Privacy Policy

Last updated: November 2, 2026

UR Mall (“UR Mall”, “we”, “us” or “our”) is an international e-commerce growth company with offices in Wyoming, USA and Cairo, Egypt. We provide Amazon account management, performance marketing and media buying, and e-commerce store building and management services for brands and manufacturers.

Protecting the data of the businesses we work with, and of their customers, is central to how we operate. This Privacy Policy explains what information we collect, how we use it, how long we keep it, how we protect it, and how we delete it, whether you are visiting urmall.org, contacting us, or working with us as a client.

1. Scope

This policy applies to:

  • Visitors to urmall.org and anyone who contacts us through our forms, email, phone or WhatsApp.
  • Clients who authorize us to access their Amazon Seller Central, Vendor Central or Amazon Ads accounts.
  • Clients who grant us access to their advertising accounts (such as Meta, TikTok, Snapchat and Google), analytics tools and e-commerce platforms (such as Shopify, Salla, Zid and WooCommerce).

2. Information We Collect

2.1 Information you provide to us

Name, business email, phone number, company name, website or store URL, and any details you share with us through contact forms, consultation calls, proposals and service agreements.

2.2 Client business data

When you engage our services and grant us access, we may process business data required to deliver those services, including product listings, catalog and inventory data, pricing, sales and order reports, advertising campaign data, budgets and performance metrics, store settings and analytics reports.

2.3 Website usage data

Basic technical information such as browser type, device type, referring pages and pages visited, collected through cookies and analytics tools to keep our website working and improve it.

3. How We Use Information

  • To respond to inquiries, run consultations and prepare project quotations.
  • To deliver, manage, optimize and report on the services agreed in your service contract.
  • To communicate with you about your projects, invoices and service updates.
  • To comply with legal, tax and accounting obligations.
  • We use client data only to provide services to that client. We never use one client’s data to benefit another client.

4. We Do Not Sell or Share Client Data

UR Mall does not sell, rent, trade, license or otherwise share client business data or customer data with any third party, including other companies, marketing agencies, data brokers, list providers or advertisers. Client data is never used for our own marketing, never combined with data from other clients, and never disclosed to anyone outside the authorized UR Mall team working on that client’s account, except:

  • When the client gives us explicit written instructions to share specific data.
  • With service providers that help us run our business (for example, hosting and email), who receive only what they need and are bound by confidentiality obligations.
  • When disclosure is required by law, regulation or a valid legal request.

5. Amazon Data and Amazon Customer PII

When we access Amazon data on behalf of a selling partner, through Seller Central, Vendor Central, Amazon Ads or the Selling Partner API, we comply with Amazon’s Acceptable Use Policy (AUP), Data Protection Policy (DPP) and Solution Provider Agreement. Specifically:

  • Authorized access only: we access a seller’s account only after the seller grants us permission through Amazon’s official user-permission tools, and only for the services agreed with that seller.
  • Least privilege: each team member receives the minimum permissions needed for their role, and permissions are reviewed regularly and removed when no longer required.
  • Purpose limitation: Amazon data is used solely to provide services to the seller who authorized us. We never use it to contact Amazon customers, for marketing outside Amazon, or for any purpose not permitted by Amazon.
  • Customer PII: Amazon customer personally identifiable information (such as buyer names, shipping addresses, phone numbers and email addresses) is accessed only when strictly necessary to fulfill an order-related task for the seller, is never exported for marketing, never shared with any third party, and is not stored outside Amazon’s systems unless required to complete that task.
  • PII retention: any Amazon customer PII we must temporarily hold is deleted no later than 30 days after order delivery, or sooner once the task is complete.
  • No aggregation: we do not aggregate Amazon data across multiple sellers or use it to build profiles of Amazon customers.

6. Performance Marketing and Advertising Data

For performance marketing and media buying clients, we work inside the client’s own advertising, analytics and store accounts. In doing so:

  • Client-owned accounts: ad accounts, pixels, conversion tracking, audiences and analytics properties remain owned by the client. We access them through partner or user access granted by the client, never through shared personal logins.
  • Customer and audience lists: any customer lists or audiences a client provides (for example, for retargeting or lookalike audiences) are used only for that client’s campaigns, uploaded only to the client’s own ad accounts, and never reused for another client or shared with any other party.
  • Tracking and pixels: pixels and conversion tracking are installed and connected only on the client’s own properties and ad accounts, to measure that client’s campaign performance.
  • Reports: campaign reports and performance data are shared only with the client and the people the client authorizes.

7. E-commerce Store Building and Management

When we build or manage an online store, we access the client’s store platform, domain, payment and shipping settings only as needed to complete the agreed work. Store administrator access is granted through individual staff accounts where the platform allows it. Upon project completion, full ownership and all administrator credentials are handed over to the client, and our access is reduced or removed as agreed.

8. Data Retention and Deletion

  • During the project: we keep client data only for as long as needed to deliver the agreed services.
  • After the project ends: within 90 days of the end of a service contract, we delete or return all client business data, campaign files, customer and audience lists, and working documents, unless the client requests otherwise in writing or the law requires a longer retention period (for example, invoices kept for tax purposes).
  • Access removal: when a project ends, we remove our access to the client’s Amazon, advertising, analytics and store accounts, or ask the client to revoke it.
  • Amazon customer PII: deleted no later than 30 days after order delivery, as described in Section 5.
  • Secure deletion: data is deleted from our working systems and storage using secure deletion methods, so it cannot be recovered.

9. Data Security

We apply administrative, technical and physical safeguards to protect client data, including:

  • Access control: role-based, least-privilege access; individual user accounts for each team member; no shared logins.
  • Credential management: strong, unique passwords; multi-factor authentication (MFA) enabled on all accounts that support it; credentials stored only in an encrypted password manager and never shared by email, chat or spreadsheets; passwords rotated regularly and access revoked immediately when a team member leaves or changes role.
  • Network protection: encryption of data in transit (HTTPS/TLS 1.2 or higher), firewalls and protected networks, up-to-date operating systems and software, and anti-malware protection on all work devices.
  • Encryption at rest: any client data we must store is kept in encrypted storage.
  • Team practices: all team members sign confidentiality agreements and receive training on data protection, phishing awareness and secure handling of client accounts.
  • Logging and monitoring: access to client accounts is monitored, and unusual activity is investigated promptly.

10. Incident Management

We maintain a documented incident response plan to detect, contain, investigate and resolve security incidents. If we become aware of a security incident that may affect client data:

  • We act immediately to contain the incident, secure affected accounts and rotate any exposed credentials.
  • If the incident involves Amazon data, we notify Amazon at security@amazon.com within 24 hours of detection and cooperate fully with Amazon’s investigation.
  • We notify affected clients without undue delay, explaining what happened, what data may be affected and what steps we are taking.
  • We review the root cause and implement corrective actions to prevent recurrence.

11. Cookies

Our website uses cookies and similar technologies to keep the site working and to understand how visitors use it. You can control or disable cookies through your browser settings. Disabling some cookies may affect how the site works.

12. Your Rights

You may request access to, correction of, or deletion of your personal information or your company’s data at any time, or ask us to stop processing it, by contacting us at info@urmall.org. We will respond within 30 days.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services or legal requirements. The latest version will always be available on this page, with the date of the last update shown at the top.

14. Contact Us

For any questions about this Privacy Policy or how we handle data, please contact us:
UR Mall
Offices: Wyoming, USA and Cairo, Egypt
Email: info@urmall.org