Data Protection Policy (DPP)

Last updated: September 2026

This Data Protection Policy (“DPP”) describes how Kursoft Yazılım Ltd. Şti. (“Kursoft”, “the Company”) receives, stores, uses, transfers and disposes of information, including data retrieved through the Amazon Selling Partner API (“Amazon Information”). This policy applies to all systems that store, process or otherwise handle Amazon Information and ensures compliance with the following Amazon policies:

Kursoft also processes personal data in accordance with the Turkish Personal Data Protection Law No. 6698 (KVKK).

1. PURPOSE OF PROCESSING AND DATA SHARING

1.1 Purpose Limitation

Amazon Information is retrieved only through the Selling Partner API with the explicit authorization of the seller. It is used solely for order management, shipment, tax invoicing and accounting within Kursoft ERP. Amazon Information is never used for marketing, advertising or profiling, and it is never sold.

1.2 Data Sharing

Amazon Information is shared only when strictly required for order fulfillment or legal compliance, and only the minimum necessary data is shared:

  • Carriers: For merchant-fulfilled (FBM) orders, the buyer’s name, shipping address and phone number are sent to the carrier selected by the seller over encrypted (TLS) connections.
  • e-Invoice integrator and Revenue Administration (GİB): Turkish Tax Procedure Law No. 213 requires invoices to be reported. Invoice data, including the buyer’s name and billing address, is sent to the Turkish Revenue Administration (GİB) through a GİB-authorized e-invoice integrator.

Amazon Information is not shared with any other third party.

2. GENERAL SECURITY REQUIREMENTS

Kursoft maintains physical, administrative and technical safeguards to protect the security, confidentiality and integrity of Amazon Information. These safeguards protect against unauthorized access, accidental loss, alteration, disclosure and all other unlawful forms of processing.

2.1 Network Protection

  • Databases and file servers are kept in segmented networks. They are not directly exposed to the internet and can be reached only from authorized IP addresses.
  • Internet-facing endpoints are protected at the application layer by Cloudflare Web Application Firewall (WAF).
  • Network traffic is controlled by continuously monitored firewalls and access control lists, and inspected by a network-based IDS/IPS.
  • All servers and endpoints run anti-virus/anti-malware software. Signatures are updated automatically every day, and protection status is monitored from a central console.
  • Remote access to servers is allowed only through VPN with multi-factor authentication (MFA).

2.2 Access Management

  • Every employee has a unique account, and shared accounts are not permitted.
  • MFA is required for all logins.
  • Accounts are locked after 3 failed login attempts or when anomalous activity is detected.
  • Access to Amazon Information is granted only on request, with a business justification and manager approval.
  • All access is logged and monitored, and access rights are reviewed every 3 months.
  • When an employee leaves the company, their access is revoked the same day.
  • All users with access to Amazon Information receive data protection and IT security training at least once a year.

2.3 Least Privilege Principle

Access is granted on a need-to-know basis using fine-grained, role-based access controls (RBAC). Only roles responsible for shipment and invoicing can see Amazon PII. All other roles see masked data.

2.4 Password and Credential Management

Password rules:

  • Passwords must be at least 12 characters long.
  • Passwords must contain uppercase and lowercase letters, numbers and special characters. Repeated or sequential characters are not allowed.
  • Passwords expire every 90 days, and users are warned before a password expires.
  • The minimum password age is 1 day.
  • The last 10 passwords cannot be reused.
  • Accounts are temporarily locked after 3 failed login attempts.
  • MFA is required on all systems that handle Amazon Information.
  • Passwords are stored only as strong one-way hashes and are never shared by email.

Credential rules:

  • LWA client secrets, refresh tokens, API keys and encryption keys are never stored in source code or public repositories, and never in plain text in configuration files. They are stored encrypted, and only authorized services can access them.
  • Credentials are never shared or sent by email.
  • API keys and credentials are rotated at least every 12 months, and are revoked immediately if exposure is suspected.

2.5 Encryption in Transit

All data in transit is encrypted with TLS 1.2 or higher (HTTPS, SSH). Legacy protocols (SSL, TLS 1.0/1.1) are disabled. Amazon Information is never sent unencrypted.

2.6 Incident Response Plan

If a database breach, unauthorized access or data leak occurs, Kursoft follows these steps:

  1. Detection: A SIEM system monitors events continuously and generates alerts immediately.
  2. Containment: Affected systems are isolated and access is restricted.
  3. Notification: Amazon is notified at security@amazon.com within 24 hours of detection.
  4. Analysis: The root cause and the scope of the incident are determined.
  5. Remediation and Recovery: Vulnerabilities are fixed, data is restored from secure backups, and system integrity is verified.
  6. Documentation: The incident, the actions taken and any new controls are documented to prevent recurrence.

Where the law requires it, Kursoft notifies the Turkish Personal Data Protection Authority and affected persons within 72 hours. Kursoft never speaks on behalf of Amazon to any authority or customer unless Amazon requests this in writing.

