Privacy Policy

Merkiz, UAB is a company registered in Vilnius, Lithuania, operating the Merkiz B2B e-commerce platform available at merkiz.com, merkiz.lt and merkiz.de. For the personal data of visitors to our websites and of our direct customers, Merkiz acts as the data controller. For personal data processed inside customer stores (such as buyer accounts and orders), Merkiz acts as a data processor on behalf of the store owner.

You can reach our privacy team at privacy@merkiz.com.

We collect only the data we need to operate our services:

We process personal data on the following legal bases: performance of a contract (operating your store and account), legitimate interest (securing the platform, preventing fraud, improving the product), legal obligation (accounting and tax law) and consent (marketing communications, non-essential cookies).

We do not sell personal data, and we do not use it for automated decision-making that produces legal effects.

All platform data is stored and processed in data centers located within the European Union. Where a sub-processor is established outside the EU, transfers are protected by adequacy decisions or Standard Contractual Clauses.

A current list of sub-processors is available on request from privacy@merkiz.com.

Account and store data is retained for the duration of your subscription and for 30 days after cancellation, after which it is permanently deleted. Billing records are kept for 10 years as required by accounting law. Log data is retained for a maximum of 12 months.

Under the GDPR you have the right to access, rectify and erase your personal data, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. To exercise any of these rights, email privacy@merkiz.com — we respond within 30 days.

You also have the right to lodge a complaint with your supervisory authority. In Lithuania this is the State Data Protection Inspectorate (VDAI).

Our websites use strictly necessary cookies for session handling and language selection, and — only with your consent — analytics cookies that help us understand how the site is used. You can change your cookie preferences at any time via the cookie settings link in the footer, and you can delete cookies through your browser settings.

We protect personal data with industry-standard measures: encryption in transit and at rest, role-based access controls, audit logging, regular penetration testing and staff security training. Access to production data is limited to employees who need it to operate the service.

We may update this Privacy Policy as our services or the law evolve. Material changes will be announced by email to account holders and via a notice on this page at least 14 days before they take effect.