Privacy Policy

1. Introduction and Scope

PL Signature Holding LLC, doing business as P&L Consultings (“P&L Consultings,” “we,” “us,” or “our”), is a California limited liability company that provides business-to-business services at pnlconsultings.com and through Briksten at www.briksten.com and app.briksten.com. This Privacy Policy (“Policy”) explains how we collect, use, disclose, and protect personal data in connection with the Consulting Services and Briksten Services described below (collectively, the “Services”) and our websites.

This Privacy Policy applies to sellers receiving our Services, the individuals they authorize to use the Briksten Services (“authorized users”), our vendors, and website visitors. In this Policy, “sellers” refers to businesses that sell products on Amazon’s platform, and “buyers” refers to individuals who purchase products from those sellers on Amazon.

2. Types of Services

Consulting Services. We provide Amazon marketplace services for sellers, including listing optimization, search and answer-engine optimization audits, advertising and pay-per-click management, and seller-account management (the “Consulting Services”). In providing the Consulting Services, we may access and process personal data contained in seller communications, working files, and Amazon seller accounts. Where a seller grants us access to Amazon Seller Central as a secondary user, the permissions granted may allow us to view buyer personal data within Seller Central. We do not store that buyer personal data. Where we download reports from Seller Central to perform the Consulting Services, the reports pass a filter that removes buyer personal data when they are read in, and the original download is deleted.

Briksten Services. We provide subscription access to Briksten, a browser-based workspace that displays each seller’s own Amazon business figures, recommendations, and generated outputs (the “Briksten Services”). Briksten is available through our websites to self-service subscribers and to sellers receiving the Consulting Services. With the seller’s authorization, Briksten uses Amazon’s Selling Partner API (“SP-API”) to retrieve the seller’s Amazon business information and provide the application’s features. Briksten does not access Seller Central, and its SP-API permissions do not provide access to buyer names, mailing addresses, email addresses, or telephone numbers. For review requests submitted through Briksten, Amazon sends the message to the buyer; Briksten does not receive the buyer’s contact details. Before SP-API authorization is in place, and for sellers receiving the Consulting Services, Briksten may also display business information we obtain through the Consulting Services and provide to Briksten on the seller’s behalf.

When we access or process personal data on behalf of a seller, we act under that seller’s instructions and our agreement with that seller. The seller remains responsible for its own privacy practices. We also process personal data for our own account administration, billing, business communications, marketing, and website and Service security, as described in this Policy. These activities may arise in either the Consulting Services or Briksten Services, including where a seller subscribes directly to Briksten.

Our handling of information we access through Amazon in connection with the Services is subject to the Amazon Selling Partner API Data Protection Policy (the “Amazon DPP”; references in this Policy to “applicable Amazon requirements” mean the Amazon DPP). Information we access through Amazon’s APIs, portals, or public-facing websites (“Amazon Information,” which has the meaning given to “Information” in the Amazon DPP) may include personal and non-personal information. Briksten does not request, and is not designed to receive, Amazon access roles that provide what the Amazon DPP calls Personally Identifiable Information (“PII”). When we provide the Consulting Services through a seller’s Seller Central account, Amazon Information shown to us may include PII. The provisions of this Policy addressing Amazon Information apply in addition to the provisions addressing personal data generally. Where applicable Amazon requirements impose stricter limits on our handling of Amazon Information, those limits apply.

3. Personal Data We Collect

We may collect the following categories of personal data about sellers and their personnel, authorized users, buyers as described below, vendors, and website visitors. The information we collect or access depends on the relevant Service and the individual’s interaction with us:

Contact and account data: name, email address, telephone number, mailing address, and account username. For both Services, this includes contact information used to establish and administer our relationship with sellers and communicate with their personnel. For the Briksten Services, it also includes account information for sellers and authorized users. We also collect contact information from vendors and individuals who contact us through our websites.

Quick-Score requests submitted through our website form (name, email address, brand, marketplace, and product identifiers) are relayed to our email system and are not stored on the web server.

Financial and transaction data: purchases and transactions, billing information, payment-card information, and bank information used to invoice sellers and pay contractors. For both Services, this includes information relating to sellers’ purchases of our Services and their payments to us. Payment-card numbers are handled by our payment processor and are not stored by us.

