Data Protection Policy

This Data Protection Policy (DPP) governs for feedmyanimal how data is collected, stored, processed, transferred, and securely disposed of, including information retrieved and used via API integrations with Amazon. This policy applies to all systems that interact with or handle data from Amazon API sources.

1. General Security Standards

To ensure a high level of data security, our organization enforces strong administrative, physical, and technical safeguards to:

Maintain data confidentiality and integrity.
Protect data from unauthorized access, alteration, exposure, or deletion.
Mitigate security risks and prevent data misuse.

To achieve this, the following security practices must be upheld:

1.1 Network Security

Our organization deploys network security controls such as firewalls and access restrictions to block unauthorized traffic, so that access to Amazon data is granted for privileged users and endpoints via firewall access rules. Intrusion detection and prevention systems (IDS/IPS) are used to monitor and prevent malicious network activities. Anti-malware solutions are implemented and updated regularly on every endpoint with access privilege. Access to development environments is restricted to trained personnel with specific security awareness training.

1.2 Access Control

A formalized user access system is in place, ensuring that each individual accessing sensitive data has a unique ID. Shared or default credentials are prohibited. Regular audits ensure that access is strictly limited to necessary personnel, and access is revoked immediately when no longer needed. User accounts are reviewed quarterly, and credentials for terminated employees are deactivated within 24 hours. Access is granted to single users based on a need-to-know principle, ensuring that only users who need the data for their specific task have access.

1.3 Least Privilege Principle

Our organization implements fine-grained access controls, ensuring that users are granted only the minimal level of access necessary for their roles and task. Access to data types are managed on need-to-know basis for each user and are reviewed quarterly. Credentials for terminated employees are deactivated within 24 hours.

1.4 Credential Management

All accounts adhere to strong password policies, requiring at least 14 characters, a mix of uppercase, lowercase, numbers, and special characters. Password policies are enforced via AD as well as Password Management Systems in dashboard. Multi-Factor Authentication (MFA) is required for all data-related access. API keys are encrypted and accessible only to authorized personnel. All passwords expire after 365 days and cannot be reused.

1.5 Data Encryption During Transmission

All sensitive data is encrypted while in transit, using secure protocols such as TLS 1.2+, SFTP, and SSH-2. Communication channels are secured against interception.

1.6 Risk Management & Incident Response

Our organization conducts annual risk assessments, reviewed by senior management, to evaluate potential threats, vulnerabilities, likelihood, and impact, tracking all identified risks. We maintain and regularly update (every 6 months after a vulnerability scan and after major changes) a detailed Incident Response Plan covering:

Clear definition of incident response roles and responsibilities.
Identification and categorization of incident types relevant to Amazon.
Detailed response procedures for each defined incident type.
Escalation paths and procedures for reporting Security Incidents to Amazon.

In the event of a Security Incident or Vulnerability:

Immediate isolation and containment of affected systems.
Notification to our internal security response team within 24 hours.

Prompt notification to Amazon via email () within 24 hours.
Comprehensive investigation and root-cause analysis.
Documentation of incident details, remediation actions, corrective measures, and implemented system/process controls.
Maintenance of chain of custody for collected evidence, available upon request by Amazon.
Notification to relevant government or regulatory agencies, as legally required.

Our organization does not represent or speak on behalf of Amazon to regulatory authorities or customers unless explicitly requested by Amazon in writing.

1.6.1 Roles, Responsibilities and Accountabilities

Incident Commander (IC): Coordination, Escalation, Accountable for Communication, Accountable for Recovery
Security Analyst (SA): First Reponse, Accountable for Risk Assessment, Logreview, Responsible for Incident Report Updates
>Technical Lead (TL): Accountable for Root cause analysis, Responsible for Patch/Hot-Fix / System-Backup
Amazon Liaison (AL): Responsible for Report to within 24 hours, Accountable for all further Amazon Communication for the incident

1.6.2 Incident Categories

Database Breach

Compromised Database
SQL Injection
Credential Stuffing

Unauthorized Access

Stolen Credits
Privilege Escalation

Data Leak: Data leaking to outside

1.6.3 Workflow

Preparation

Goal: Prevention and Training
Timeline: Ongoing
Steps: Playbooks, Table-Top Training, Contactlist updates

Detection & Analysis

Goal: Identify and evaluate the incident
Timeline: <30 Minutes from Alert
Steps: Alert is issued by the system, Incident Report is issued, SA starts Analysis and evaluates the scope, severity and incident category

