Privacy & Data Protection Policy

1. Who we are

CIEL is a wholesale distributor of books and related products, supplying retailers and online marketplaces across the Middle East, Africa and Europe. We operate as a vendor and seller on Amazon marketplaces and fulfil certain orders directly to end customers (“direct fulfilment”).

2. Scope

• Visitors to our websites (ciel.me and affiliated sites);
• Business contacts (customers, suppliers, publishers, carriers);
• Marketplace order data, including personal information of end customers that we receive from Amazon and other marketplaces strictly for the purpose of fulfilling and shipping orders.

3. Information we collect

Website visitors. Basic technical data (IP address, browser type, pages visited) and any details you submit through our contact forms (name, email, message).

Business contacts. Names, business contact details, order and billing information needed to run our wholesale operations.

Marketplace order information (“Amazon Information”). When we fulfil marketplace orders shipped directly to consumers, we receive, via secure marketplace APIs only, the minimum data needed to ship the order: recipient name, delivery address, and order/shipment identifiers. We do not receive or store customer payment card data.

4. How we use information

We use personal information solely to:

• Fulfil, pack, ship and confirm orders, and generate shipping labels and packing slips;
• Communicate with carriers to deliver shipments;
• Operate, secure and improve our services and website;
• Meet legal, tax and accounting obligations.

Purpose limitation: marketplace customer data is used exclusively for order fulfilment and for no other purpose. We do not use it for marketing, profiling, or analytics, and we never sell personal information.

5. How information is shared

We do not sell, rent or trade personal information. We share it only:

• With delivery carriers, limited to the recipient details required to deliver the parcel;
• With the marketplace concerned (e.g. Amazon) to confirm shipments and resolve delivery issues;
• With authorities where required by applicable law.

No marketplace customer data is disclosed to any other third party, transferred to external analytics or advertising services, or combined with data from other sources.

6. How information is protected

• In transit: all data exchange with marketplaces and carriers occurs over encrypted connections (TLS/HTTPS). We retrieve Amazon Information exclusively through Amazon’s Selling Partner API.
• At rest: order data is stored on access-controlled servers within our private corporate network, on volumes protected with disk-level encryption (AES). Encryption keys are managed centrally and restricted to IT administrators.
• Access control: each employee has a unique named account; access to order data is granted on a least-privilege, need-to-know basis according to job function, and revoked on role change or departure. Administrative and remote access requires multi-factor authentication.
• Network security: our systems sit behind managed firewalls with default-deny inbound rules, network segmentation, and continuously updated anti-malware protection. No database or file server is exposed to the public internet.
• Monitoring: security logs are retained and reviewed regularly to detect unauthorised access or misuse.

7. Data retention and disposal

• Marketplace customer data (name, delivery address): retained only as long as needed to ship the order and confirm delivery, and securely deleted no later than 30 days after shipment, except where a longer period is required by law or by the marketplace for dispute resolution.
• Business records (orders, invoices): retained for the periods required by applicable commercial and tax law.
• Website enquiries: retained only as long as needed to respond and follow up.

Disposal is performed by secure deletion; backup copies expire on a rolling schedule.

8. International transfers

Our operations span the UAE, Saudi Arabia, South Africa, Turkey, Egypt and the United Kingdom. Where personal information is transferred between our entities or to carriers in other countries, it is transferred only for the fulfilment purposes described above and protected by the same safeguards described in this policy, in accordance with applicable data protection laws (including the UAE Personal Data Protection Law and, where applicable, the EU/UK GDPR).

9. Security incidents

We maintain a documented incident response plan. In the event of a security incident affecting personal information we will: contain and investigate the incident; notify the affected marketplace (for Amazon Information, Amazon Security within 24 hours of detection) and, where required, the affected individuals and competent authorities; and take corrective action to prevent recurrence.

10. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal information, or object to its processing. Marketplace customers should direct requests concerning their marketplace account to the marketplace (e.g. Amazon); we will fully cooperate with any such request forwarded to us.

11. Cookies

Our website uses only essential cookies and basic, privacy-respecting analytics. We do not use advertising or cross-site tracking cookies.

12. Changes to this policy

We review this policy at least annually and update it when our practices or legal obligations change. The effective date above reflects the latest revision.

13. Contact

For privacy questions or requests:
CIEL Book Distribution LLC
Dubai, United Arab Emirates
Email: info@ciel.me