Privacy

Philippe Ramón Hamerla, Agiou Georgiou 2-4, 8220 Chlorakas, Paphos, Cyprus

Email: team@merchavio.com

No data protection officer has been appointed, as the legal requirements for a mandatory appointment are not met. Please use the email address above for data protection enquiries.

• Visiting the website: when you access the site, our server processes technically necessary connection data (IP address, time, requested address, browser identifier) to deliver the pages and protect them against misuse, e.g. by limiting repeated requests. We do not store access logs containing IP addresses.
• Account (seller/team/buyer): name, email, password (stored only as a bcrypt hash) or, for Google sign-in, the Google account identifier, business data (company, address, VAT ID), store data and uploaded product/media content, as well as proof of your confirmations at registration (time, version of the accepted terms, confirmation of business use).
• Purchase: name and email address of the buyer, ordered products, amounts, order status and proof of the declarations made during the order process (ticked checkboxes, time, version of the texts and IP address).
• Payment: payment data is collected and processed directly by Stripe; we do not receive full card details, only payment and subscription status and pseudonymous identifiers (customer/subscription ID).
• Shop visit statistics: page viewed, time, type of event (e.g. view, cart) and referring page (referrer); only with your consent, additionally a random visitor ID (see section 4).
• Partner programmes: the partner code of a link through which you arrived and the time of the click; upon registration or purchase, the attribution to that partner.
• Community, livestreams and voice rooms: your posts and chat messages and, if you actively participate or go live, camera/microphone data (audio/video) during the session.
• Notifications: if you allow web push in your browser, a device-related push identifier (subscription token).
• Team access: name, email address and assigned role/permissions of people a seller invites to their account.
• Finance and bookkeeping module (sellers): the receipts and invoices you upload, including the information they contain (also about third parties such as issuers), as well as your categories, notes, fixed costs and the evaluations calculated from them.
• Communication: content of your enquiries to our point of contact and related email metadata.

• Provision of the platform, accounts, storefronts, checkout and sign-in (including Google sign-in): Art. 6(1)(b) GDPR (contract/pre-contractual measures).
• Processing of connection data, prevention of misuse and fraud, IT security, stability: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning service).
• Proof of declarations at registration and purchase, including the IP address at purchase: Art. 6(1)(c) and (f) GDPR (obligations to provide evidence and legitimate interest in being able to prove conclusion of contract and consents).
• Sending transactional emails (order, account and password emails): Art. 6(1)(b) GDPR.
• Retention of invoice/accounting data and tax reporting obligations (e.g. DAC7): Art. 6(1)(c) GDPR (legal obligation).
• Shop visit statistics without a visitor ID and counting clicks on partner links: Art. 6(1)(f) GDPR (legitimate interest of sellers and of us in measuring reach and settling partner programmes; no usage profiles are created).
• Storing a visitor ID, partner codes and the marketplace attribution in your browser: only with your consent, Art. 6(1)(a) GDPR in conjunction with Art. 5(3) of Directive 2002/58/EC (ePrivacy Directive) as implemented nationally.
• Attributing a referred account to a partner and settling the commission: Art. 6(1)(b) GDPR towards the partner and Art. 6(1)(f) GDPR towards the referred seller (legitimate interest in a traceable settlement).
• Provision of the finance and bookkeeping module including receipt upload, evaluations and export, as well as team access and connecting own domains: Art. 6(1)(b) GDPR. Where uploaded receipts contain personal data of third parties (e.g. of issuers), we process it on behalf of the respective seller, who is the controller in this respect (Art. 28 GDPR); the seller usually bases this processing on commercial and tax retention obligations (Art. 6(1)(c) GDPR) or on a legitimate interest in orderly bookkeeping (Art. 6(1)(f) GDPR).
• Community features (posts, chat, livestreams, voice rooms): Art. 6(1)(b) GDPR; camera/microphone use and web push notifications only take place with your express permission, Art. 6(1)(a) GDPR (consent).
• Sending marketing/newsletter emails: only with your consent, Art. 6(1)(a) GDPR; you can withdraw your consent at any time via the unsubscribe link or our point of contact.

As technically necessary and permitted without consent, we store in your browser the sign-in token, the cart and local working states of the app, your settings (e.g. language) and your consent decision. In addition, a so-called service worker stores program files of the site in the browser cache so that it loads faster.

