09 / Policy updates
When services, infrastructure or processing change, we update this policy and its version and effective date, provide appropriate notice of material changes, and maintain it under applicable regional law and Amazon data protection policies.
Regional privacy rights
Where the GDPR applies, we process business enquiries to take steps before entering a contract or to perform a contract (Article 6(1)(b)), or for legitimate interests in responding to professional enquiries and securing our services (Article 6(1)(f)). Optional consent-based processing relies on Article 6(1)(a). For seller-controlled Amazon data, the seller determines the lawful basis and purpose; we process it within documented instructions and applicable platform requirements. You may request access, correction, erasure, restriction or portability, object to relevant processing, withdraw consent prospectively, and lodge a complaint with the competent supervisory authority. Contact a958965018@gmail.com; we verify identity and respond within applicable legal time limits. Necessary order fulfillment transfers and country-specific hosting are described above; they are not a general permission to share data.