Containment

Goal: Stop the spread
Timeline: <2 Hours
Steps: TL isolates the system and creates a snapshot as forensic backup,

Notification

Goal: Notifications according to law and contracts
Timeline: <24 Hours
Steps: AL sends Incident Report to security@amazon.com, If applicable an Incident Report is sent to the Regulator according to DSGVO

Eradication

Goal: Remove root cause
Timeline: <24 Hours
Steps: Root-Cause Analysis, Patch/Hot-Fix/Backup Recovery/Malware Removal

Recovery

Goal: Return to normal
Timeline: <48 Hours
Steps: Re-Deploy System, Validate the Eradication of the Root-Cause, Move to a 7 day heavy system monitoring

Post-Incident

Goal: Lessons-Learned, Prevention
Timeline: <14 Days
Steps: Closing Meeting between IC, TL, SA and AL, Report to Management, Policies Updates, Playbook Updates, Control Updates

1.6.4 Communication Matrix

SecOps

Via: Alert Notification, E-Mail
Timeline: Immediately

Management

Via: Direct Messages, Phone, E-Mail
Timeline: <1 Hour

Amazon

Via: E-Mail
Timeline: <24 Hours

Affected Customers

Via: E-Mail
Timeline: After Approval

Regulatory Office

Via: E-Mail, Online Form
Timeline: <24 Hours

1.6.5 Maintainance, Reports & Tests

Review every half-year and after an incident
Yearly Table-Top-Test of a fictional incident scenario
Quarterly Report of Mean-Time-To-Detect, Mean-Time-To-Containment, Mean-Time-To-Recovery and Incident Numbers to Management

1.7 Data Deletion

Data is permanently deleted in accordance with industry-standard protocols (e.g., NIST 800-88) within 30 days, unless legal requirements necessitate further retention. Secure deletion certificates are issued upon request.

1.8 Data Classification

Our organization maintains a clear classification system to track the origin and security level of stored data. All sensitive data are distinctly tagged within databases.

2. Additional Security Measures for Personally Identifiable Information (PII)

Special measures are in place for Amazon API integrations which provide access to Personally Identifiable Information (PII).

2.1 Data Retention

Data is retained for no longer than 30 days after the completion of order delivery and strictly for the following purposes:

Fulfillment of orders, ensuring products and services reach customers accurately and effectively, including resolving customer inquiries.

Calculation and remittance of taxes in compliance with financial regulations.

Generation of legally required documentation such as tax invoices and order confirmations.

Meeting explicit legal and regulatory requirements that mandate extended retention periods.

Any retention beyond this 30-day period occurs solely when explicitly required by applicable laws, including tax or other regulatory obligations. All PII, at any point of retention, is securely protected through robust encryption standards during both storage (encryption at rest) and transmission (encryption in transit), ensuring that data is never stored or transmitted unprotected.

Upon expiry of the retention period or upon completion of legal obligations, all PII is securely and irreversibly deleted according to recognized industry standards, ensuring permanent data destruction.

Data is stored and transmitted in accordance to our data protection regulations in encrypted and secured form as outlined in 1.5 and 2.4.

2.2 Data Governance

Appropriate practices and technical controls for data management.

Comprehensive records of data-processing activities (collection, processing, storage, usage, sharing, disposal).

Processes ensuring compliance with applicable privacy and security regulations.

Procedures for obtaining customer consent.

Respect for customer data rights (access, rectify, erase, restrict processing).

Technical and organizational procedures for data subject access requests.

Confidentiality obligations explicitly included in employee contracts handling PII.

This privacy and data-handling policy is clearly documenting and governing the appropriate practices and technical controls applied when managing and protecting information assets. A comprehensive record of data-processing activities is maintained, including specific data fields, methods of collection, processing, storage, usage, sharing, and disposal of all PII, ensuring accountability and regulatory compliance.

We have established processes to detect and comply with applicable privacy and security laws and regulatory requirements, with documented evidence of compliance regularly reviewed and updated. We ensure customer consent is obtained, and we respect all customer data rights, including the rights to access, rectify, erase, or restrict data processing, in alignment with data privacy regulations.

Technical and organizational procedures are implemented to assist Authorized Users with data subject access requests promptly and efficiently. Employment contracts explicitly include confidentiality obligations for employees handling PII, further protecting the integrity and confidentiality of sensitive information.

