Last Updated: December 3, 2025 | Mercatiq S.R.L.
This Privacy Policy (“Policy”) describes how Mercatiq S.R.L. (“MercatIQ” "we," "us," "our") collects, uses, and protects your personal data when you use our Services. By using our Services, you acknowledge that you have read and understood this Policy and agree with the practices described herein.
Capitalized terms not defined in this Policy have the same meaning set forth in our Terms of Service.
Personal Data We Process
Personal Data You Provide: (i) Name, email address, mailing or billing address, phone number, job title; (ii) messages or any information you chose to provide when giving feedback, or via support requests; (iii) account credentials
Personal Data Automatically Collected: IP address, logins, device identifiers, browser information, usage data (pages visited, features used, searches), data collected through cookies or similar technologies, as detailed in the below Section 5, and analytics data.
Personal Data From Third Parties: Data from third party services and organizations such as Google/Microsoft/LinkedIn sign-in, and business intelligence sources for B2B users.
How We Use Your Personal Data And Legal Bases For Processing
2.1. We Process Your Personal Data For The Following Purposes:
For Service Delivery: Account management, authentication, customer support, platform functionality and service provision.
For Service Improvement and Developing: Understanding usage patterns, research and benchmarking, developing new features and our Services in general, A/B testing, fixing bugs, and generating aggregated statistics (anonymized, non-identifiable data are especially used for this purpose).
For Marketing: Sending promotional emails (if you opt-in), in-app personalized recommendations, surveys, and educational content.
For Legal Compliance: Complying with legal obligations, meeting privacy law’s requirements.
For Security and Fraud Prevention: Monitoring and preventing fraud, illegal use of the Services or violation of the Terms of Service.
Business Transactions: In case of financing, merger, acquisition, sale of assets or other corporate transactions (with appropriate notice, as legally required).
2.2. Legal Bases For Processing are as follows:
Performance of a Contract. We may process your Personal Data in order to take steps at your request prior to entering into an agreement with you or when it is required to fulfill our agreement with you. This includes actions necessary to deliver the Services you have requested or subscribed to.
Legitimate Interests. We may use Personal Data when it supports our legitimate business interests and when such interests do not override your rights and freedoms. This can include enhancing or maintaining our Services, developing functionality, or keeping our Services secure. Before relying on this basis, we carefully assess potential impacts on your privacy. You may object to processing based on legitimate interests at any time.
Consent. When required by law, we rely on your consent to process Personal Data—for example, when sending certain types of marketing communications or using non-essential cookies. You may withdraw your consent whenever you choose; this will not affect any processing already carried out but will prevent future processing based on consent.
Legal Obligation. We may process Personal Data when doing so is necessary to meet our legal responsibilities, such as fulfilling tax or employment requirements or responding to lawful requests from regulatory or governmental authorities or to protect our legal rights.
How We Share Your Personal Data
We share personal data as follows:
Third-Party Service Providers: To provide and support the Services, we use Third-Party Service Providers (Sub-Processors) such as - cloud hosting, analytics, customer support, email and marketing services, CRM, payment providers. All providers are contractually obligated to protect your data. Please consult our Third-Party Service Providers (Sub-Processors) list for more information.
Legal Requirements: When required by law, court order, to enforce our applicable terms, or to protect our legal rights.
Business Transactions: In case of a business transaction such as a merger, acquisition, financing round, asset sale, or bankruptcy, your data may be transferred to the relevant entity. Any party receiving your data will be required to safeguard it under obligations at least as protective as those in this Policy.
Link to Third-Parties. Our Services may contain links to websites or services not controlled by us. These external sites may collect or use your data under their own privacy policies, which we encourage you to review. For embedded third-party features—such as social media buttons or single sign-on—those providers may collect data directly from you based on their own terms.
We do not sell your personal data.
Data Security And Data Retention
4.1. Data Security.
We take privacy and the security of your Personal Data very seriously. To safeguard your information against unauthorized access, modification, disclosure, or destruction, we implement a range of technical and organizational measures, including: Encryption in transit (TLS/SSL) and at rest (AES-256), access controls, multifactor authentication, firewalls, regular security audits, employee training.
4.2. Data Retention.
Personal Data is retained only for the period required to fulfill the purposes for which it was collected, as explained in this Policy, and to satisfy legal or business requirements. Accordingly, retention periods vary based on the specific category of data, the data subject to whom it relates, the purpose of collection, and any legal obligations that apply. Once the data retention period expires, we will delete, anonymize or destroy the data, in accordance with the applicable laws.
