MerkatisMerkatis

The French version is authoritative in the event of any discrepancy.

Privacy policy

1. Data controller

The data controller is Merkatis Solutions S.L., Calle Puerto 14, 5-5, 29016 Málaga, Spain.

Any question relating to the processing of personal data, as well as any request to exercise rights, may be sent to dpo@merkatis.io.

2. The data collected

When the account is created

  • an email address, which serves as the login identifier;
  • a password, stored in hashed form and never in clear text;
  • a contact email address at the level of the organisation;
  • the addresses of the sites whose monitoring is requested;
  • the language in which the account wishes to be served;
  • your first name and surname, your job title, your telephone number and the name of your company.

When the service is used

  • the connection records needed for sessions to work;
  • a log of administration actions, which keeps the author and the date of each action;
  • a log of emails sent, which keeps the recipient address, the date and the result of the sending, without the content of the message.

When you change your login address, the old and the new address are kept in your account's security log.

Billing data

When a contract is drawn up, the organisation also has a company name, a billing address, a country, a professional status and the tax identification numbers needed to issue invoices. To these are added the name and job title of the billing contact. For public-sector customers, the service code and the commitment number are added.

At the time of payment, the service keeps the internet protocol address and the country of issue of the means of payment, information that the tax regulations applicable to electronically supplied services require to be kept in order to establish the customer's place of establishment.

The data of the means of payment itself, namely the card number, the expiry date and the security code, are processed by the payment service provider and are never kept by the publisher.

When an intra-community value added tax (VAT) number is provided, it is checked with the European Commission's verification service, and the result of that check is kept.

Audit and contact requests

When you request a free audit, we collect: your email address, your first name and surname, the name of your company, your job title, your telephone number, the address of the site analysed and the result of the analysis, as well as the date of each request.

When you arrive on the page through a link, we record with the request the campaign identifiers that this link contains (tracking identifier, campaign parameters, advertising click identifiers) and the name of the site from which the visit comes. Advertising campaign parameters and click identifiers are recorded only with your consent (§8).

Origin of the account

The service keeps the way in which an account arrived: the source of the registration and, where applicable, the public analysis that preceded it. This information cannot be modified.

Data relating to the monitored sites

The analyses cover information that is publicly accessible from outside the sites. They do not include personal data, unless the monitored site itself publishes such data.

3. The purposes

  • providing the monitoring service and returning its results;
  • managing accounts, authentication and the validation of registrations;
  • informing the user of the changes observed on their sites;
  • issuing invoices and meeting the publisher's accounting and tax obligations;
  • ensuring the security of the service and the traceability of administration actions.

Sending you the result of the audit requested; qualifying your request and contacting you again, by telephone or by email, about the publisher's services; measuring the effectiveness of our communication campaigns.

4. The legal bases

The processing of account and service data is based on the performance of the contract.

The processing of billing data is based on compliance with legal obligations to which the data controller is subject, as well as on the performance of the contract.

The traceability of administration actions and the security of the service are based on the legitimate interest of the data controller.

Sending the result responds to your request. The use of your contact details to contact you again about the publisher's services is based on the agreement you give by sending the form. The measurement of communication campaigns is based on the legitimate interest of the publisher; the measurement of advertising campaigns is based on your consent (§8).

5. The recipients

The data is neither sold nor passed on to third parties. It is disclosed only to the following recipients:

  • the infrastructure hosting provider: OVH SAS, France;
  • the transactional email sending provider: Brevo, France;
  • the payment provider: Stripe Payments Europe Ltd, Ireland, which receives the data needed to collect payment; we do not keep any card number;
  • the advertising networks through which you arrived on our site (Google, LinkedIn or OpenAI), which receive only the click identifier that they themselves issued, under the conditions described in §8.

The first three act as processors; the terms applicable to each of them include the provisions required by Article 28 of the General Data Protection Regulation (GDPR) and are available to the customer on request. The advertising networks process the click identifier on their own behalf, as data controllers.

Where processing involves a transfer of data outside the European Union, that transfer is governed by the appropriate safeguards provided for by the applicable regulations.

