Fluid Inventory: privacy and data handling policy
Fluid Inventory is the warehouse management system Pozzani Australasia Pty Ltd uses to receive, pick, pack and despatch its orders. It connects to the online marketplaces and web shop we sell through (Amazon, eBay and others) to collect orders that need fulfilling and to confirm when they have been despatched. This policy describes how the order information obtained from those marketplaces ("marketplace data", which for Amazon means Amazon Information as defined in Amazon's Data Protection Policy) is collected, processed, stored, used, shared and disposed of.
1. What we collect
For each paid order we collect only what is needed to fulfil it:
| Data | Why |
|---|---|
| Marketplace order number, order date, order status | To identify the order and avoid duplicates |
| Items ordered: SKU, title, quantity | To pick and pack the right goods |
| Recipient name, delivery address, contact phone number and email address | To address the parcel and for the carrier to deliver it |
| Despatch details we create: carrier and tracking number | To confirm despatch to the marketplace and the customer |
We do not collect payment card details, buyer account passwords or any marketplace data beyond what the fulfilment of the order requires. We only ever request the marketplace permissions (roles) needed for orders and shipment confirmation.
2. How we collect it
Fluid Inventory calls the marketplace's official seller API (for Amazon, the Selling Partner API) over HTTPS using credentials issued to our seller account, at short intervals, to retrieve new paid orders. Nothing is collected by scraping, by email forwarding or by third-party aggregators.
3. How we process and use it
Marketplace data is used solely to fulfil the order: to allocate stock, print a pick list, pack the goods, produce a carrier label, despatch the parcel, confirm despatch and tracking back to the marketplace, and to record the fulfilment for our own invoicing and stock records. It is not used for marketing, profiling, analytics beyond fulfilment reporting, or any purpose unrelated to the order. It is not combined with data from other sources except our own stock and carrier records.
4. Where and how it is stored
- All marketplace data is held in a database on a single server on Amazon Web Services (AWS EC2, Ireland region). It is not stored on staff computers, phones or removable media, and there is no file export containing buyer details.
- The database accepts connections only from the server itself; it has no public endpoint. The server's firewall (AWS security group) exposes only HTTPS to the internet; administrative access is by SSH key from our office network only.
- All access to the system is over HTTPS (TLS). Marketplace API credentials are stored encrypted (AES-256) with the key held outside the database, and are never displayed once entered.
- Our data is in its own database with its own user accounts; no other business using the system can see it.
- Backups, where taken, are encrypted and held within AWS in the same region, and are subject to the same retention limits as live data.
5. Who can access it
Only named staff with an individual login and a role that involves fulfilling orders can see buyer details. Every login is recorded with time and source address, and every change to an order is attributed to the user who made it. Accounts are removed when a person leaves or changes role. Marketplace credentials are managed in a separate administrative panel by a small number of named administrators.
6. Who we share it with
- Carriers (for example Australia Post): the recipient name, address and contact details needed to deliver the parcel, sent to the carrier's own system to produce a label. Carriers process this under their own policies.
- Amazon Web Services: hosts the server as our infrastructure provider and does not access the data.
- The marketplace itself: we return despatch status and tracking numbers for the order.
We do not sell, rent or otherwise disclose marketplace data to anyone else, and we do not transfer it to any other party for their own purposes.
7. How long we keep it and how it is disposed of
- The raw order record received from the marketplace, and the recipient's name, address, phone number and email, are deleted automatically 30 days after the order is despatched. The deletion runs daily as part of the system's scheduled jobs and overwrites the fields in the database; it is not reversible.
- After that, the order is retained only as a fulfilment and financial record: the marketplace order number, the date, the items and quantities, the delivery postcode, the carrier and tracking number, and the fulfilment fee. These contain no personal information beyond the postcode and are kept for the period required by Australian tax and accounting law (five years), after which they are removed.
- If a marketplace or a customer requires an order to be deleted sooner, it is deleted on request.
8. Security incidents
If we become aware of any unauthorised access to, or loss of, marketplace data, we will contain it, assess which orders and marketplaces are affected, and notify the marketplace concerned (for Amazon, within 24 hours at security@amazon.com as its policy requires) and any affected individuals where the law requires, and record the incident and the remedy.
9. Your rights and contact
Buyers' rights over their personal data are exercised through the marketplace they bought from, which passes requests to us; we also act on requests received directly. For anything about this policy or the handling of order data, contact Pozzani Australasia Pty Ltd, 145 Fitzgerald Road, Laverton North VIC 3026, Australia, support@poz-auz.com.au.
We review this policy whenever the system or the marketplaces we connect to change, and at least once a year.