Data & Security Policy

Last updated: 15 September 2026

MEILK LTD (“MEILK”, “we”, “us” or “our”) is committed to protecting client, business, marketplace and personal information processed in connection with our services.

This Data & Security Policy describes the organisational and technical principles we use to protect information, control access to systems, manage security risks and respond to security incidents.

This policy applies to information and systems used by MEILK in connection with services including:

• UK market entry and business operations
• Product compliance coordination
• Import and logistics coordination
• E-commerce operations
• Amazon Seller Central management
• Amazon catalogue management
• FBA and inventory operations
• Amazon advertising management
• Marketplace compliance and case management

It applies to personnel and authorised third parties who are permitted to access MEILK systems or client information.

MEILK follows security principles designed to protect the confidentiality, integrity and availability of information.

Our approach includes:

• Access on a need-to-know basis
• Least-privilege access
• Individual user accounts
• Strong authentication
• Multi-factor authentication where available
• Restricted access to client marketplace accounts
• Secure handling of business information
• Periodic review of access permissions
• Prompt removal of access when no longer required
• Security risk assessment
• Incident identification and response procedures

Security controls are reviewed as our systems, personnel, services and regulatory obligations change.

Where a client authorises MEILK to access Amazon systems or information, Amazon Information is accessed only for legitimate business purposes necessary to provide the authorised service.

This may include authorised activities relating to:

• Seller Central management
• Catalogue management
• FBA and inventory operations
• Marketplace cases
• Advertising management
• Performance reporting
• Marketplace compliance

MEILK does not sell Amazon Information.

MEILK does not use Amazon Information for unrelated marketing, advertising or other unauthorised purposes.

Access to Amazon Information is restricted to authorised personnel with a legitimate business requirement.

Personnel must not share marketplace credentials or provide unauthorised individuals with access to Amazon Information.

Access to systems and client information is granted according to business need and job responsibilities.

MEILK applies the principle of least privilege so that users receive only the level of access reasonably required to perform authorised work.

Where supported by the relevant system:

• Individual accounts are used
• Multi-factor authentication is enabled
• Access permissions are limited by role
• Shared credentials are avoided
• Access requirements are periodically reviewed

Access must be removed or adjusted when an individual no longer requires it, including following a change of responsibilities or termination of engagement.

Passwords, authentication credentials and security tokens must be protected against unauthorised disclosure.

MEILK personnel must not knowingly:

• Share passwords with unauthorised persons
• Store credentials in publicly accessible locations
• Send passwords through insecure public channels
• Reuse client credentials for unrelated services
• Circumvent multi-factor authentication or security controls

Where available and appropriate, secure credential-management methods are used.

Only personnel with a legitimate business need may access client or marketplace information.

Before access is granted, the required level of access should be determined based on the individual’s responsibilities.

Personnel are expected to follow MEILK’s confidentiality, data protection and security requirements.

Access is reviewed when responsibilities change and must be removed when it is no longer required.

MEILK reviews organisational changes that may affect its need for, access to or use of Amazon Information.

This includes material changes relating to:

• Company ownership or legal entity information
• Business operations
• Services provided
• Personnel with authorised access
• Systems used to process Amazon Information
• Relevant subcontractors
• The purpose for which Amazon Information is accessed

Where required under applicable Amazon requirements, MEILK will notify Amazon within 30 days of an organisational change or event that changes the company’s need for, access to or use of Amazon Information.

The Managing Director is responsible for reviewing relevant organisational changes and ensuring that required notifications are made.

MEILK maintains a process for identifying and evaluating information-security risks relevant to its operations.

Risk assessments may consider:

• Unauthorised system access
• Credential compromise
• Phishing and social engineering
• Malware
• Data loss
• Accidental disclosure
• Inappropriate access permissions
• Third-party service risks
• Device security
• Marketplace account compromise
• Operational changes affecting information security

Identified risks are evaluated based on their potential likelihood and impact.

Appropriate measures are then considered to reduce risks to an acceptable level.