The data of audit requests is accessible only to the publisher's staff in charge of commercial follow-up, and may be exported to the publisher's internal prospecting tools. It is neither sold nor transferred.

6. The retention period

Account data, namely the email address, the addresses of the monitored sites and the history of analyses, is kept for as long as the account exists. No automatic deletion is applied. Deletion may be requested at any time; it is then carried out within a reasonable time.

Billing data and the invoices issued are kept for ten years, the period required by accounting and tax regulations. This retention survives the deletion of the account: the customer's billing identity, the history of their subscription and the identifier of their account remain kept by the publisher for that period, for the sole purpose of supporting the accounting records.

The periods applied to technical data are as follows:

  • raw analysis records: 30 days for public analyses, 90 days for analyses of monitored sites;
  • availability records: 14 days;
  • expired account tokens and analysis transfers: 30 days;
  • log of emails sent: 180 days.
  • Advertising click identifier: thirty days from your arrival on the site.

The data of an audit request that has not led to the creation of an account is kept for three years from the last contact coming from you: a new request or a reply to our solicitations. If you create an account, it follows the period applicable to account data.

7. The rights of individuals

Every person has a right of access, rectification, erasure, restriction and objection, as well as a right to the portability of their data. These rights are exercised by writing to dpo@merkatis.io.

The account and all associated data can be deleted directly from the service, at any time, subject to the data whose retention is required by accounting and tax regulations. Other requests are handled manually by the publisher, on receipt.

You may withdraw at any time, and without having to give reasons, your agreement to the use of your data for prospecting purposes, by writing to dpo@merkatis.io.

8. Measurement of advertising campaigns

When you arrive on our site from an advertisement (Google, LinkedIn or ChatGPT), the address of the page may contain campaign parameters (source, medium, campaign, ad) and a click identifier assigned by the advertising network.

Only with your consent, we keep this information in your browser's session storage. It is erased when the tab is closed. If you request an audit, it is attached to your request and to your account, so that we know which campaign brought you to us.

If you use a business email address, we inform the advertising network concerned that an audit request, an account creation or a subscription has taken place, sending it only the click identifier. We send it neither your name, nor your email, nor the address of the audited site.

Legal basis: your consent. You can withdraw it at any time with the "Manage my cookies" link at the bottom of every page. If you decline, the site works normally and none of this information is kept. Only exception: if you request an audit, the campaign parameters present in the address of the page at that moment are recorded with your request, without any storage in your browser, without the click identifier and without any information sent to the advertising networks.

Recipients: Google Ireland Ltd, LinkedIn Ireland, OpenAI, only for the campaign you came from.

Retention period: the click identifier is kept for thirty days from your arrival on the site, then erased, including when it is attached to your account. The campaign parameters attached to your audit request are kept for as long as that request, and, if you create an account, for as long as your account (§6).

To exercise your rights: dpo@merkatis.io.

Other trackers. Our site uses a connection cookie that is strictly necessary for your account to work, a preference cookie that remembers the language you have chosen (twelve months), an item of local storage that records that you have closed the language choice banner, and an item of local storage that records your choice on the measurement of advertising campaigns (six months). As these elements are necessary for the service, for your preferences or for respecting your choice, placing them does not require prior consent. None of them is used to track you or to identify you.

Audience measurement. We measure the audience of our public pages with the Umami software, hosted on our own servers, without cookies or persistent identifiers. The data collected (page viewed, referring page, country, type of device and browser, originating campaign, steps of the journey: audit, registration, subscription) is aggregated and anonymous, and is not sent to any third party. It is kept for no more than twenty-five months. You can object to this measurement by enabling the "Do Not Track" signal in your browser.

9. Complaints

Any person who considers that the processing of their data does not comply may lodge a complaint with the Agencia Española de Protección de Datos (AEPD), the authority of the country where the data controller is established, or with the supervisory authority of their own country of residence.

10. Amendment

This policy may be amended. The applicable version is the one published on the service.

Document version: 1a6275d1086bd828