The incident response plan is reviewed every 6 months and after any significant change. Senior management reviews the risk assessment at least once a year.

Incident Management Point of Contact (IMPOC): İsmail Çelebi – ismail@kursoft.com.tr

2.7 Request for Deletion or Return

Within 72 hours of Amazon’s request, Kursoft will either return Amazon Information or permanently and securely delete it in line with NIST SP 800-88. If Amazon requests it, Kursoft will confirm the deletion in writing.

3. ADDITIONAL REQUIREMENTS FOR PERSONALLY IDENTIFIABLE INFORMATION (PII)

3.1 Data Retention

Amazon PII is deleted or irreversibly masked no more than 30 days after the order ships. There is one exception: Turkish Tax Procedure Law No. 213 requires invoices to be kept, so the buyer’s name and billing address on those invoices are kept in encrypted accounting records for the legally required period. This data is used only to comply with that law and is securely destroyed when the period ends. Amazon PII is never written to logs.

3.2 Encryption at Rest and Key Management

Amazon PII is encrypted at rest with AES-256 using SQL Server Transparent Data Encryption (TDE). All servers and devices use full-disk encryption (BitLocker).

Encryption keys are managed through a documented key lifecycle:

  • Generation: Keys are generated securely in a key management system.
  • Distribution: Keys are delivered to authorized services only over encrypted channels.
  • Storage: Keys are stored separately from the data they protect, with restricted access. They are never stored in source code or in the database in plain text.
  • Rotation: Keys are rotated at least every 12 months.
  • Revocation: Keys are revoked immediately if compromise is suspected.
  • Destruction: Keys are securely destroyed when no longer needed.

3.3 Backups

  • Full backups are taken every day and encrypted with AES-256.
  • Backups are stored in geographically separate data centers, isolated from production systems and protected by restricted access controls.
  • Backups are kept on a 30-day rotation, and expired backups are securely deleted. Only the invoice records required by Tax Procedure Law No. 213 are kept longer, in an encrypted archive.
  • Restore procedures are tested every 3 months. The Recovery Time Objective (RTO) is 24 hours and the Recovery Point Objective (RPO) is 24 hours at most.

3.4 Asset and Device Management

  • Kursoft keeps an inventory of all software and physical assets that handle PII and reviews it every 3 months.
  • Amazon Information can be accessed only from company-owned devices managed through MDM/UEM. Personal and unmanaged devices are blocked.
  • USB and other removable storage devices are blocked through Group Policy and Data Loss Prevention (DLP) controls. DLP also monitors transfers by email, to cloud storage and to print.
  • Screens lock automatically after 15 minutes of inactivity.
  • PII is never stored on removable media, personal devices or unsecured public cloud applications.
  • Printed documents containing PII are securely destroyed.

3.5 Test Environments

Test environments are isolated from production at both network and database level. Production PII is never copied into test environments. Testing uses anonymized, masked or synthetic data and the SP-API Sandbox. Only authorized personnel can access test environments, using individual accounts and role-based permissions.

3.6 Logging and Monitoring

  • All access to Amazon Information is logged centrally in a SIEM system, and logs do not contain PII.
  • Logs are kept for at least 12 months and reviewed at least every two weeks.
  • The following events trigger automatic alerts to the IT security team:
    • unauthorized access attempts
    • unusually high API request volumes
    • suspicious logins
    • access to canary (decoy) records in the database
  • A dark web monitoring service watches for Kursoft data appearing outside protected boundaries, such as on the dark web or paste sites.
  • Suspicious activity is investigated under the Incident Response Plan.

3.7 Vulnerability Management and Secure Development

  • Vulnerability scans run at least every 30 days on all systems that handle Amazon Information, plus an additional scan after any significant change.
  • Application code is scanned for vulnerabilities (SAST) before each release.
  • Independent security firms perform penetration tests at least once a year, using industry-standard methodologies (OWASP, PTES).
  • Findings are recorded in an internal issue-tracking system with their severity, owner and target date. Critical findings are fixed within 7 days and high findings within 30 days. Each fix is verified with a follow-up scan before the finding is closed.
  • Developers receive secure coding training at least once a year. It covers OWASP risks such as SQL injection, XSS and CSRF.

3.8 Change Management

All changes are tested in a dedicated test environment before they go to production. A formal change management process defines who tests, verifies and approves each change. Only authorized personnel can deploy changes to production.

4. AUDIT AND ASSESSMENT

During the agreement with Amazon and for 12 months after it ends, Kursoft will give Amazon, on request, all records that demonstrate compliance with the DPP, the AUP and the Developer Agreement. Kursoft will cooperate fully with any auditor Amazon appoints. Any deficiencies found in an audit will be fixed at Kursoft’s expense within the agreed timeframe.

5. CONTACT

Incident Management Point of Contact (IMPOC): İsmail Çelebi – ismail@kursoft.com.tr
Kursoft Yazılım Ltd. Şti., Erciyes Teknopark Tekno-4 Binası No:26, 38039 Melikgazi / Kayseri, Türkiye