Privacy Policy

1. Data controller

This privacy policy applies to Black Mango ApS. We are the data controller for the personal data we process in connection with our services.

Black Mango ApS
CVR: 44980339
Vestre Ringgade 48, 8000 Aarhus C, Denmark
Email: anders@blackmango.dk

2. Information we collect

We process the following types of information:

• Contact information such as name, email, phone number and company when you contact us or enter into an engagement.
• Client business data from Amazon Seller Central, including sales data, advertising data, inventory data, product information and account status.
• Technical data such as anonymized web analytics when you visit our website.

3. Access to Amazon Seller Central data

When we work for a client, we operate directly within the client's own Amazon Seller Central account using the permissions the client grants us through Amazon's user management. We only request the permissions necessary to deliver the agreed service, and access can be revoked by the client at any time. We do not sell or disclose a client's Amazon data to third parties.

4. Purpose and legal basis

We process the information in order to provide and manage our services, communicate with you and comply with our legal obligations. The legal basis is the General Data Protection Regulation (GDPR) Article 6(1)(b) (performance of a contract) and (f) (legitimate interest in operating and improving our business).

5. Storage and security

We retain information for as long as necessary to fulfil the purpose and in accordance with applicable law (e.g. accounting legislation). We apply appropriate technical and organisational security measures to protect the information against unauthorized access, loss or misuse.

6. Security incidents

Black Mango ApS maintains a documented incident response plan. If unauthorised access, a data leak or another security incident is suspected or confirmed, we identify and contain the incident, isolate affected systems and rotate compromised credentials. Where the incident involves Amazon-related information, we notify Amazon at security@amazon.com within 24 hours of detection. Affected clients are notified without undue delay, and the Danish Data Protection Agency (Datatilsynet) within 72 hours where legally required. After each incident we review what happened and update our controls.

7. Disclosure and data processors

We may share information with trusted data processors that provide tools for analytics, operations and communication, as well as with Amazon as part of delivering the service. Data processors only process data on our instructions and under a data processing agreement.

8. Retention period

Contact information is retained for as long as we have an active client relationship or a legitimate interest. Access to a client's Amazon data ends when the engagement is terminated, after which access is removed.

9. Your rights

Under the GDPR you have the right to:

• access the information we process about you
• have inaccurate information corrected
• have information erased (the right to be forgotten)
• object to or restrict the processing
• receive your information in a structured format (data portability)

You can exercise your rights by contacting us at anders@blackmango.dk.

10. Contact and complaints

If you have questions about this privacy policy, please contact us. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk.