Privacy policy

1. Who processes your data

The controller is MB Digitasodas, company code 305676811, registered address K. Čerbulėno g. 17-2, LT-47266 Kaunas, Lithuania (“Mervio”, “we”). For anything about personal data, write to pagalba@mervio.lt.

This policy covers the Mervio website mervio.lt, its forms and Mervio accounts (merchants, their team members and partners). It does not cover the shops that run on the Mervio platform: each shop is the controller of its customers’ and visitors’ data and publishes its own privacy policy, while Mervio processes that data only on the shop’s behalf under the data processing agreement.

2. What data we process and why

• Contact and partner forms. Your name, email, phone and company (if given), website or portfolio (in a partner application), message, the page you wrote from, campaign tags (UTM) in the link, IP address and browser information. Purpose: to answer your question or application and to protect the forms from abuse. Legal basis: our and your legitimate interest in communicating, and steps before entering into a contract when you ask about Mervio services (GDPR Art. 6(1)(b) and (f)). We keep it while we are in touch and no longer than 2 years after the last contact.
• Reports of illegal content. The link, type of violation, explanation, your name and email (optional for reports of child sexual abuse material), language, IP address and browser information. Purpose: to review the report and tell you about the decision, as required by the Digital Services Act (Regulation (EU) 2022/2065). Legal basis: legal obligation (GDPR Art. 6(1)(c)). We do not pass your name and email to the seller unless it is necessary to prove the violation. We keep reports while they are reviewed and for 3 more years for possible complaints and requests from authorities.
• Mervio account and subscription. Name, email, password (hashed only), two-factor authentication data, company details and VAT number, shop settings, subscription plan, invoices and payment history, acceptance of the terms of service, activity logs and support requests. Purpose: to provide the service, issue invoices and keep the account secure. Legal basis: performance of the contract and legal obligation (GDPR Art. 6(1)(b) and (c)). We keep account data while the account is active and accounting documents for 10 years, as required by Lithuanian accounting law. If you sign in with Google, we receive your name and email from Google.
• Partner links. If you arrive through a partner link (?via=…), your browser stores the partner’s code so that a shop opened later is attributed to that partner. Clicks are counted only as a daily total, without any data about you. Legal basis: legitimate interest in calculating partner commissions.
• Technical logs. The server records the time, address, IP address and browser information of each request. They are needed for security and fixing errors (legitimate interest). Logs are kept briefly and overwritten automatically.
• Visitor country. The server looks up the country of your IP address in the MaxMind GeoLite2 database stored on our own server: your IP address is not sent to MaxMind. The country is used only when a shop restricts access by country, and it is not stored.

We do not use analytics, advertising or social media tracking on the Mervio website. We do not make automated decisions with legal effects on you.

3. Cookies

We only use cookies that the website needs to work, so we do not ask for consent to them.

You can delete cookies in your browser settings; without the session cookie the forms and sign-in will not work.

4. Who receives the data

We do not sell data. It is processed only by service providers bound by data processing agreements:

We may also disclose data to public authorities when the law requires it and, for reports of illegal content, to the shop when the violation cannot be reviewed otherwise.

5. Your rights

You can ask to access, correct, erase, restrict or port your data, and object to processing based on legitimate interest. Write to pagalba@mervio.lt and we will reply within 30 days. You can view and change your account data yourself in the account settings. You also have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, Vilnius, vdai.lrv.lt).

6. Changes

If our processing changes, we will update this policy and the date at the top. We will email Mervio account holders about material changes.

7. Third-party data

This product includes GeoLite2 Data created by MaxMind, available from https://www.maxmind.com.