When determining the specific retention periods for your personal data, we consider multiple factors to ensure compliance with legal requirements and business necessity, including: (i) the type and nature of Services we provide to you (e.g. active account information is kept as long as you have an active account with us); (ii) the duration and ongoing nature of our relationship with you; (iii) mandatory retention periods established by applicable laws and regulations (e.g. transaction records may be kept for tax statutory/accounting periods, in some jurisdictions for up to seven (7) years); (iv) the purpose for which the personal data was originally collected and processed.
4.3. Personal Data Breach Notification.
In the event of a Personal Data breach that may affect your rights and freedoms, we will: (i) notify the appropriate supervisory authority without undue delay, where required by applicable law; and (ii) inform you directly if the breach is likely to result in a high risk to your rights and freedoms.
Cookies And Tracking Technologies
We use cookies and similar tracking technologies (including web beacons and pixels) to operate our Services, remember your settings, analyze how our Services are used, enhance performance, deliver tailored advertising, or support social media features. Some cookies are required for platform functionality and cannot be disabled (necessary cookies). Other cookies may involve sharing personal information with third parties (such as advertisers, analytics partners, or social media platforms), and you may have the right to opt out under applicable privacy laws. You can adjust your preferences at any time through our cookie banner or by selecting “Cookie Settings” at the bottom of any page. For more information about the cookies and trackers we use, their purposes, and how you can control them, please refer to our Cookie Policy, which forms part of this Policy.
Data Subjects Rights
6.1. In accordance with the applicable law, you may have the following rights:
The right to information: To confirm whether we are processing your personal information
The right to access: To request a copy of the personal data we hold about you.
The right to portability: To receive your personal data in a structured, commonly used and machine-readable format and have the right to transmit those personal data to another controller, in certain circumstances.
The rights to rectification (correction): To ask us to correct inaccurate or incomplete information.
The rights to erasure (the right to be forgotten): To request deletion of your data in certain circumstances.
The right to objection and restriction: If we rely on legitimate interests to process your personal data, you may have the right to object to that processing, depending on your place of residence. You may also request that we limit (restrict) the processing of your personal data in specific situations
The right to withdraw your consent: You can withdraw any consent you previously gave for processing your personal data at any time. This will not affect the lawfulness of processing carried out before the withdrawal.
The right to lodge a complaint: You have the right to file a complaint with your local data protection authority if you believe your personal data has been processed unlawfully or your rights have been infringed.
The right to not sell or share your personal information (opt-out of sale/sharing of targeting advertising): Under certain U.S. laws, you can direct us not to “sell” or “share” your personal information with third parties for cross-context behavioral advertising.
The right to non-discrimination: You have the right to exercise any privacy rights without being penalized. This means we cannot deny services, charge different prices, or reduce quality because you exercised your privacy rights.
The right to not be subject to a decision based solely on automated processing: Although we don’t do automated decision-making, if this will change, you can object to decisions made only by automated systems (without human involvement) when those decisions significantly affect you. In such cases, you may request human review and an explanation.
6.2. How to exercise Your Rights. Please e-mail us at privacy@mercatiq.com We strive to respond to all valid requests within the legally required timeframe for your jurisdiction. If additional time is needed, we will inform you.
International Data Transfers
Considering that we operate globally, your Personal Data may be stored or processed in countries outside your own, including the United States. By using our Services or providing your Personal Data, you acknowledge that your Personal Data may be transferred across international borders to us and to trusted third parties, as described in this Policy.
EEA/UK/Switzerland. If you are located in the EEA, UK, or Switzerland, we comply with GDPR. For transfer outside these regions, where possible, (i) we rely on countries or territories that have been recognized as providing an “adequate” level of protection, by European Commission or if that is not possible (ii) we rely on Standard Contractual Clauses (SCCs).
Brazil (LGPD). For international transfers from Brazil, we follow LGPD, including the use of Brazil-approved contractual clauses or other authorized transfer mechanisms.
India (DPDP Act). We will comply with the DPDP Act’s requirements for cross-border transfers once official rules are issued. Until then, we apply safeguards similar to GDPR mechanisms to ensure a high level of protection.
Other Jurisdictions. For other jurisdictions with transfer rules (such as Canada or Australia), we take reasonable steps to ensure any overseas recipients handle Personal Data in line with this Policy and applicable law.
Children's Privacy
Our Services are not intended for individuals under the age of 16 (or the minimum age required by applicable law in each jurisdiction). We do not knowingly collect personal data from children. If you are under 16, please do not use our Services or provide any Personal Data. If you believe a child has provided us with Personal Data, contact us at privacy@mercatiq.com for immediate deletion.
