Privacy policy

APROJECTS APG PARTNERS MANAGEMENT CONSULTANCIES - FZCO. Effective 20 October 2026. This policy applies to this website, to enquiries you send us, and to the data we handle when delivering the APROJECTS Marketplace Management service and operating the APROJECTS Connect application.

1. Who we are

APROJECTS APG PARTNERS MANAGEMENT CONSULTANCIES - FZCO ("APROJECTS", "we", "us") is a free zone company licensed by the Dubai Integrated Economic Zones Authority, registration number 73310, licence number 75313, with its registered office at DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates. We are the controller of personal data relating to website visitors, prospective clients and client staff. For data belonging to a client's Amazon account, including any Amazon customer data, we act as the client's service provider (processor) and on the client's instructions. Questions about this policy go to charles@aprojectsuae.com or +971 56 104 8132.

2. Data we collect and where it comes from

We do not intentionally collect Amazon customer personal information (buyer names, delivery addresses, phone numbers, email addresses or tax identifiers). APROJECTS Connect does not request Amazon's restricted data roles. If such information is nonetheless visible to our staff while working inside a client's account, for example in a customer message, it is viewed only for the purpose of handling that message, is not copied out of Amazon's systems, and is treated in accordance with section 5.

3. How we use data and the legal basis

• To respond to enquiries and prepare proposals. Basis: your request and our legitimate interest in responding to it.
• To deliver the services in a client's agreement, such as managing listings, advertising, inventory and reporting. Basis: performance of the contract and the client's instructions.
• To invoice, keep accounts and meet legal obligations under UAE law, including tax and record-keeping requirements. Basis: legal obligation.
• To secure our systems, detect misuse and investigate incidents. Basis: legitimate interest.

We do not use Amazon account data or Amazon customer data for any purpose other than supporting the client's use of Amazon services. In particular, we do not use it to build marketing lists, to contact Amazon customers, to benchmark or profile other sellers, to train models, or for any purpose of our own. We do not sell personal data.

Where the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies, the bases above are those set out in that law. Where the UK GDPR or EU GDPR applies to a client established there, the bases are Article 6(1)(b), (c) and (f), and the client's data processing agreement with us governs our processing.

4. Sharing

We share personal data only with:

• Our staff and contractors who need it to deliver the service, each bound by confidentiality obligations and given the minimum access their role requires.
• Service providers that host our systems, email, project management and reporting tools. Each is bound by written terms requiring at least the level of protection described in this policy, and none may use the data for its own purposes. Amazon account data is only ever shared with providers that are necessary to deliver the client's services.
• Amazon, where the client's service requires us to submit data to Amazon on the client's behalf, for example a listing update or a reimbursement case.
• Authorities and advisers, where the law requires it or where necessary to establish, exercise or defend legal claims.

We do not share, publish or transfer Amazon customer data to any third party except as described above, and we never share it with any party that would use it for its own purposes.

5. How we protect Amazon account data

Our handling of data obtained through Amazon's services follows Amazon's Data Protection Policy and Acceptable Use Policy. The controls below apply to every system that stores or processes that data:

• Access control. Access is granted per person, by role, on a least-privilege basis, and reviewed at least quarterly. No shared or generic accounts. Multi-factor authentication is required on every account with access to Amazon data, including Seller Central logins and our internal systems. Accounts lock after repeated failed sign-in attempts. Access is removed within 24 hours when a staff member leaves or changes role.
• Credentials. Selling Partner API credentials and refresh tokens are stored encrypted in a managed secrets service, are never hard-coded or shared by email or chat, and are rotated regularly and immediately if compromise is suspected.
• Encryption. All data is transmitted over TLS 1.2 or higher and stored encrypted at rest using AES-256 with keys held in a managed key management service. Backups are encrypted to the same standard.
• Network and devices. Systems holding Amazon data sit behind firewalls with only necessary ports open, are patched on a defined schedule, and are separated from development and test environments. Staff devices are managed, encrypted and protected with current endpoint security.
• Logging and monitoring. Access to and changes of Amazon data are logged with the user, time and outcome. Logs are protected from tampering, monitored for unusual activity, and retained for at least 12 months.
• Vulnerability management. Vulnerability scans are run at least every 180 days and a penetration test at least annually on systems that process Amazon data. Critical findings are fixed within 7 days and high-risk findings within 30 days.
• Incident response. We maintain a written incident response plan, reviewed at least every six months, with a designated Incident Management Point of Contact. Any security incident involving Amazon data is reported to Amazon within 24 hours of detection, and affected clients are informed without undue delay. We do not represent or speak on behalf of Amazon to any regulator or customer.
• Staff. Everyone with access to Amazon data completes data protection and security training at onboarding and annually.

6. Retention and deletion

• Amazon customer personal information, if any is held, is deleted no later than 30 days after the related order is delivered, unless a specific law requires longer retention, in which case it is kept only for that purpose, offline and encrypted.
• Other Amazon account data (listings, inventory, advertising and sales reports) is kept only for as long as needed to deliver the client's services and in any case no longer than 18 months, unless the law requires longer.
• On termination of a client agreement, or on a client's or Amazon's written request, we permanently and securely delete the data within 30 days, including from live systems and, at the next backup rotation, from backups, and confirm deletion in writing.
• Enquiry data is deleted 12 months after our last contact if no engagement follows.
• Contracts, invoices and accounting records are kept for the period required by UAE law, currently five years after the end of the relationship.

Deletion is carried out using methods that make the data unrecoverable. Where a document is retained for a legal reason, the personal data in it is minimised to what the law requires.

7. International transfers

We are based in the United Arab Emirates and may work with clients based in the United Kingdom, the European Union and the United States. Where personal data is transferred across borders, we rely on the client's instructions in the service agreement, on contractual protections equivalent to the protections in this policy, and, for data subject to the UK or EU GDPR, on standard contractual clauses or the UK International Data Transfer Agreement.

8. Your rights

Depending on where you are, you may have the right to ask us to confirm whether we hold personal data about you, to access it, to correct it, to delete it, to restrict or object to its use, or to receive a copy in a portable format. To exercise any of these rights, email charles@aprojectsuae.com. We respond within 30 days. If you are an Amazon customer whose data we hold on behalf of a seller, we will pass your request to that seller and assist them in responding. You may also complain to the UAE Data Office or, where the UK or EU GDPR applies, to your local supervisory authority.

9. Cookies and this website

This website uses no advertising, analytics or tracking cookies and loads no third-party trackers. Fonts are loaded from Google Fonts, which receives your IP address for that purpose only. Our hosting provider keeps standard server logs for security, deleted after 90 days. Enquiries sent by email go directly to us and are not stored on the website.

10. Children

Our services are for businesses. We do not knowingly collect personal data from anyone under 18.

11. Changes to this policy

We will post any change on this page with a new effective date. Material changes affecting clients are also notified by email.