E-commerce Policy

Company: Cloud Business Setup Services Pvt. Ltd. (Cloud Inc.)

Website: https://www.cloudinc.co/

Effective Date: 14 August 2026

Policy Review: At least annually and after any material security incident or organizational change.

1. Purpose

Cloud Inc. is committed to protecting Amazon Information, client information, credentials, and business data accessed while providing e-commerce services including Amazon account management, cataloguing, advertising, fulfillment, compliance, reporting, and related services.

Access to information is limited to authorized personnel based on business need and least-privilege principles.

2. Data Access & Protection

Cloud Inc. :

• Uses Amazon Information only for authorized business purposes and contracted services.
• Restricts access to authorized personnel on a need-to-know basis.
• Reviews and removes access when an employee changes responsibilities or leaves the organization.
• Protects credentials and uses appropriate security controls, including MFA where available.
• Stores and transmits information using approved and appropriate security measures.
• Does not disclose Amazon Information to unauthorized third parties.
• Retains information only as long as necessary and securely deletes it when no longer required.

3. Organizational Change Notification

Cloud Inc. maintains a formal requirement to notify Amazon within 30 days of any organizational change or event that may materially affect the Company's need for, access to, or use of Amazon Information.

This may include material changes in ownership, control, legal entity, business activities, data usage, or security/compliance arrangements.

Management is responsible for assessing such changes and coordinating any required notification to Amazon.

4. Risk Management

Cloud Inc. maintains a risk assessment process to identify, assess, mitigate, and monitor information-security risks.

Risks may include:

• Unauthorized access
• Credential compromise
• Phishing or malware
• Data leakage
• Accidental disclosure
• Lost or stolen devices
• Third-party security risks
• System vulnerabilities

Risks are assessed based on likelihood and potential impact. Appropriate controls and corrective actions are implemented based on the level of risk.

Material risks and mitigation activities are documented and reviewed periodically.

5. Incident Response

Cloud Inc. maintains an incident response process covering:

Detection → Assessment → Containment → Investigation → Remediation → Recovery → Notification → Review

Security incidents may include unauthorized access, credential compromise, data leakage, malware, phishing, accidental disclosure, or other events affecting protected information.

Employees are required to report suspected security incidents immediately to the designated internal contact.

Where an incident involves Amazon Information, Cloud Inc. will follow applicable Amazon notification and security requirements, including any required notification timelines.

Following a significant incident, Cloud Inc. conducts a review to identify the root cause, corrective actions, and improvements required to prevent recurrence.

6. Employee & Third-Party Responsibilities

Employees and authorized contractors must:

• Protect company and Amazon-related information
• Follow access-control requirements
• Keep credentials confidential
• Report suspected security incidents immediately
• Use information only for authorized business purposes

Third-party access is permitted only when there is a legitimate business requirement and appropriate authorization and security controls are in place.

7. Policy Review

This policy is reviewed at least annually and following significant security incidents, material organizational changes, or changes to applicable Amazon requirements.