This Privacy Policy explains how Merriloom (“we”, “us”) collects and uses your personal data when you visit merriloom.org or buy from us, and what rights you have under the EU General Data Protection Regulation (GDPR).
1. Controller
The controller responsible for processing your personal data is Merriloom, operator of merriloom.org. For any privacy questions or requests, contact us at [email protected].
2. Data we collect
- Order data: name, billing and shipping address, e-mail address, phone number, ordered products and order history.
- Payment data: payment method and transaction status. Full card details are processed directly by our payment providers and are not stored by us.
- Account data: if you create an account — your login details and saved addresses.
- Communication data: messages you send us via e-mail or the contact form.
- Technical data: IP address, browser type, device information and pages visited, collected through server logs and cookies.
3. Purposes and legal bases
- Processing and delivering your order, handling returns and customer service — performance of a contract (Art. 6(1)(b) GDPR).
- Meeting legal obligations, such as tax and accounting record keeping — legal obligation (Art. 6(1)(c) GDPR).
- Operating and securing the website, preventing fraud — our legitimate interests (Art. 6(1)(f) GDPR).
- Analytics and marketing cookies, newsletters — only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
4. Who we share data with
We share personal data only as needed to run our shop, with:
- payment providers, to process payments;
- shipping carriers, to deliver your order;
- hosting, e-mail and IT service providers acting as our processors;
- authorities, where required by law.
We do not sell your personal data.
5. International transfers
Where a service provider is located outside the European Economic Area, we ensure an adequate level of protection, for example through an adequacy decision of the European Commission or Standard Contractual Clauses.
6. How long we keep data
We keep order and invoice data for as long as required by tax and commercial law (typically up to 10 years). Account data is kept until you delete your account. Contact form messages are deleted once your request has been resolved, unless we need them for legal reasons.
7. Your rights
You have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, where there is no legal reason for us to keep it;
- restrict or object to processing;
- receive your data in a portable format;
- withdraw your consent at any time, without affecting earlier processing.
To exercise these rights, e-mail [email protected]. You also have the right to lodge a complaint with the data protection supervisory authority in your country of residence.
8. Cookies
We use cookies that are necessary for the shop to work, and — only with your consent — optional cookies. Details are in our Cookie Policy.
9. Security
We use appropriate technical and organisational measures, including encrypted connections (TLS), to protect your personal data against loss and unauthorised access.
10. Changes to this policy
We may update this Privacy Policy from time to time. The current version is always published on this page with the date of the last update.