Seller business data: sales, traffic, fees, advertising, inventory, and other business figures obtained under the seller’s Amazon authorization; contract information, correspondence, and working files used to deliver the Services. For the Consulting Services, this includes information sellers provide to us and information we access through the permissions they grant us in Seller Central. For the Briksten Services, this includes the seller’s Amazon business information retrieved through SP-API under the seller’s authorization, together with information the seller or its authorized users submit through the application. This information is personal data to the extent it relates to an identifiable individual, including a sole proprietor.

Website and technical data: dashboard activity logs, Internet Protocol (IP) address, and web server access logs (including IP address, time, requested path, response status, and user agent). Website logs relate to visits to our websites for either Service; Briksten activity logs also relate to sellers’ and authorized users’ use of the application.

Buyer information accessed through the Consulting Services. For the Consulting Services, a seller may grant us Seller Central access as a secondary user. Depending on the permissions granted, this access may allow us to view buyer personal data displayed on order pages within Seller Central. Reports we download from Seller Central pass a filter that removes buyer personal data when they are read in; we do not keep buyer personal data in our files, systems, or backups.

Buyer information and seller requests through the Briksten Services. Briksten does not access Seller Central, and its SP-API permissions do not provide access to buyer names, mailing addresses, email addresses, or telephone numbers. As part of the Briksten Services, sellers may use Briksten to submit requests to Amazon and receive the information Amazon makes available in response. These requests are initiated by the seller through Briksten. When a seller requests a product review or seller feedback through Briksten, Briksten processes the Amazon order identifier and the applicable marketplace identifier to submit the seller’s request to Amazon. Briksten does not receive the buyer’s contact details.

Other categories of personal data. We do not process health, biometric, genetic, or precise-location data, or information about race, ethnicity, religion, sexual orientation, citizenship, criminal history, or union membership.

The sensitive personal data we handle includes account login credentials used to secure access to the Briksten Services. Account passwords are stored in hashed form. We use this information solely to provide and secure the Services and not to infer characteristics about any individual, and we limit its use and disclosure accordingly.

We collect personal data directly from sellers, their personnel, authorized users, vendors, and website visitors through account registration, purchases, transactions, and business communications; from sellers that designate authorized users; and automatically when individuals visit our websites or use Briksten. We also access information through Seller Central for the Consulting Services and receive information through SP-API for the Briksten Services, as described above. Information we access through Amazon’s APIs, portals, or public-facing websites may include personal and non-personal information and is subject to applicable Amazon requirements.

3.1 Information We Collect Automatically

When individuals visit our websites or use the Briksten Services, we and our hosting provider automatically collect certain technical information, including the individual’s IP address, the dates and times of the individual’s activity, the pages and resources requested, response status, and the individual’s browser user agent. We collect this information through web server logs and Briksten activity logs. Website logs relate to visits to our websites for either Service. Briksten activity logs relate to sellers’ and authorized users’ use of the application.

For our websites, the server log records the full requested address, including campaign parameters, and the referring page, in addition to the information above. Once a day, we derive aggregate figures from these logs, such as page views per page, visits per source or campaign, and visitors per day. The aggregate figures contain no IP address or other personal data. Our websites carry the campaign source between pages through a short parameter in internal links, not through cookies.

We use this information to operate, secure, and troubleshoot our websites and the Briksten application, to maintain the integrity of signed-in sessions, and to understand how sellers and authorized users interact with Briksten. We do not use this information for advertising, and we do not sell or share it for cross-context behavioral advertising.

3.2 Cookies and Similar Technologies

Our websites and the Briksten application use only strictly necessary cookies. Specifically, the Briksten application uses a session cookie that keeps a signed-in user’s session active until sign-out or until the browser is closed, and a short-lived cookie limited to the sign-in page that carries the seller or authorized user through the sign-in steps. Both are set by the Briksten application and are essential to providing the requested sign-in and account access functions.

The Briksten application also uses the browser’s local storage to retain interface settings, such as language, help-panel state, and which items the user has already viewed. These settings remain in the seller’s or authorized user’s browser and are not sent to us.

We do not use analytics cookies, advertising cookies or pixels, social-media pixels, session-recording tools, or other non-essential tracking technologies, and we do not permit third parties to place cookies or similar technologies through our websites or the Briksten application. We do not currently display a cookie consent banner. Should we introduce non-essential cookies or similar technologies in the future, we will update this Policy and, where consent is legally required, obtain it before those technologies are used.

