Privacy policy

Draft text. To be reviewed by a lawyer before publication.

1. Who is responsible

The controller of your personal data is NI MED EOOD, 17 Lyuben Karavelov Str., 8000 Burgas, Bulgaria. You can contact us about privacy at [email protected].

2. What data we process

• Contact form: name, e-mail address, company, country and the content of your message.
• Partner application and account: company name, VAT number, address, website, contact person, e-mail address, phone number, your interests and a password (stored only as a one-way hash).
• Order requests: the items, sizes and quantities you request, prices, totals and your note to us.
• Technical data: to protect the site from abuse we use your IP address only in the form of a hash for rate limiting. We do not store your raw IP address in our database.

3. Why we process it and on what legal basis

• To answer your message and to review partner applications and order requests: performance of a contract or steps taken at your request before a contract (Art. 6(1)(b) GDPR).
• To keep the site secure and prevent abuse: our legitimate interest (Art. 6(1)(f) GDPR).
• To meet tax and accounting duties: legal obligation (Art. 6(1)(c) GDPR).

4. Cookies

We use only cookies that are necessary for the site to work. See the cookie policy. We do not use advertising or analytics cookies.

5. Who receives your data

Data is processed by us and by service providers who host the site and send e-mail on our behalf: Hetzner Online GmbH (server hosting, Germany) and Cloudflare, Inc. (content delivery and protection against attacks). E-mail is sent from our own mail server on the merrowbrand.eu domain. We do not sell personal data.

6. How long we keep it

[TODO: retention periods for contact messages, partner accounts, orders and accounting records]

7. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. You can also withdraw any consent you have given. To use these rights, write to the privacy contact above. You also have the right to lodge a complaint with your national data protection authority.

8. Changes

We may update this policy. The current version is always published on this page.