Only with your consent do we store a random visitor ID for the visit statistics of shops, partner codes for attributing referrals (platform partner programme and sellers’ partner programmes) and a cookie recording that you opened a shop via the marketplace. Without consent we store none of this; a partner code then only works until you reload the page. We do not use third-party advertising or analytics cookies.

Sellers see statistics on views, pages viewed and referring pages for their shop, but no names, email addresses or IP addresses of visitors.

You can withdraw your consent at any time with effect for the future via the “Cookie settings” link (in the footer and on the “Cookies” page); the entries and cookies mentioned are then deleted. If you choose to sign in with Google or make a payment, third-party services (Google sign-in, Stripe, PayPal) are integrated that may set or read their own cookies. Details, storage periods and providers can be found on the “Cookies” page.

The content, fonts and scripts of our website are generally delivered from our own server (self-hosted); simply browsing the platform does not establish connections to third-party CDNs (e.g. Google Fonts).

Exceptions: (a) only if you click “Continue with Google” or “Sign up with Google” on the sign-in or registration screen is the Google sign-in script loaded from Google’s servers. (b) For payment, you are redirected to a secure page hosted by Stripe or PayPal.

Content embedded by sellers: sellers can embed third-party content on their storefronts, product pages and in communities, in particular videos (e.g. YouTube, Vimeo, Twitch) and review widgets (e.g. Trustpilot). When such content is loaded, your IP address is transmitted to the respective provider, which may set its own cookies. Where possible, the content is only loaded after you click. Course and product videos uploaded by sellers themselves are delivered via Bunny Stream (see section 7).

The “Google Identity Services” script is only loaded when you click “Continue with Google” or “Sign up with Google” on the sign-in or registration screen (two-click solution); before that, no connection to Google is established. When it is loaded, your IP address is transmitted to Google. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for users in the EEA); the parent company is Google LLC, USA.

After successful sign-in, Google sends us a signed token with your email address, your name and a Google account identifier, which we use to create or match your account. Google may set its own cookies and process data in this context.

The legal basis is Art. 6(1)(b) GDPR (sign-in requested by you) or, where cookies requiring consent are set, your consent given by clicking the Google button (Art. 6(1)(a) GDPR). If you use email/password sign-in instead, the Google script is not loaded.

• Hosting: Hetzner Online GmbH, Germany (server location EU); processing on our behalf under Art. 28 GDPR.
• Object storage and name resolution: Cloudflare, Inc. (USA). Uploaded files and media, including receipts from the finance and bookkeeping module, and our backups are stored in the “Cloudflare R2” object storage (region EU). Cloudflare also operates the name resolution (DNS) of our domain; the traffic when you visit the website does not pass through Cloudflare. Transfers to the USA are safeguarded by Cloudflare’s certification under the EU-U.S. Data Privacy Framework and EU standard contractual clauses.
• Payments (card, SEPA and others): Stripe Payments Europe, Ltd. (Ireland); in the course of payment processing, Stripe may transfer data to Stripe, Inc. (USA), safeguarded by the EU-U.S. Data Privacy Framework and standard contractual clauses.
• Payments (PayPal): PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. If you choose PayPal for a purchase or a subscription, your name, email address, amount and order/subscription ID are transmitted to PayPal for payment processing; PayPal is independently responsible for this. If the seller has connected their own PayPal business account, we only technically create the subscription or payment at PayPal using the seller’s credentials and in the seller’s name; the buyer data mentioned (name, email, amount, order/subscription ID) is processed in this context, and the seller is the controller for this PayPal merchant relationship. If sellers pay for their Merchavio plan via PayPal, we only receive the payment and subscription status and pseudonymous identifiers from PayPal.
• Sign-in: Google Ireland Limited / Google LLC (USA) for the optional Google sign-in, safeguarded by the EU-U.S. Data Privacy Framework and standard contractual clauses.
• Email delivery: sending of transactional emails and, only with your consent, marketing emails via Brevo (Sendinblue GmbH, Cologne, or Brevo SAS, France, EU) as processor.
• Mailboxes: Zoho Corporation (USA) provides the mailboxes of our contact and support addresses (data centre USA). If you email us, your message, your email address and any attachments are stored there; processing on our behalf under Art. 28 GDPR; transfers to the USA are safeguarded by the EU-U.S. Data Privacy Framework and/or EU standard contractual clauses.
• Live streaming, voice rooms and video communities: LiveKit, Inc. (USA) operates the real-time audio/video infrastructure as “LiveKit Cloud”. If you join a livestream or voice room or go live yourself, the audio/video and connection data transmitted is processed via LiveKit. Where we additionally use our own TURN server as a connection aid, it runs on our server in the EU. Transfers to the USA are safeguarded by EU standard contractual clauses.
• Video hosting: BunnyWay d.o.o. (Slovenia, EU) provides the delivery of uploaded course/product videos via a content delivery network under “Bunny Stream”; the original files remain in the EU object storage (Cloudflare R2).
• Push notifications: if you enable web push in your browser, the (encrypted) notification is delivered via the push service of your browser or device manufacturer; your browser selects this service.
• Sellers: when you make a purchase, the respective seller receives the data required to perform the contract (name, email, order data) as an independent controller and may contact you within the legal limits (or with your consent).
• Partners: if you registered as a seller via the link of a partner of our partner programme, that partner sees in the partner portal the name of your shop, your partially masked email address, the registration date, your plan and status, and the resulting commissions. The partner is an independent controller in this respect; the legal basis for the transfer is Art. 6(1)(f) GDPR (traceable commission settlement).
• App products (“Works with Merchavio”): if you buy a software product (app) from a seller, we transmit the order data required for activation (name, email, order number, plan), signed and encrypted in transit, to the app service configured by the seller; the seller is the controller for this processing.