Changes to This Policy
We may update this Policy to reflect legal updates or business practices. If we make such changes, we will update the effective date of this Policy. Your continued use of the Services, including after such changes occur, constitutes acknowledgement and acceptance of the updated terms. If you disagree with the updated terms, you should discontinue use of the Services and, where relevant, close your account. Please review this Policy from time to time to remain informed about how we are safeguarding your information.
Contact Information
10.1. If you have any questions, concerns, or wish to exercise any of the rights described in this Policy, you can reach us using the contact information below:
Address: Data Controller: MercatIQ S.R.L., Bihor County, Saldabagiu de Munte Village, Paleu Commune, Petofi Sandor Street, No. 341, Romania; Email: privacy@mercatiq.com;
10.2. We aim to respond to all inquiries promptly and within the deadlines required by applicable laws. If you believe your concerns have not been fully resolved, you may have the right to contact your local data protection authority:
For users in Romania, The National Supervisory Authority for Personal Data Processing: Address: 28-30 Magheru Bd, District 1, Bucharest; Tel. +40 31 805 9211; Email: anspdcp@dataprotection.ro
For users in other EEA countries, a list of data protection authorities can be found through the European Data Protection Board website.
Users in the UK may contact the Information Commissioner’s Office (ICO) at https://ico.org.uk.
Brazilian users may reach the Autoridade Nacional de Proteção de Dados (ANPD) at https://www.gov.br/anpd.
Indian users may contact the Data Protection Board of India (once operational under the Digital Personal Data Protection Act) or the relevant Ministry when additional guidance becomes available.
10.3. Acknowledgement: By using our Services, you acknowledge and accept this Policy. If you do not agree with the practices described in this Policy, please discontinue using our Services immediately.
State-Specific Disclosures
11.1. Supplemental Notice: California Residents
Your Rights Under the California Consumer Privacy Act (“CCPA”) and California Privacy Rights Act (“CPRA”): if you are a California resident, you have specific rights regarding your Personal Information under the CCPA/CPRA.
Categories of Personal Information. In the last 12 months, we may have collected the following categories of Personal Information about California residents:
Identifiers: Name, email address, IP address, device identifiers, and account credentials;
Commercial Information: Purchase history, transaction records, and payment information;
Internet/Electronic Activity: Browsing history, search history, and interaction with our services
Geolocation Data: Approximate location based on IP address;
Professional Information: Job title, company name, and work-related details;
Inferences: Preferences and characteristics derived from your activity and usage patterns
Sources and Purposes: As described in this Policy.
We do not sell personal information in the traditional sense. However, we may share certain information for advertising purposes that could constitute "sharing" under CPRA.
Your California Privacy Rights. Right to Know/To access; Right to Delete; Right to Correct; Right to Opt-Out of Sale/Sharing/Targeting Advertising; Right to Limit Use of Sensitive Personal Information, Right to Non-Discrimination.
How to Exercise Your Rights. To exercise your California privacy rights, please email us at privacy@mercatiq.com. We may request additional information to verify your identity before processing requests involving access to or deletion of Personal Information.
Authorized Agents: You may designate an authorized agent to submit requests on your behalf by providing written authorization or a valid power of attorney.
Response Timeframes: We will respond to your request within 45 days (extendable to 90 days for complex requests with notification).
Data Retention. We retain personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods vary by data type and use case and as mentioned in this Policy.
Contact Information. As mentioned in this Policy.
DEFINITIONS
For the purposes of this Policy:
"Personal Data" means any information relating to an identified or identifiable natural person, or any other information defined as “personal data”, “personal information” or other similar terms under applicable law.
"Data Controller" means the entity that determines the purposes and means of processing personal data. MercatIQ acts as the Data Controller for the Personal Data it processes under this Policy. For Personal Data that the Customer provides to MercatIQ in order to deliver the Services, the Customer remains the Data Controller.
"Data Processor" means the entity that processes personal data on behalf of the Data Controller. For Personal Data that the Customer provides to MercatIQ in order to deliver the Services, MercatIQ acts as the Data Processor.
“Processing” refers to any operation or set of operations carried out on Personal Data. This includes, but is not limited to, the collection, recording, organization, structuring, storage, adaptation, use, disclosure, making available, restriction, erasure, or destruction of Personal Data.
"Data Subject" means any identified or identifiable individual whose Personal Data is processed.