Do Not Track. Some browsers offer a “Do Not Track” (DNT) setting that signals a preference not to be tracked across websites. We do not track individuals’ online activities over time and across third-party websites or permit third parties to do so through our websites or the Briksten application. Accordingly, our data collection and use practices do not change in response to DNT signals. Our practices concerning sale, sharing, and marketing opt-outs are described in the “Your Privacy Rights and Choices” section below.

4. How and Why We Use Personal Data

Consulting Services. We use personal data to communicate with sellers and their personnel, administer consulting engagements, and perform the Consulting Services described in Section 2. Where a seller grants us access to personal data through Seller Central, we use that access only as needed to perform the authorized Consulting Services, subject to the seller’s instructions and applicable Amazon requirements.

Briksten Services. We use personal data to register sellers and authorized users, create and manage their accounts, authenticate access, and provide the Briksten application’s features. This includes retrieving and displaying the seller’s Amazon business information under the seller’s authorization and enabling the seller to submit requests to Amazon and receive the information Amazon makes available in response, as described in Sections 2 and 3.

Purposes common to both Services. We also use personal data to administer our relationships with sellers and vendors; process payments and transactions; provide support; send service-related communications; send marketing communications to business contacts where permitted; operate, secure, and troubleshoot our websites and the Briksten application; prevent fraud; and comply with our legal obligations. Our use of personal data for these purposes remains subject to applicable restrictions on information accessed through Amazon.

We limit our collection, use, retention, and sharing of personal data to what is reasonably necessary and proportionate for the purposes described in this Policy, and we do not use personal data for new, incompatible purposes without providing further notice and obtaining consent or authorization where required. Where we process personal data on a seller’s behalf, we do so under the seller’s instructions and our agreement with that seller.

Deidentified, Anonymous, and Aggregate Data. Where permitted by applicable law, our agreements with sellers, and applicable Amazon requirements, we may create, use, retain, and disclose deidentified information, anonymous information, and aggregate consumer information to analyze the performance of our own Services and improve them. We do not combine information accessed through Amazon for one seller with information of another seller, and we do not use that information to create statistics or benchmarks across sellers. We take reasonable measures so that deidentified information cannot reasonably identify, relate to, describe, or be linked to an individual or household. Aggregate consumer information concerns groups or categories from which individual identities have been removed and is not linked or reasonably linkable to an individual or household, including through a device. These permissions do not override restrictions on the use or disclosure of information accessed through Amazon, including information that has been deidentified, anonymized, or aggregated. Deidentification, anonymization, or aggregation does not authorize a use prohibited by applicable Amazon requirements or replace a requirement to delete the underlying information.

We maintain and use deidentified information in that form and do not attempt to reidentify it. We contractually require recipients to maintain equivalent protections and not attempt reidentification. We treat information as anonymous only where individuals are no longer identifiable, taking account of the means reasonably likely to be used to identify them. Pseudonymized information remains personal data where an individual can still be identified. These uses do not authorize AI model training prohibited by Section 7.

5. How We Share Personal Data

We share personal data with service providers that support our operations, limited to what each provider needs to perform its function. These providers support the Consulting Services, Briksten Services, or both, as described below. We require providers that process personal data on our behalf to do so under written data protection terms. We also disclose personal data where required by law or to establish, exercise, or defend legal rights, and in connection with a corporate transaction. We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not provide or license it to another company for that company’s independent marketing. Payment providers may separately process payment information for their own legal, security, and fraud-prevention purposes under their privacy policies.

The categories of service providers we use, and the information each receives or accesses, are as follows:

Provider list and changes. We maintain a dated list identifying our providers, their functions, and the Services they support at pnlconsultings.com/subprocessors. Where a provider processes personal data on our behalf in delivering Services for a seller, the list identifies that provider as a subprocessor. We post additions or replacements at least 30 days before the new provider begins processing affected personal data. Any additional notice, authorization, or objection requirements in our agreement with the seller or applicable law also apply.

