Legal
Merqi — Privacy Notice
Version 1.0 | Effective 16/09/26
This notice explains how Merqi collects and uses personal data. It is written in four parts, because we handle data differently depending on who you are:
- Part A — visitors to getmerqi.com
- Part B — clients and their personnel
- Part C — sellers, retailers and businesses we observe on marketplaces (read this if you have been told your storefront appears in a Merqi report)
- Part D — prospective clients we contact
Parts E to K apply to everyone.
Who we are
Merqi is a marketplace and retailer monitoring service operated from Ireland.
We are the controller of the personal data described in Parts A, C and D. For Part B we are controller of account and contact data, and processor of personal data contained in material our clients supply to us.
Contact us about anything in this notice: contact@getmerqi.com
We are not required to appoint a Data Protection Officer and have not appointed one. Enquiries go to the address above.
Part A — Visitors to getmerqi.com
What we collect. If you submit a form (demo request, audit request, contact, newsletter): your name, business email, company, job title where given, and whatever you write in the message. Automatically, when you visit: IP address, approximate location derived from it, browser and device type, pages viewed, referring page, and timestamps.
Why, and on what basis.
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry or demo request | Legitimate interests — dealing with a request you made to us |
| Sending you a requested audit, sample or research document | Legitimate interests — supplying what you asked for |
| Keeping the site secure and available, and investigating misuse | Legitimate interests — protecting our service |
| Analytics and measuring how the site is used | Your consent, given through the cookie banner |
| Sending marketing emails after you have opted in | Your consent, withdrawable at any time |
How long. Enquiry correspondence: 24 months from your last contact with us. Server and security logs: 12 months. Analytics: as stated in the Cookie Notice. Marketing list: until you unsubscribe, then a suppression record so we don't contact you again.
Part B — Clients and their personnel
What we collect. Business contact details of your staff and authorised users; account and login identifiers; access and usage logs; billing and payment records; and correspondence with us.
Why, and on what basis. To provide the service, manage the account, invoice, support you, and keep records — on the basis of performance of our contract with you, our legitimate interests in running and improving the service, and our legal obligations in tax and accounting.
Material you send us. When you supply catalogues, reference prices, sales or order records or other files, any personal data inside them stays under your control. You are the controller and we act as your processor, under our Data Processing Addendum, which forms part of our agreement with each client and is available on request. We process that material only to provide the service.
How long. Account and contact data: for the term of our agreement plus 12 months. Financial records: 6 years, as required by Irish tax law. Client material: per our agreement — generally deleted after the 30-day export window following termination.
Part C — Sellers, retailers and businesses we observe
Read this if you sell on a marketplace and have been told your storefront appears in a Merqi report.
What we do. Merqi monitors publicly visible listings on marketplaces and retailer websites on behalf of brand owners, so they can see who is selling their products, at what price, and where their products are missing. Most of what we collect concerns companies, not individuals. But some sellers trade as individuals or sole traders, and some storefront and contact details name a person. Where that happens, we are processing personal data, and this Part applies.
What we collect about sellers. Storefront and trading name; seller identifier on the marketplace; business name, address and registration details as displayed on the listing or in a public register; listing content, prices, offers, availability, fulfilment method and how these change over time; and, where we make one, an inferred association between a storefront and a legal entity or between several storefronts and one operator.
Where it comes from. Entirely from sources that are already public: marketplace and retailer listings and seller information pages, and public business and company registers. We do not buy seller data, and we do not obtain it from our clients' private records.
Our lawful basis is legitimate interests — specifically, the interest of brand owners in understanding how their own products are distributed and priced, and our interest in providing that service. We have carried out a legitimate interests assessment weighing this against your rights. You can request a summary of it at contact@getmerqi.com.
Why you did not hear from us directly. Article 14(5)(b) GDPR allows us not to notify each person individually where doing so would involve disproportionate effort. We observe a very large number of storefronts, most of which are companies rather than individuals, and we hold no contact route to most of them. Publishing this notice is how we make the information available instead.