Data is collected only via Amazon Services such as reports available via the SellerCentral or via Amazons SP-API as well as Amazons Notification Services. Data is processed only via automated processes on our server or via users on the need-to-know and minium access guidelines detailed in 1.2 and 1.3. Data is stored in accordance to our data protection regulations in encrypted and secured form as outlined in 1.5 and 2.4. Data is used by our automated processes or via users on the need-to-know and minimum access guidelines detailed in 1.2 and 1.3. Data is shared only to privileged users which are regulated by the need-to-know and minium access guidelines detailed in 1.2 and 1.3. Data is disposed in accordance to industry standards outlined in 1.7.

Our detailed privacy and data handling policies are publicly accessible at: https://www.feedmyanimal.de/amazon-data-privacy.

2.3 Asset Security & Management

Our organization

Maintains and quarterly updates a comprehensive inventory of all software and physical assets (computers, mobile devices, servers) with access to PII.

Ensures each asset complies with baseline security standards.

Systematically applies regular patches, updates, defect fixes, and upgrades.

Implements a rigorous change management process with thorough testing, verification, and approval before changes are implemented.

Enforces segregation of duties between those approving changes and those implementing/testing changes.

Prohibits storage of PII on personal removable media, personal devices, or unsecured public cloud applications.

Securely disposes of printed documents containing PII.

Utilizes Data Loss Prevention (DLP) controls to monitor unauthorized data movement, triggering immediate alerts to IT security.

We maintain and update quarterly a comprehensive inventory of all software and physical assets (such as computers, mobile devices, and servers) with access to PII, detailing each asset's compliance with baseline security standards. Regular patches, updates, defect fixes, and upgrades are systematically applied. A rigorous change management process is in place, requiring that software and hardware changes with access to PII undergo thorough testing, verification, and approval before implementation. Segregation of duties ensures that personnel who approve changes differ from those testing and implementing changes.

PII is strictly prohibited from being stored on personal removable media, personal devices, or unsecured public cloud applications monitored by deactivated USB ports and web traffic control. Personal devices can not connect to our network based on a whitelist. All printed documents containing PII are securely disposed of. Data Loss Prevention (DLP) controls actively monitor for and detect any unauthorized data movement or access attempts, triggering immediate alerts to the IT security team.

Change Management is overseen by the Technical Lead and physical access to the storage of PII containing servers is managed by the Server Provider.

2.4 Encryption at Rest

All data is encrypted using AES-128 or RSA-2048 bit encryption. Cryptographic keys are securely stored and managed, ensuring that only authorized applications can decrypt data. All endpoints accessing data at rest have encrypted storage drives to comply with our encryption at rest regulations. All backup storages only store the already AES-128 or RSA-2048 encrypted data.

2.5 Secure Development & Testing

Sensitive credentials are never hardcoded in applications or exposed in public repositories. Credentials are stored encrypted as outlined in 2.4

Testing and production environments remain separate to prevent unauthorized data leaks.

Test environments never share data with the production environment and are based on dummy data. No PII is used or stored on test environments

2.6 Logging & Monitoring

Our organization:

Implements comprehensive logging mechanisms capturing detailed security events across application and system channels (service APIs, storage-layer APIs, administrative dashboards).

Records event outcomes (success or failure), timestamps, access attempts, data modifications, and system errors.

Utilizes real-time monitoring (SIEM tools) and conducts bi-weekly manual log reviews.

Maintains strict access controls to logs, preventing unauthorized access and tampering.

Retains logs securely for a minimum of 90.

Employs automated monitoring systems to trigger alarms for suspicious activities, prompting immediate, documented investigations per the Incident Response Plan.

We maintain comprehensive logging mechanisms that capture detailed security-related events across all application and system channels, including service APIs, storage-layer APIs, and administrative dashboards. Logs record event success or failure, date and time, access attempts, data modifications, and system errors. Real-time monitoring systems (such as SIEM tools) and bi-weekly manual reviews ensure timely detection and response to anomalies. Access controls strictly prevent unauthorized access or tampering of logs throughout their lifecycle. Logs are retained securely for at least 90 days, without storing PII. Automated monitoring triggers alarms for suspicious actions, prompting immediate documented investigations as per our Incident Response Plan. Alarms are sent via E-Mail, Control Dashboard Notifications and Direct Messages to responsible security personnel.

3. Audit & Compliance

Our organization maintains accurate records demonstrating compliance with security policies.

Audit logs and security documentation are retained for at least 12 months.

Periodic security reviews are conducted to validate compliance.

Any non-compliance findings are addressed promptly.