Our employees and authorized contractors may access information obtained through Seller Central for the Consulting Services or through SP-API for the Briksten Services only as needed to perform their assigned responsibilities in providing the Services. Authorized contractors who access seller information are bound by written confidentiality and data protection obligations. We may provide information to Amazon and its authorized assessors where necessary for compliance reviews, security investigations, and audits, subject to applicable confidentiality requirements. Disclosures of information accessed through Amazon to service providers or in connection with a corporate transaction remain subject to applicable Amazon requirements.

We require our subprocessors to protect data to a standard at least equivalent to the protections we are required to provide for that data, and we will support audits by Amazon and sellers as required by applicable Amazon requirements and our agreements with sellers, including by obtaining the audit reports and information our subprocessors’ agreements provide.

We also use market-research tools for marketplace research; we do not provide them with personal data or seller data, and no seller account is connected to them. Authorized contractors may have restricted access to information needed to perform their work, separately from the platforms used to engage or pay them.

Stripe payments. For information about Stripe’s handling of personal data, see Stripe’s Privacy Policy (https://stripe.com/privacy).

Our service providers and authorized contractors may process personal data in the United States, the European Economic Area, the United Kingdom, and the Philippines. Additional information about international transfers appears in Section 13.

6. Marketing Communications

Where we send marketing or promotional email to sellers, their personnel, or other business contacts about the Consulting Services or Briksten Services, we do so only where permitted by applicable law and obtain consent where required. We do not use Amazon buyer personal data for marketing or promotional communications.

Each message identifies itself as a marketing or promotional communication where required, includes a clear way to opt out of further commercial email, and includes a valid physical postal address. If an individual asks us to stop sending commercial email, we will honor that request. To opt out of marketing communications, use the unsubscribe link in the message or contact us at privacy@pnlconsultings.com.

Opting out of marketing does not prevent us from sending necessary communications about an existing consulting engagement or Briksten account, including billing, security, support, and changes affecting the applicable Service.

We do not send marketing or promotional text messages.

7. Artificial Intelligence

We use artificial intelligence (AI) in both Services. For the Consulting Services, our personnel use third-party AI tools to assist with analysis and content preparation. For the Briksten Services, third-party AI tools power features that sellers and authorized users initiate through the application. The AI functions described below analyze information and generate text, recommendations, or images.

Consulting Services. For the Consulting Services, AI is our own work tool: a text-and-analysis provider assists with analyzing seller business figures including revenue and margin and drafting listing text, and image-generation providers assist with product images. The text-and-analysis tool is also connected to our own Microsoft 365 account, so it may process business contact details contained in email, calendar entries, files, and chat messages. Business figures and work content may also constitute personal data where they relate to an identifiable individual, including a sole proprietor. We do not submit Amazon buyer personal data to these tools.

Briksten Services. For the Briksten Services, AI is a function of the application itself. It runs under the application’s own AI-provider credentials, not the seller’s Amazon account credentials, and prepares and improves listing content for a seller’s own products—translating product titles into the language the seller or authorized user selects, generating optimization suggestions, and producing product images—through features initiated by the seller or authorized user. Those features process that seller’s own listing and product information, publicly available competitor listing information, and buyer feedback text such as reviews and return reasons. No Amazon buyer personal data or cost or margin figures are sent to AI providers through the Briksten Services.

Briksten identifies its AI-powered features and the outputs they generate within the application so that sellers and authorized users can distinguish AI-generated content from other information displayed in the workspace.

Image-generation tools. For both Services, our image-generation providers receive product and listing information only, without personal data or cost or margin figures.

Model training. We use the AI providers’ paid business interfaces. We do not use seller information, including non-personal business information, to train or improve AI models, and we do not permit our AI providers to use submitted information to train or improve their models. These restrictions also cover using seller information to fine-tune models or as training, testing, or validation datasets for model development or improvement; processing information to generate a requested output is distinct from using that information for model development. These restrictions apply to both Services.

The restriction on model training does not mean that AI providers never retain submitted information. Information submitted to AI providers remains subject to the applicable processing and retention arrangements described in Sections 5 and 10.

Amazon Information. Our use of Amazon Information in connection with AI remains subject to applicable Amazon requirements. The descriptions above do not authorize submitting information to an AI provider or using it for a purpose prohibited by those requirements.

Human review. AI outputs may be inaccurate, incomplete, or misleading. For the Consulting Services, our personnel review and verify AI-assisted work before relying on it and may correct or reject the output.