The technical service providers listed above (Hetzner, Cloudflare, Stripe, PayPal, Google, Brevo, Zoho, LiveKit, Bunny) are also the sub-processors within the meaning of the Data Processing Agreement; the list there (page “DPA (Art. 28)”, section 7) is identical to this list. Sellers, partners, app providers and your browser’s push service, by contrast, are independent controllers or not processors for us.

Where data is transferred to recipients in the USA (Cloudflare, Stripe, Google, Zoho, LiveKit), the transfer is based on an adequacy decision (EU-U.S. Data Privacy Framework) and/or on EU standard contractual clauses under Art. 46(2)(c) GDPR together with supplementary safeguards. Hetzner, Brevo and Bunny process within the EU/EEA; PayPal (Europe) is based in Luxembourg. A copy of the safeguards can be requested via our point of contact.

• Connection data: only for the duration of the request; we do not keep access logs containing IP addresses. Server error logs are limited in size and automatically overwritten.
• Account data: until the account is deleted; the data is then deleted unless statutory retention obligations apply.
• Order and invoice data: in accordance with the statutory commercial and tax retention periods (usually 6–10 years). We store the proof of declarations at registration and purchase together with the account or order data.
• Visit statistics and clicks on partner links: 90 days, then automatically deleted.
• Entries in your browser: visitor ID until you withdraw consent or delete it in your browser; sellers’ partner codes 30 days; the platform partner programme’s partner code and the related cookie 90 days; marketplace cookie 24 hours.
• Attribution of an account to a partner: as long as commissions can arise from it, then in accordance with the tax retention periods for the settlements.
• Community content (posts, chat messages): until deleted by you, the seller or a moderator, or when the community membership ends. Live audio/video from streams/voice rooms is not stored permanently by us unless a recording is expressly offered and enabled.
• Receipts and evaluations in the finance and bookkeeping module: until deleted by the seller; the seller decides on deletion within the commercial and tax retention periods applicable to them.

• access (Art. 15 GDPR) to the data stored about you,
• rectification (Art. 16) and erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• objection to processing based on legitimate interests (Art. 21),
• withdrawal of consent given, with effect for the future (Art. 7(3)).

An informal message to team@merchavio.com is sufficient to exercise these rights.

You have the right to lodge a complaint with a data protection supervisory authority, in particular with the authority responsible for us: Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal, www.cnpd.pt, or with the supervisory authority of your habitual residence.

Providing the data requested at purchase or registration is necessary for concluding the contract; without it we cannot provide the service. Beyond that, there is no obligation to provide data.

We do not carry out automated decision-making, including profiling with legal effect, within the meaning of Art. 22 GDPR. The payment service provider Stripe may carry out automated checks for fraud prevention; Stripe is independently responsible for this.

Where we process customer data on behalf of a seller (e.g. the seller’s order/customer list), the seller is the controller and we are the processor. The Data Processing Agreement (page “DPA (Art. 28)”) also applies to this processing.

We adapt this Privacy Policy when the processing or the legal situation changes. The version published here applies.