Technology & Data Security

Last updated: 17 October 2026

Brands trust us with access to their Amazon and advertising accounts. This page explains how we protect that access and the data that comes with it. It applies to O ve O Company Elektronik ve Kozmetik Pazarlama Limited Şirketi, operating as Two Goghs, its staff and its contractors.

1. Access

• We access Seller Central only through Amazon's Solution Provider Portal, using the roles Amazon has approved for our service and the permissions each seller grants us.
• Least privilege: every person gets only the access their work needs, and only for as long as they need it. Access is removed the same day a person's role ends.
• We do not request roles that expose Amazon customers' personally identifiable information. Our services do not need it.
• Every account used for client work is protected with multi-factor authentication.

2. Credentials

• Credentials and API keys are stored only in an encrypted password manager. They are never written into code, documents, spreadsheets or messages.
• Credentials are never shared between people. Each person signs in with their own account.
• Credentials are rotated at least once a year, and immediately if a compromise is suspected.

3. Data protection

• Data is encrypted in transit (TLS 1.2 or higher) and at rest.
• Work devices use full-disk encryption, screen lock, up-to-date operating systems and malware protection.
• Client data is kept in access-controlled storage, separated by client.
• Amazon customers' personally identifiable information is not retained. If it reaches us incidentally, it is deleted without further use.
• Business data is deleted or returned when an engagement ends, except records the law requires us to keep.

4. Network protection

• Client work is done only on secured networks and devices with firewalls enabled. No client work on public or shared computers.
• Software and browser extensions used for client work are reviewed before use and kept up to date.

5. Risk assessment

We review security risks at least once a year and whenever our services, tools, staff or suppliers change materially. Each review records the risks found, the action taken and who owns it.

6. Incident response

Our incident response plan covers monitoring, detection and response:

1. Detect. Account activity, sign-in alerts and unusual behaviour are monitored.
2. Contain. Affected access is revoked, credentials are rotated and affected systems are isolated.
3. Notify. Security incidents involving Amazon Information are reported to Amazon at security@amazon.com within 24 hours of detection. Affected clients are informed without undue delay, and authorities where the law requires it.
4. Recover and learn. Root cause is investigated, fixes are applied, and the plan is updated.

7. Organizational changes

We notify Amazon within 30 days of any organizational change or event that changes our need for, or use of, Amazon Information, such as a change of ownership, services or data use.

8. Policies we follow

Amazon Solution Provider Portal Agreement, Amazon Acceptable Use Policy and Amazon Data Protection Policy, together with applicable data protection law including KVKK and GDPR.

9. Report a concern

If you believe you have found a security issue, email hi@wavesounds.com.tr. We respond within one business day.