Linnworks have revealed that Amazon have recently updated their privacy policy concerning personally identifiable information.
All Amazon sellers and 3rd party integrators are required to remove any and all personally identifiable information held about an Amazon order 30 days after an order has been shipped. All multichannel management solutions and other service companies will have to follow suit… Linnworks are just the first to inform their clients.
“You will retain Confidential Information only for so long as its use is necessary for participation in the Services or to fulfill your statutory obligations (e.g. tax) and in all cases will delete such information upon termination or as soon as no longer required for the fulfilment of statutory obligations. The foregoing sentence does not restrict your right to share Confidential Information with a governmental entity that has jurisdiction over you, provided that you limit the disclosure to the minimum necessary and explicitly indicate the confidential nature of the shared information to the governmental entity.”
– Amazon Services Europe Business Solutions Agreement
To comply with these changes, Linnworks will now automatically remove all personally identifiable information from orders downloaded from Amazon 30 days after they’re processed. This change will come into effect on the 16th of August and will affect all existing and future Amazon processed orders.
The data that Linnworks will delete includes:
- First Name
- Surname
- Email Address
- Phone Number
- Shipping Address
- Billing Address
- Post/ZIP Code
- Customer-facing Order Notes
- Buyer VAT Number
Having personally identifiable information deleted will impact many parts of your business such as the ability to give ongoing customer support and see previous notes and warranty expiration dates. It may also impact your ability to comply with tax legislation – for instance if buyer VAT number have been deleted any orders shipped to the EU VAT free should have the buyer VAT number recorded.
Linnworks say that you can download data before it is deleted, but if you export it then it is then your responsibility to comply with Amazon’s data protection policies. If you don’t need the data don’t download it and if you only need a part of the data don’t save the details that aren’t required to fulfil your future obligations.
Doubtless this stems from the GDPR legislation and will apply to all third party multi-channel management tools as well as to data you hold yourself. Generally it’s good practice to delete all data as soon as it’s no longer needed to fulfil your legal obligations – if you don’t hold personally identifiable information on your customers then you can’t be hacked and have it stolen.
8 Responses
most businesses have good reason to keep the data – for us, its warranty based products and customer wanting invoice requests – sometimes upto 12 months after the order.
Er… how long is the A-Z period again? How could you manage this if you have deleted the customer information…
It will also impact product recalls – I used to work for a Veterinary supply company and they were required to keep the customer details on file incase of a batch recall. As Amazon do not have a field for “Batch Number” on an order it would be impossible for their system to admin a product recall.
Or a VAT audit – how do you prove that your sales went to VAT exempt locations if the addresses are wiped… HMRC walks in and suddenly your bankrupt because you end up with a back dated VAT bill for export sales that should have been VAT exempt / zero rated but you cant prove it because Linnworks / Amazon wiped the data…
Seems very half thought out without any actual consideration to the needs of the companies…
Will Amazon be deleting all customer order information from their system? Will be interesting to see what happens, this is all getting a little OTT
WOW – I can see many problems with this.
errr… so if a customer complains after 30 days, how do you locate their order so that you can assist them with a refund/replacement etc ?
An order management system that deletes key order data after 30 days – LOL
Stephen Wright makes some very interesting points, this is TOTAL OVERKILL.
At first glance, this seems to be a huge overkill and once again on Amazon’s part, one sided.
Are they suggesting that we can access the data within Amazon if we need it for all of the reasons above but they are not subject to the same rules that we are? I can sort of understand it if they do not want third party software companies such as Linnworks holding this data in the cloud but are Amazon saying they will delete it from their own servers or that they are not susceptible to hacking?
We had a situation with a customer last year who placed orders very regularly to be dispatched to different addresses. Yes, there’s a name for that type of customer…
We found him because we track the data and realised that every order he placed, he was making an A-Z claim for arrived damaged – even though they weren’t going to his own address! And yes you guessed it, when we showed the data to Amazon, they still said his claim was valid!
Will the courier you used also have to delete information? They are also a 3rd party.
Amazon should focus on fake and non-complient goods, as well as Chinese VAT. But they seem to be bad at that 10 plus years and the problems only getting worse. Needless to say, Chinese integrated systems can ignore this.
Yes, so since nobody will have any order information after 30 days, buyers won’t be able to complain, demand returns or refunds, open claims or find any other way to fleece us because there will be no record of the transaction.
Sounds great to me, bring it on!
Amazon are approaching this from the perspective of GDPR, although it effectively works to make signing up to their VAT Calculation Service virtually compulsory – with the added bonus (for Amazon) of making the individual seller even more invisible from the buyer’s perspective.
However, they appear not to have discussed this with HMRC. WHen I called HMRC and discussed this new policy with them, the advice they gave is that it is in direct contradiction with VAT Notice 700/21, which covers keeping adequate business records. In the event of a VAT inspection it would be us as sellers who would get the penalties, which can be quite substantial.
I am adopting a solution of keeping PDF copies of all invoices, but storing them in an offline medium, as this meets both Amazon and HMRC requirements.
It’s a pain in the backside, but also a useful lesson, reinforcing the fact that any data held in the cloud is no longer ours but effectively owned by a third party who can delete it with virtually no notice, so it’s essential to keep our own secure copies.