What we are careful about. Our seller associations are inferences drawn by automated matching, not verified legal determinations, and they can be wrong. We tell our clients this in our terms and we flag low-confidence results. We do not make automated decisions producing legal effects about you.
How long we keep it. Observation records: [24] months, after which they are deleted or aggregated into statistics from which you cannot be identified. Inferred entity associations: [12] months, refreshed or dropped.
Your rights. You can ask us what we hold about you, ask us to correct it — including a wrong association between a storefront and a person or company — and object to our processing it. Because our basis is legitimate interests, an objection means we stop unless we can show compelling grounds that override your rights. In practice, if you tell us a storefront is operated by you personally and you object, we will act on it. Email contact@getmerqi.com with the marketplace and storefront name.
Part D — Prospective clients
What we collect. Business contact details of people in relevant roles at brands and manufacturers — name, job title, employer, business email, public professional profile — obtained from company websites, public professional networks and business data sources. We may also produce a sample report about that company's publicly listed products and send it to them.
Lawful basis. Legitimate interests in promoting a business-to-business service to businesses likely to have a use for it. We contact people only in their professional capacity, about a service relevant to their role. We do not send marketing of this kind to consumers.
Your choice. Every message identifies us and tells you how to stop. Reply "stop", or email contact@getmerqi.com, and we will remove you and keep a minimal suppression record so you are not contacted again. We honour objections immediately and without argument.
How long. Prospect records: 24 months from last contact, or until you object.
Part E — Who we share data with
We do not sell personal data and we do not share it for anyone else's marketing.
We share it with service providers who process it on our behalf — hosting and cloud infrastructure, data storage, automated matching and text processing, email delivery, error monitoring, analytics, payments and accounting. Each is bound by a written contract limiting them to our instructions. We keep a current list of the providers we use, naming each one and where it processes data; email contact@getmerqi.com for a copy.
We also share data with our professional advisers where needed, with authorities where we are legally required to, and with a buyer if we ever sell or reorganise the business.
A note on reports. Reports we produce for clients describe how products are being sold, and name storefronts and sellers. Where a seller is a sole trader, that is personal data being disclosed to our client. Our clients are contractually restricted to using reports for their own internal business purposes and are prohibited from using them to fix or enforce resale prices.
Part F — International transfers
We host and store data in the European Economic Area wherever we can. Some of our service providers process data outside the EEA. Where that happens we rely on an adequacy decision, or on the European Commission's Standard Contractual Clauses together with an assessment of the destination country and additional safeguards. We can tell you which providers process data outside the EEA, where, and which safeguards apply — email contact@getmerqi.com.
Part G — Security
We protect personal data with access controls on a least-privilege basis, multi-factor authentication on administrative accounts, encryption in transit and at rest, logical separation of each client's data, logging, regular encrypted backups, and a documented incident response procedure. No system is perfectly secure, but we take these measures seriously and review them.
Part H — Your rights
Under the GDPR you have the right to: be told what we hold and get a copy; have inaccurate data corrected; have data erased in certain circumstances; restrict how we use it; receive data you gave us in a portable format; object to processing based on legitimate interests, including profiling; and withdraw consent at any time where consent is our basis, without affecting what we did before you withdrew it.
To exercise any of these, email contact@getmerqi.com. We respond within one month, extendable by two months for complex requests, and we will tell you if we need more time. We may ask for enough information to identify you and your records. There is no charge unless a request is manifestly unfounded or excessive.
Complaints. If you are unhappy with how we have handled your data, tell us first and we will try to resolve it. You also have the right to complain to the Irish Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28 — dataprotection.ie — or to the supervisory authority where you live or work.
Part J — Changes
We update this notice when our processing changes. The version in force is the one published here, with its effective date at the top. Where a change materially affects you and we have a way to reach you, we will tell you.
Part K — Company details
If you have any questions please contact us at contact@getmerqi.com.
Last updated 16/09/26. Merqi — Privacy Notice, version 1.0, effective 16/09/26.