Data Security & Privacy Statement

Overview & Commitment

FLINK Business Solutions provides outsourced business services that may involve confidential business information, customer records, and other sensitive data. Protecting client information is core to how we work. Our security program is designed to safeguard the confidentiality, integrity, and availability of that information throughout its entire lifecycle using a comprehensive mix of administrative, technical, and physical safeguards supported by strict policies, continuous training, diligent monitoring, and regular security reviews.

When handling information received from a client, FLINK acts as a service provider or data processor on the client's behalf, while the client remains responsible for deciding why and how that information is processed. For information collected directly through our website or business communications, FLINK acts as the data controller.

Independent NIST CSF 2.0 Assessment

FLINK's cybersecurity program has been independently assessed by a qualified third party against the NIST Cybersecurity Framework (CSF) 2.0 within the scope documented in our applicable assessment report. This framework helps us organize, manage, and continually improve our security posture across six core areas:

Amazon Data Protection Compliance

When FLINK provides services to independently authorized Amazon sellers, Amazon Information is handled in strict compliance with the Amazon Acceptable Use Policy, Data Protection Policy, and applicable contractual obligations. Our handling practices align with the following core mandates:

• Minimum Necessary Access: We request and access only the explicit information required to perform the agreed service. Access is tightly restricted to approved personnel who require it for assigned workflows.
• Credential Safeguards: FLINK never requests or accepts an Amazon Seller Central username, password, or private access keys. All portal interactions must use Amazon-approved secondary-user or official authorization processes.
• Logical Data Separation: Information belonging to different sellers is logically separated and clearly attributed to its source. FLINK strictly prohibits combining seller information to build cross-seller datasets, profiles, benchmarks, or competitive insights.
• Prohibition on Data Brokering & Advertising: We do not sell personal information or Amazon Information. FLINK does not use customer details for targeted advertising, marketing, review fabrication/modification, data brokering, or independent customer profiling.

Technical Information Security Controls

To support our NIST CSF 2.0 alignment and satisfy rigorous enterprise data protection standards, FLINK enforces granular administrative and technical security measures:

Continuous Monitoring & Vulnerability Management

FLINK maintains a centralized security logging and monitoring architecture alongside a structured vulnerability management program to mitigate potential risks before they materialize:

• Security-event collection and suspicious activity alerts.
• Protection of security logs against unauthorized alteration.
• Controls preventing personal data from entering technical logs.
• Regular vulnerability scanning and security patching.
• Endpoint protection and independent penetration testing.
• Code/system security reviews and documented risk remediation.

Incident Response & Business Continuity

FLINK operates a documented incident-response process with established escalation procedures, responsibilities, and notification guidelines. If a suspected incident occurs, we act quickly to detect, verify, contain, and investigate the event, remove the underlying cause, and restore normal operations. Where personal information or Amazon datasets are affected, FLINK notifies affected clients, Amazon, regulators, or individuals within contractually and legally mandated timelines.

Furthermore, we maintain documented business continuity and data recovery measures to preserve the availability of critical client services, regularly testing our ability to safely restore systems and datasets following any unexpected disruption.

Data Retention, Privacy Rights & Secure Deletion

FLINK retains information only for as long as required to deliver contracted services, maintain necessary business records, resolve disputes, or satisfy legal, tax, and regulatory compliance.

• Amazon Customer PIIRetained for no longer than 30 days after service contract terminated, exclusively for order fulfillment, sales calculations, or statutory obligations. Longer retention occurs only if strictly required by applicable law.
• Other Amazon InformationNon-PII datasets are retained only as long as necessary to provide authorized services, capped at a maximum of 18 months unless a shorter period applies or longer retention is legally mandated.
• Amazon Deletion NoticesUpon receipt of an Amazon deletion notice, FLINK initiates the deletion process within 30 days and completely removes applicable live, online, or network-accessible instances within 90 days.
• NIST SP 800-88 SanitizationData destruction is executed via industry-standard practices (such as NIST SP 800-88) to prevent any reconstruction or recovery. Written confirmation of destruction is provided when required.

Individuals may exercise applicable privacy rights (including access, correction, deletion, or restriction requests) based on their jurisdiction. Where FLINK processes data purely on behalf of a client, requests may be referred directly to that client for expedited handling.