Organizational Change Notification Policy

Digital Club Operations, S.L. (trading as Digital Club Agency) CIF B70858964 · Calle Gran Vía 54, 3B · 28220 Majadahonda (Madrid), Spain

Document status. This is the controlled copy of the policy, published by Digital Club Operations, S.L. at the URL above. The version number and effective date in the table below identify the copy in force; superseded versions are retained internally. Published policies are adopted by resolution of the company's management and do not require a handwritten signature to be binding.

This policy satisfies the requirement, under section 3.11 of the Amazon Data Protection Policy and the Amazon Acceptable Use Policy, that a Solution Provider maintain a written policy requiring it to inform Amazon, within 30 days, of any organizational change or event that changes its need for, or use of, Information.

---

1. Purpose

Digital Club Operations receives Amazon Information in order to provide services to selling partners. Amazon must be able to rely on the fact that the organisation it granted access to is still the organisation using that access, for the same purposes. This policy makes the notification obligation explicit, assigns it to named owners, and defines how compliance is evidenced.

Policy statement: Digital Club Operations, S.L. will inform Amazon of any organizational change or event that changes its need for, or use of, Amazon Information within 30 calendar days of that change taking effect.

2. Scope: what counts as a notifiable change

The following are notifiable, whether or not they are considered material internally:

Corporate and ownership

• Merger, acquisition, or any other transfer of business ownership or control, whether Digital Club Operations is the acquirer or the target.
• Change of legal entity, corporate name, registered office or tax identification number (CIF).
• Sale or transfer of a business line that uses Amazon Information.
• Insolvency, winding-up or cessation of trading.

Products and services

• Material change in the products or services offered to selling partners.
• Starting to use Amazon Information for a new purpose, or for a new product.
• Ceasing to need Amazon Information, or ceasing to provide services that require it (which also triggers deletion of the Information under the retention requirements of the Data Protection Policy).

Data handling and technical

• Material change in how Amazon Information is stored, processed or transferred, including a change of hosting region or cloud provider.
• Addition or replacement of a subprocessor with access to Amazon Information.
• Change of the Incident Management Point of Contact (IMPOC) or of the security contact details held by Amazon.
• Material change in the population of personnel with access to Amazon Information, such as outsourcing an operations function.

Compliance

• Any event that materially affects the organisation's ability to comply with the Amazon Data Protection Policy or Acceptable Use Policy.

When it is unclear whether a change is notifiable, the organisation notifies. Over-reporting has no penalty; under-reporting does.

3. Responsibilities

Notification is not optional and not delegable to a third party: one of the two Co-CEOs signs off every notification before it is sent.

4. Procedure

1. Detect. The change is identified, either by its owner or through the quarterly review.

2. Assess. Within 5 business days, the policy owner and the CTO assess whether the change falls within section 2 and how it affects the need for or use of Amazon Information.

3. Notify Amazon within 30 calendar days of the change taking effect, through:

   • a case opened with Amazon SP-API Developer Support (https://developer.amazonservices.com/support) for changes affecting API access and use of Information; and
   • an update of the organisation's profile in the Solution Provider Portal / Service Provider Network, where the change affects the published business information; and
   • the Amazon Ads partner contact, where the change affects the advertising partner relationship.

   The notification states: the nature of the change, its effective date, its effect on the need for and use of Amazon Information, any change to the systems or subprocessors holding that Information, and the current IMPOC contact details.

4. Record. The notification, its date, the channel used and Amazon's response are filed in the compliance register (held internally, retained for at least 3 years and made available to Amazon on request). Records are retained for at least 3 years and made available to Amazon on request.

5. Follow through. Any action Amazon requests as a result of the notification is tracked to completion by the policy owner.

5. Monitoring and review

• Quarterly change review. Once per quarter the policy owner and the CTO review the previous quarter for notifiable changes: corporate events, new or discontinued services, new subprocessors, changes of contacts. The review is recorded even when it finds nothing, so that the absence of notifications is evidenced rather than assumed.
• Event-driven check. Any corporate transaction, launch of a new service line or change of provider triggers an immediate check against section 2, without waiting for the quarterly cycle.
• Policy review every 6 months, and after any change to Amazon's requirements. Version history is maintained below.

6. Version history