Privacy Policy

Privacy Policy

This Privacy Policy describes how Origamipolly (“Site”, “we”, “us”, or “our”) collects, uses, discloses, and handles personal information when you use our services or purchase from origamipolly.com (the “Services”).

Last Updated: 07 Oct 2025

1. Changes to This Privacy Policy

We may update this policy periodically to reflect changes in our practices or regulatory requirements. We will publish the updated Privacy Policy on the Site and update the “Last Updated” date.

2. How We Collect and Use Personal Information

We collect personal data only to the extent necessary to provide, maintain, and enhance the Services.

What Information We Collect

• Directly from you: name, billing/shipping address, phone number, email, order details

• Automatically: usage data (IP address, device info, browser type, pages visited, etc.) via cookies, pixels, and similar tracking technologies

• From third parties: payment processors, logistics/shipping partners, analytics services

How We Use Personal Information
We use data for these purposes (and only for these):

• Process orders, generate shipping labels, track shipments, issue tax invoices

• Provide customer support and transaction-related notifications

• Prevent fraud, detect security threats, and enforce our terms

• Operate, maintain, and improve our site and Services

• Communicate marketing/promotional offers (only if you opt in)

We do not use your PII for advertising targeting or share with third parties for marketing purposes, unless you consent.

For Amazon orders, we only access and use buyer PII obtained via the Selling Partner API (SP-API) for order fulfillment and delivery accuracy.
No Amazon data is used for analytics, profiling, or marketing purposes.

3. Data Retention & Deletion

We retain personal information no longer than 31 days after order shipment (for buyer PII) unless longer retention is required by law.
After the retention period, we permanently delete or anonymize data using secure methods.
Logs and non-identifiable analytics data may be retained longer, as permitted under applicable law.

Amazon order data (including buyer name, address, and phone number) is deleted within 30 days after order shipment completion, in accordance with Amazon Data Protection Policy.

4. Storage & Encryption

We store personal information in secure cloud databases within a private Virtual Private Cloud (VPC).
Data at rest is encrypted using AES-256 encryption.
Access to the database requires Multi-Factor Authentication (MFA) and is limited via role-based access control (RBAC).
Encryption keys are managed in a secure secret management system (e.g. AWS Secrets Manager or similar).

Our servers are located in Singapore (AWS Region ap-southeast-1).

5. Backups & Archiving

Regular backups are performed and stored in encrypted form (AES-256) in secure cloud storage.
Backups are accessible only by authorized administrators with MFA.
Backup data containing PII is deleted when no longer needed or when the original data has been purged.

6. Monitoring, Logging & Security

We use intrusion detection and prevention systems (IDS/IPS), log aggregation, and real-time monitoring tools to detect anomalous behavior.
All access, API calls, and administrative actions are logged.
Alerts are generated for repeated failed logins, unauthorized access attempts, or abnormal patterns.
Security staff investigate alerts, document root cause, and perform remediations.

All access and API logs related to Amazon data are reviewed periodically, and alerts for unauthorized access are reported to Amazon Security if required.

7. Access Control & Least Privilege

Each staff member has a unique ID and is granted access only to the information needed to perform their role (least privilege principle).
Access permissions are reviewed periodically and revoked immediately when no longer needed or when an employee leaves the company.

Access to Amazon data is limited to authorized fulfillment and support staff only, under a documented least-privilege policy.
Personal devices, USB drives, external media, or mobile phones are blocked from accessing Amazon data. Only company-managed and secured devices can access PII or Amazon-related data.

8. Third-Party Sharing / Disclosure

We disclose personal information to third parties only as necessary and under strict conditions:

• To service providers (payment processors, shipping carriers, cloud hosting) to perform contractual obligations

• To comply with legal obligations (e.g. tax authorities, court orders)

• With your consent (if you authorize sharing)

• In connection with a merger, acquisition, or corporate reorganization, with appropriate safeguards

We do not sell, rent, or lease your personal information to third parties for marketing.
We do not share Amazon data with any third parties beyond contracted logistics providers used for shipping.

9. International Data Transfers

Your personal information may be transferred and stored in countries outside your residence where we or our service providers operate.
Where required, we use recognized mechanisms (e.g. Standard Contractual Clauses) to safeguard the transfer.

10. Your Rights & Choices

Depending on your location, you may be able to:

• Request access to your data

• Request correction or deletion

• Withdraw consent

• Limit or object to processing

• Request data portability

We will respond within legally required timeframes and may require identity verification.

11. Contact & Complaints

If you have any questions, complaints, or want to exercise your rights, contact us at:

📧 Email: info.origamipolly@gmail.com
📞 WhatsApp / Phone: +66 98928964

If unsatisfied with our response, you may file a complaint with your local data protection authority.