DTTM for Amazon Export Incentive Workflows

DTTM – Privacy and Data Protection Policy

DTTM (Digital Incentive Tracking Module) is an institutional digital infrastructure developed to ensure that e-export incentive processes are verified, reported, and managed in compliance with applicable legislation. This Privacy and Data Protection Policy explains the scope and principles under which DTTM collects, processes, stores, protects, and manages data through the Amazon Services API (SP-API) and other integrations. The platform processes data solely on behalf of Amazon Authorized Users and strictly based on their explicit authorization. Authorization is obtained through Amazon's OAuth-based third-party access mechanism, and DTTM never requests or collects Amazon passwords or access keys from users.

DTTM fully complies with the Amazon Solution Provider Agreement, the Amazon Acceptable Use Policy (AUP), the Amazon Data Protection Policy (DPP), the General Data Protection Regulation (GDPR), the Turkish Personal Data Protection Law No. 6698 (KVKK), and all other applicable national and international data protection regulations. The platform does not engage in any data processing activity that would violate Amazon policies and does not facilitate any breach of contractual obligations between Authorized Users and Amazon.

DTTM processes only the data necessary to provide its services. Such data may include order and transaction identifiers, sales and financial summary data, incentive-eligible expense items, and performance reports. In addition, system logs, API call records, access timestamps, and authorization token information may be processed for system security and performance monitoring purposes. All processing activities are conducted in accordance with the principle of data minimization, and no data outside the scope of the service is requested or accessed.

With regard to Personally Identifiable Information (PII), DTTM adopts a strictly limited processing approach. Amazon customer data is not used for marketing, advertising, profiling, or commercial analytics. Access to unnecessary personal data fields is not requested, and personal data is never treated as a commercial asset. PII is processed only when required by the nature of the relevant transaction or by legal obligation. Any direct or indirect marketing to Amazon customers using Amazon-derived data is strictly prohibited.

The data collected is processed exclusively for incentive eligibility verification, expense reconciliation, financial analysis, reporting, auditing, and regulatory compliance purposes. Data is never used for marketing, advertising, profiling, competitive intelligence, resale, or generating commercial insights about Amazon's business operations. DTTM does not combine Amazon data with external data services and does not aggregate data across different Authorized Users for commercial purposes.

No data processed within DTTM is sold, rented, licensed, or commercially transferred to third parties. Data may only be disclosed upon the explicit written request of the Authorized User, in response to a legal obligation, or as required by official audit procedures. Outside of these limited circumstances, no data is shared with third-party individuals, institutions, or organizations. DTTM expressly commits not to sell data and not to share data with third parties for commercial purposes.

DTTM implements strong technical and organizational measures to ensure data security. Data transmission is encrypted via TLS/HTTPS protocols. Systems are protected through role-based access control mechanisms, and access activities are logged and monitored through anomaly detection systems. API usage strictly adheres to throttling and rate-limit requirements. Secure server infrastructure, access restrictions, and monitoring systems are implemented to prevent unauthorized access. Organizational measures include confidentiality agreements, access authorization matrices, regular security audits, and ongoing data protection awareness training.

Data is retained only for the duration necessary to fulfill the relevant legal and operational purposes. Upon expiration of the retention period, data is anonymized or permanently deleted using irreversible deletion methods. Data deletion and disposal processes are conducted in a manner that ensures confidentiality and integrity.

Authorized Users have the right, in accordance with applicable law, to access their processed data, request corrections, request deletion (subject to legal retention obligations), and obtain information about processing activities. Requests are evaluated and resolved within the legally prescribed timeframes.

DTTM commits to full compliance with Amazon policies and applicable legislation, to notifying Amazon of relevant organizational changes when required, and to continuously improving its data protection processes through internal audit mechanisms. The platform is open to technical and contractual compliance audits that may be conducted by Amazon.

DTTM explicitly declares that no data processed within the platform will be sold, commercially exploited, or shared with unauthorized individuals or entities. All data processing activities are conducted strictly within the scope of authorized use and limited purposes.