For the Briksten Services, sellers and authorized users should review and verify outputs generated through Briksten before using or publishing them; this seller review is separate from our personnel’s review of consulting work. Briksten displays AI-generated listing content and images for the seller’s or authorized user’s review and does not publish that content to Amazon without their approval.

Decisions about individuals. We do not use AI to make or materially assist decisions about individuals that produce legal or similarly significant effects. The Briksten AI features described above assist sellers with business analysis and product-related content and recommendations.

If we introduce a use of automated decisionmaking technology that triggers additional legal requirements, we will provide the required notices and implement the applicable rights and safeguards before beginning that use.

The categories of AI providers and the information they receive are described in Section 5. The dated provider list identifies the providers supporting each Service. Individuals may exercise applicable rights concerning personal data processed in connection with AI under Section 11 or contact privacy@pnlconsultings.com.

8. Children’s Data

Our websites and Services are directed to businesses and their personnel, not to children. We do not allow individuals under 18 to create Briksten accounts or submit personal information through our websites or Services, and we do not knowingly collect personal information from children. If we learn that we have collected personal information from a child, we will delete it.

9. Data Security

We maintain administrative, technical, and physical safeguards appropriate to the nature of the personal data we handle through both Services. These include encryption in transit and at rest, multi-factor authentication, role-based and limited access, and security monitoring. Our website server keeps visitor logs in memory only and does not write them to disk. Access by our personnel and authorized contractors is limited based on job responsibilities. Within Briksten, sellers and authorized users have access only to the seller accounts and information they are authorized to access; one seller cannot access another seller’s account or information. For the Consulting Services, access to Seller Central is limited by the permissions the seller grants us.

Our employees and contractors who access seller data are bound by signed confidentiality and data protection obligations and work only from devices or environments that meet our endpoint policy. We also process information on our own encrypted company device in the United States. Access from that device is subject to our access controls and endpoint security requirements.

We maintain procedures to investigate and respond to actual or suspected security incidents affecting information handled through the Services. We provide notices to affected sellers and individuals, Amazon, and authorities as required by applicable law and our contractual obligations.

We notify Amazon within 24 hours of detecting a security incident subject to notification under the Amazon DPP. We notify an affected seller within 24 hours of becoming aware of a security incident affecting information we process on that seller’s behalf, in addition to any notice required by applicable law. We maintain a named incident contact and a named deputy.

Our processing of personal data on a seller’s behalf is also governed by the data processing terms in that seller’s agreement with us.

10. Data Retention

We retain personal data and other information for the periods below, based on the purpose and type of information. This section applies to both the Consulting Services and the Briksten Services. A request to delete information or close an account does not require us to delete records we must or may lawfully retain. Amazon Information is subject to the specific restrictions below, whether or not it is personal data. Those restrictions take precedence over the general retention periods in this section.

After the applicable period, we delete or de-identify the information unless continued retention is required or permitted by law, including to meet legal obligations or resolve disputes. For Amazon Information, the specific restrictions above control. Deidentification does not replace required secure deletion, and a general business need or dispute does not independently authorize continued retention. The periods above do not authorize continued access to Seller Central or SP-API after the seller’s authorization ends. Payment providers may retain information they independently control under their own retention policies.

11. Your Privacy Rights and Choices

Depending on applicable law, you may have rights to request access to your personal data, correction of inaccurate data, deletion of your personal data, and a portable copy of your data. Additional rights and applicable conditions depend on your location, our role in processing the information, and the law governing the request, as described in Sections 12 and 13. These rights concern personal data about you, including personal data processed in connection with AI as described in Section 7. They do not automatically entitle an individual to access all information in a seller’s account.

How to Exercise Your Rights. Email privacy@pnlconsultings.com, describe your request, and provide enough information for us to identify the information involved. You do not need to create an account to submit a request. We will respond within the period required by applicable law. If we deny a request in whole or in part, we will explain the reason and any available right to appeal or complain, as required by applicable law. Where applicable law provides an appeal right, you may submit an appeal to the same email address, identifying the request and explaining why you believe our response should be reconsidered.

Verification. For requests requiring verification, we take reasonable steps to verify your identity and authority. If you have a Briksten account, we may ask you to send or confirm the request through your registered email address or authenticate through your existing account. If you do not have an account, we may request information reasonably necessary to match you to our records. We will not request more information than necessary or use verification information for unrelated purposes. If we cannot verify a request, we may be unable to fulfill it and will explain our response as required by law.