MEILK conducts a formal information-security risk assessment at least annually and when material changes to systems, services or information-processing activities justify an additional review.

MEILK maintains an incident response process for suspected or confirmed information-security incidents.

Potential incidents may include:

• Unauthorised access
• Compromised credentials
• Loss or theft of a device containing business information
• Malware or malicious software
• Accidental disclosure
• Suspicious marketplace account activity
• Unauthorised disclosure of Amazon Information
• Other events affecting the confidentiality, integrity or availability of information

Our incident response process follows the general stages of:

Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned

When an incident is identified, MEILK will seek to:

1. Assess the nature and scope of the incident.
2. Protect affected systems and information.
3. Contain unauthorised access or activity.
4. Preserve relevant information required for investigation.
5. Remove or mitigate the cause of the incident.
6. Restore secure operations.
7. Determine whether clients, Amazon, regulators or other parties must be notified.
8. Document the incident and relevant actions.
9. Review lessons learned and implement appropriate corrective measures.

The Managing Director acts as the primary Incident Management Point of Contact unless another authorised person is formally designated.

Where a security incident affects or may reasonably affect Amazon Information, MEILK will assess and escalate the incident promptly.

Where notification to Amazon is required under applicable Amazon security requirements, MEILK will make the required notification within the applicable reporting timeframe, including within 24 hours where Amazon’s requirements require notification within 24 hours.

MEILK will cooperate with reasonable investigation and remediation requirements associated with such an incident.

MEILK’s incident response arrangements are reviewed periodically and following significant incidents or material changes to systems or operations.

Where appropriate, lessons identified during an incident are incorporated into security procedures and risk controls.

MEILK seeks to access and process only information reasonably necessary to provide the relevant service.

Client and marketplace information should not be collected solely because it is available.

Access requirements should reflect the service being performed.

Information is retained only for as long as reasonably necessary for:

• Providing contracted services
• Business administration
• Legal and regulatory obligations
• Accounting requirements
• Security and dispute management
• Applicable marketplace requirements

Where information is no longer required and there is no legal, regulatory or contractual reason to retain it, MEILK will take reasonable steps to delete, anonymise or otherwise securely dispose of the information.

MEILK may use appropriate third-party providers for technology, professional, logistics or operational services.

Where a third party requires access to confidential or protected information, MEILK considers the nature of the access and the service being provided.

Third parties should only receive information reasonably necessary for the relevant purpose.

Access to Amazon Information must not be provided to a third party unless that access is authorised and consistent with applicable Amazon requirements.

Devices used to access confidential client or marketplace information should be appropriately protected.

Depending on the device and system, safeguards may include:

• Password or biometric device access
• Operating system security updates
• Screen locking
• Multi-factor authentication
• Anti-malware or platform security controls
• Secure network connections
• Restricted administrative access

Lost, stolen or compromised devices that may expose protected information must be treated as potential security incidents.

Where personnel access MEILK or client systems remotely, they must take reasonable precautions to prevent unauthorised access.

Confidential information should not knowingly be exposed in public environments or accessed through insecure systems where this would create an unreasonable security risk.

Personal information is processed in accordance with applicable data protection law and our Privacy Policy.

Security measures are selected with regard to the nature and sensitivity of the information being processed.

Information security is an ongoing process.

MEILK periodically reviews its:

• Access controls
• Security risks
• Incident procedures
• Data handling practices
• Personnel access
• Third-party dependencies
• Marketplace permissions

Controls may be updated in response to new threats, operational changes, marketplace requirements or lessons learned from incidents.

This Data & Security Policy is reviewed at least annually and may be reviewed earlier following:

• A material change in business operations
• Significant changes to information systems
• Changes to Amazon access or services
• A significant security incident
• Material changes to applicable legal or contractual requirements

The Managing Director is responsible for ensuring the policy is reviewed and maintained.

Questions regarding information security or this policy can be directed to:

MEILK LTD
124 City Road
London
EC1V 2NX
United Kingdom