Privacy Policy
§1. Data controller
The controller of your personal data is Merkato Sp. z o.o., with its registered office in Warsaw (00-001), ul. Innowacyjna 12, KRS 0001234567, NIP 5213000000 (hereinafter the "Controller"). Contact on data protection matters: rodo@merkato.pl.
§2. Data Protection Officer
The Controller has not appointed a Data Protection Officer due to the nature and scale of the data processing. In matters concerning the protection of personal data, please contact the Controller directly at rodo@merkato.pl.
§3. Purposes and legal bases of processing
Personal data are processed for the following purposes: - concluding and performing the agreement for the provision of Platform services (Article 6(1)(b) GDPR), - fulfilling legal obligations, including issuing invoices and keeping records (Article 6(1)(c) GDPR), - pursuing the Controller's legitimate interests: ensuring security, preventing abuse, establishing and pursuing claims (Article 6(1)(f) GDPR), - sending the newsletter and marketing communications – solely on the basis of consent given (Article 6(1)(a) GDPR).
§4. Categories of data processed
We process the following categories of personal data: - identification data: first name, surname, e-mail address, telephone number, - organisation data: name, tax identification number (NIP), registered office address, industry, representative's position, - transaction data: history of offers, RFQs, negotiations and payments, - technical data: IP address, session identifiers, activity logs, information about the device and browser.
§5. Data recipients
Personal data may be disclosed to: - entities processing data on behalf of the Controller: hosting providers, payment operators, providers of CRM and e-mail marketing systems – solely on the basis of data processing agreements, - public authorities (courts, tax authorities, the Police) – where the obligation to disclose the data results from legal provisions. The Controller does not transfer personal data to third countries outside the European Economic Area or to international organisations.
§6. Data retention period
Personal data are stored for the following periods: - for the duration of the agreement and 3 years after its termination (limitation period for contractual claims), - for 5 years from the date of issue of the invoice (obligations under tax law), - until consent is withdrawn – in the case of the newsletter and marketing, - for 12 months – activity logs and technical data.
§7. Rights of the data subject
You have the following rights in connection with the processing of your personal data: - the right of access to your data and to obtain a copy of it (Article 15 GDPR), - the right to rectification of inaccurate data or completion of incomplete data (Article 16 GDPR), - the right to erasure ("right to be forgotten") in the cases specified in Article 17 GDPR, - the right to restriction of processing (Article 18 GDPR), - the right to data portability to another controller (Article 20 GDPR), - the right to object to processing based on legitimate interests (Article 21 GDPR), - the right to withdraw consent at any time – without affecting the lawfulness of processing carried out before its withdrawal. Requests should be sent to rodo@merkato.pl. The Controller will respond to them within 30 days.
§8. Cookies and tracking technologies
The Platform uses the following categories of cookies: - strictly necessary (session, authentication, security) – always active, do not require consent, - analytics (traffic statistics, user behaviour) – require consent, - marketing (remarketing, ad personalisation) – require consent. You can manage your cookie consent via the preferences panel available on the Platform or through your web browser settings.
§9. Right to lodge a complaint
If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl.
§10. Changes to the Privacy Policy
1. This Privacy Policy may change as a result of legal, technological or organisational changes. 2. Users will be informed of material changes in advance by e-mail or by a notification on the Platform. 3. This Privacy Policy applies from 1 May 2026.