Authorized Agents. Where permitted by law, an authorized agent may submit a request on your behalf. We may require evidence of the agent’s authority and, where permitted, ask you to verify your identity or confirm that authority directly with us.

Marketing Opt-Outs and Browser Signals. You may opt out of marketing emails as described in Section 6. This does not stop necessary consulting engagement, account, billing, security, or support communications. We do not sell personal data or share it for cross-context behavioral advertising. Because we do not sell or share personal data for cross-context behavioral advertising or use it for targeted advertising, there is no sale, sharing, or targeted advertising for a browser-based opt-out signal, such as Global Privacy Control, to stop under our current practices.

Information Controlled by a Seller. Where we process personal data on a seller’s behalf in delivering the Consulting Services or Briksten Services, that seller controls the information. Submit requests about that information to the seller, including requests by buyers whose information we access through the Consulting Services and authorized users whose information we process on the seller’s behalf through Briksten. We will reasonably assist the seller as required by applicable law and our agreements. If you contact us about information we process on a seller’s behalf, we will direct the request to the seller or otherwise assist as required by applicable law and our agreement with the seller. You may contact us directly about information we control for our own account administration, billing, security, and business communications, including where you subscribed directly to Briksten.

Briksten Account Closure. A seller or an individual authorized to act for the seller may request closure of the seller’s Briksten account by contacting privacy@pnlconsultings.com. Closing an account is separate from exercising an individual privacy right and does not require deletion of information we must or may lawfully retain, subject to the limits in Section 10. An authorized user’s individual request does not, by itself, authorize closure of the seller’s account.

Payment Provider Information. Stripe and other payment providers may independently control certain payment and transaction information. Where a request concerns information controlled by a payment provider, we may direct you to that provider. You may still contact us about the billing and transaction records we control.

We will not discriminate against you for exercising an applicable privacy right.

Amazon Authorization. Sellers may withdraw their authorization for our access to their Amazon accounts. For the Consulting Services, this includes removing our Seller Central permissions. For the Briksten Services, this includes revoking the application’s SP-API authorization. Contact privacy@pnlconsultings.com if assistance is needed. When authorization ends, we stop further access and processing that depends on that authorization and delete the affected information accessed through Amazon as described in Section 10. The deletion period does not extend our authorization to access or use that information.

12. California and Other U.S. Residents

California Residents. Where the California Consumer Privacy Act, as amended (CCPA), applies to our processing of your personal information, you may request to know and access personal information, correct inaccuracies, delete information subject to exceptions, and receive a portable copy. These rights are subject to the CCPA’s coverage requirements and applicable exceptions. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information for purposes requiring a right to limit; separate opt-out and limitation links are therefore not provided. Exercise applicable rights under Section 11. Additional information about the CCPA is available from the California Department of Justice at https://oag.ca.gov/privacy/ccpa.

Residents of Other States. Where your state’s privacy law applies to our processing of your personal data, you may have rights to confirm processing, access or obtain a copy of your personal data, correct inaccuracies, request deletion, and receive information about disclosures. Rights depend on applicable coverage requirements and exceptions, including exclusions for certain business-related information. Depending on applicable law, you may also have a right to appeal our response to a request, as described in Section 11. We do not sell personal data or use it for targeted advertising or profiling that produces legal or similarly significant effects. Our AI uses are described in Section 7. Exercise applicable rights, including opting out of marketing, as described in Sections 6 and 11.

13. International Users (EU/EEA and GDPR)

The following additional disclosures apply where our processing of personal data is subject to the European Union General Data Protection Regulation (GDPR), including in connection with offering the Services to individuals in the European Economic Area (EEA). References to the GDPR include the UK GDPR where it applies; UK residents may contact the Information Commissioner’s Office.

Our Role. We act as controller for personal data whose processing purposes and essential means we determine, including information used for our own account administration, billing, business communications, marketing, and website and Service security. This includes administering direct, self-service subscriptions to Briksten.

Where we process personal data on a seller’s behalf to perform the Consulting Services or provide Briksten features under the seller’s documented instructions, we act as processor. The seller acts as controller or, where applicable, as a processor acting for another controller. Our processing is governed by the data processing terms in our agreement with the seller. A direct Briksten subscription does not, by itself, change our role for information processed on that seller’s behalf.

