OneTag Policy

Last updated on: February 08, 2021

This oneTag policy including the Data Processing Addendum incorporated here by reference (“oneTag Policy”) contains the terms and conditions that govern your access to and use of oneTag, and is an agreement between you and Amazon. This oneTag Policy is incorporated into and forms part of the Associates Program Operating Agreement (the “Agreement”) by reference as a Program Policy and unless expressly stated otherwise, all provisions of the Agreement will be construed as applying to this oneTag Policy.

Associates that use oneTag must:

• Publish on your Site a privacy policy that includes information about how a visitor to your Site can opt out of data processing by oneTag by visiting the Amazon Associates oneTag Preferences.
• Obtain your visitors’ consent and/or satisfy applicable legal requirements for the use of cookies, pixels, and other technologies by third parties, including Amazon and its affiliates.
• Not collect or pass to Amazon any personally identifiable information through oneTag, including but not limited to, names, email addresses, and telephone numbers.
• Not use oneTag on any site, app or service directed to children (based on the age defined by applicable law), or which collects or solicits information from children (based on the age defined by applicable law).
• Comply with Amazon’s information security policy, as updated from time to time, found here.

For more information on what data is collected through oneTag and related FAQs, see here.

Locale-specific Provisions

Australia: To the extent that oneTag processes Personal Information subject to the Privacy Act 1988 (Cth), the parties acknowledge and agree that you are the entity primarily responsible for the collection, use and disclosure of such Personal Information, and you have instructed Amazon Commercial Services Pty Ltd (“Amazon Australia”) to access, and process such Personal Information on your behalf in its capacity as a service provider to you to provide you with oneTag reporting and any related technical support, pursuant to this oneTag Policy. You agree that Amazon may use a third party sub-contractor or Amazon affiliate to perform the services pursuant to this oneTag Policy, including entities located in foreign countries. You must ensure that you have provided the appropriate notifications, and procured any necessary consents or authorisations, to allow you to collect, use and disclose such Personal Information to Amazon Australia, and to allow Amazon Australia to collect, use and disclose such Personal Information, for the purposes of the oneTag program, as contemplated by the Agreement and in accordance with the Privacy Act 1988 (Cth) and any implementation or successor thereof. “Personal Information” means personal information within the meaning of the Privacy Act 1988 (Cth) and any implementation or successor thereof.

Brazil: To the extent that oneTag processes Personal Data subject to LGPD requirements, the parties acknowledge and agree, for the purpose of creating oneTag reporting, that you are the data controller in respect of such Personal Data, and you have instructed Amazon Serviços de Varejo do Brasil Ltda. (“ASVB”) to process such Personal Data on your behalf as your data processor to provide you with oneTag reporting and any related technical support, pursuant to this oneTag Policy. The parties acknowledge and agree that ASVB may appoint any duly designated Amazon affiliate to act as a sub-processor in connection with these terms, including affiliates located in foreign countries. For that purpose, you shall include in your website information to your users making it clear that their Personal Data may be transferred outside of Brazil. “Personal Data” means personal data within the meaning of applicable laws of Brazil, including LGPD. “LGPD” means the Brazilian General Data Protection Law (Law 13,709, of August 14, 2018) and any implementation or successor thereof.

Canada: To the extent that oneTag processes personal information subject to the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 (“PIPEDA”), the parties acknowledge and agree that you are the entity accountable under PIPEDA for the collection, use and disclosure of such personal information, and you have instructed Amazon.com.ca, Inc. to process such personal information on your behalf as your service provider to provide you with oneTag reporting and any related technical support, pursuant to this oneTag Policy.

CCPA: To the extent that oneTag processes personal information subject to CCPA requirements, the parties acknowledge and agree that you are the entity accountable under CCPA for the collection, use and disclosure of such personal information, and you have instructed Amazon.com Services LLC to act as your service provider (as defined by CCPA). This section applies solely to the extent that CCPA applies. “CCPA” means the California Consumer Privacy Act, California Civil Code Section 1798.100 et seq. and any implementation or successor thereof.

EU & UK: To the extent that oneTag processes Personal Data subject to GDPR requirements, the parties acknowledge and agree, for the purpose of creating oneTag reporting, that you are the data controller in respect of such Personal Data, and you have instructed Amazon Europe Core S.à r.l. (“AEC”) to process such Personal Data on your behalf as your data processor to provide you with oneTag reporting and any related technical support, pursuant to this oneTag Policy. The parties acknowledge and agree that AEC may appoint any duly designated Amazon affiliate to act as a sub-processor in connection with these terms. “Personal Data” means personal data within the meaning of applicable laws of the European Economic Area, including GDPR. “GDPR” means the General Data Protection Regulation (Regulation (EU) 2016/679) and any implementation or successor thereof. Any reference to the applicable law of the European Economic Area, including the GDPR, that is directly applicable or directly effective in the United Kingdom at any time is a reference to such law as it applies in England and Wales from time to time including as retained, amended, extended, re-enacted or otherwise given effect on or after 11pm on 31 of January 2020.

India: To the extent that oneTag processes any 'sensitive personal data or information' or 'personal information' (“Personal Data”) for the purpose of creating oneTag reporting, you are the data fiduciary in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 and any future amendments thereto, and you have instructed Amazon Seller Services Private Ltd. to process such Personal Data on your behalf as your data processor to provide you with oneTag reporting and any related technical support, pursuant to this oneTag Policy. The parties acknowledge and agree that Amazon Seller Services Private Ltd. may appoint any duly designated Amazon affiliate to act as a sub-processor in connection with these terms, including affiliates located in foreign countries. For that purpose, you shall include in your website information to your users making it clear that their Personal Data may be transferred outside of India. The term 'personal information' means information as per the provisions of the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 and any future amendments thereto.

Japan: Associates that use oneTag must not collect or pass to Amazon any personal information, as defined in Paragraph 1, Article 2 of Act on the Protection of Personal Information, through oneTag, including but not limited to, names and contact information.

Mexico: To the extent that oneTag processes Personal Data in Mexico, the parties acknowledge and agree, for the purpose of creating oneTag reporting, that you are the data controller in respect of such Personal Data, and you have instructed Servicios Comerciales Amazon México, S. de R.L. de C.V. (“Amazon Mexico”) to process such Personal Data on your behalf as your data processor to provide you with oneTag reporting and any related technical support, pursuant to this oneTag Policy. The parties acknowledge and agree that Amazon Mexico may appoint any duly designated Amazon affiliate to act as a sub-processor in connection with these terms. “Personal Data” means personal data within the meaning of the Federal Law to Protect Personal Information Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) and any implementation or successor thereof.

Singapore: To the extent that oneTag processes Personal Data subject to the Personal Data Protection Act 2012 (“PDPA”), the parties acknowledge and agree that you are the entity accountable under the PDPA for the collection, use and disclosure of such Personal Data, and you have instructed Amazon Asia-Pacific Holdings Private Limited to process such personal information on your behalf as a data intermediary to provide you with oneTag reporting and any related technical support, pursuant to this oneTag Policy. “Personal Data” means personal data within the meaning of the PDPA and any implementation or successor thereof.