Requests concerning information we control may be directed to us. Requests concerning information we process on a seller’s behalf are handled as described in Section 11. Our contact details appear in Section 14.

Legal Bases. For personal data we process as controller, we rely on the legal bases described in the table below: contract performance where you are a party to the contract; compliance with legal obligations, including tax and accounting requirements; our legitimate interests in operating and securing the Services and communicating with business contacts; or consent where required. We rely on legitimate interests only where they are not overridden by your interests or fundamental rights. Where we act as processor, the seller or other relevant controller determines the lawful basis and we process personal data under the seller’s documented instructions.

Required Information. Providing certain account, contact, and billing information is necessary to establish and administer the seller relationship, provide the Services, and meet applicable legal obligations. If required information is not provided, we may be unable to provide the relevant Services. Information requested solely for optional marketing is not required to use the Services.

Sources and Categories. The categories of personal data and their sources are described in Section 3. Depending on the activity, we receive information directly from individuals, from sellers that provide information or designate authorized users, through authorized Seller Central or SP-API access, or automatically through website and Briksten activity.

GDPR Processing Activities and Lawful Bases

The following table describes the main processing activities for the Consulting Services and Briksten Services, the information involved, and the applicable legal bases where we act as controller. The seller or other relevant controller determines the lawful basis for activities we perform solely as a processor. AI processing may involve personal data as described in Section 7. Non-personal information is not subject to the GDPR merely because it is processed using AI. Provider categories and processing locations appear in Section 5. See Section 10 for the retention schedule.

Your Rights. Subject to applicable conditions and exceptions, you have the following rights:

Information and Access. Be informed about our processing, confirm whether we process your personal data, and obtain access to it and related processing information.

Rectification. Have inaccurate personal data corrected and incomplete personal data completed.

Erasure. Request deletion of your personal data where the applicable conditions are met.

Restriction. Request that we restrict processing in the circumstances provided by law.

Data Portability. Receive personal data you provided in a structured, commonly used, machine-readable format and, where applicable, have it transmitted to another controller.

Objection. Object to processing based on legitimate interests on grounds relating to your situation, and object at any time to processing for direct marketing, including related profiling.

Withdrawal of Consent. Withdraw consent at any time where processing relies on consent, without affecting the lawfulness of earlier processing.

Automated Decisions. Not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, subject to applicable exceptions. We do not make these decisions about individuals. Our AI uses and human-review practices are described in Section 7.

Complaints. Lodge a complaint with a supervisory authority, as described below.

Submit requests through Section 11. We respond without undue delay and generally within one month. Where permitted for complex or numerous requests, we may extend that period by two further months and will explain the extension within the first month. Where we process information on a seller’s behalf, we assist the seller in responding as required by applicable law and our agreement with the seller.

International Transfers. We are established in the United States, and our service providers and authorized contractors may process personal data in other countries, as described in Section 5. The P&L Consultings website (pnlconsultings.com) is hosted in the United States. Briksten, including its website www.briksten.com, is hosted in Germany for all customers, including customers outside the European Union. If we add a hosting location, we will update this Policy before any customer data is stored there. We also process information on our encrypted company device in the United States. Hosting information in the European Union does not prevent access from outside the EEA. Personal data may be accessed from or transferred to the United States and other countries whose data protection laws differ from those in your country.

Where transfers require safeguards under the GDPR, we rely on the European Commission’s Standard Contractual Clauses incorporated into the applicable data processing terms in our agreement with the seller, together with supplementary measures where required. You may contact us at privacy@pnlconsultings.com for information about the safeguards applicable to your personal data and to request a copy.

Data Protection Questions and Complaints. Contact privacy@pnlconsultings.com about data protection concerns. You may lodge a complaint directly with a competent supervisory authority, particularly in the EEA country of your habitual residence, place of work, or the alleged infringement. Contact details are available in the European Data Protection Board’s directory of supervisory authorities at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. You do not need to contact us before lodging a complaint.

14. How to Contact Us

For privacy questions or to exercise your rights, contact us by email at privacy@pnlconsultings.com or by mail at PL Signature Holding LLC (P&L Consultings), 1807 Alpha Rd, Glendale, CA 91208, USA.

15. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a revised “Last updated” date and, where required, provide additional notice.