Privacy policy

Controller and contact

Merbac I/S, Danish registration no. 44646579, Frederiksgade 26, 2. sal th., 5000 Odense C, Denmark, is the controller for the processing described here. Contact services@merbac.com.

This policy covers the merbac.com landing page. The login link leads to the separate pilot.merbac.com service. Processing of employee and customer data in the platform requires separate information. The customer company will generally be the controller for its employee data.

Contact form and email

We receive your name, company and email, plus your phone number, message and module selections if provided. The form also sends the enquiry type and selected language. You provide this information, and we use it to answer questions, arrange demos and prepare quotes.

Your enquiry is emailed to services@merbac.com and you receive an automatic acknowledgement. The form does not subscribe you to a newsletter or create a subscription.

Name, company and a valid email are required to submit the form. Other contact fields and module selections are optional. Provide only necessary information; do not include national identity numbers, health information, passwords or other confidential information. You can also email us directly.

Purpose and legal basis

Ordinary business enquiries are processed under GDPR Article 6(1)(f). Our legitimate interest is communicating with potential customers and responding to relevant enquiries. If you are personally the prospective contracting party and the enquiry concerns steps before entering a contract, Article 6(1)(b) may apply.

Website operation and abuse prevention rely on Article 6(1)(f) and our legitimate interest in a secure, functioning website. Legally required retention relies on Article 6(1)(c). We do not make automated decisions about you with legal or similarly significant effects.

Technical information and security

Technical information, including your IP address and request information, is processed by the hosting provider to deliver and protect the website.

For form submissions, abuse protection stores a hash derived from the IP address and submission attempt times. Hashing is pseudonymisation, not anonymisation. A one-hour checking window limits repeated submissions; it is not an automatic file deletion deadline.

The website uses HTTPS and form emails are sent over an encrypted SMTP connection. Access to enquiries is limited to people with a work-related need.

Recipients and transfers

Hostinger provides hosting and email and processes relevant technical information and email content. Staff and advisers may access information where necessary to handle your enquiry or a legal obligation. We do not sell your information.

Providers’ international operations and support may involve processing outside the EU/EEA. Where this occurs, a valid transfer mechanism is required, such as an adequacy decision or the European Commission’s standard contractual clauses with necessary supplementary measures. Contact us for information about the basis and a copy of relevant safeguards.

Retention

Ordinary enquiries are normally deleted within 12 months of the last relevant contact, and sooner if no longer needed. If an enquiry becomes a customer relationship, necessary information continues to be processed for customer administration. Relevant information may be retained longer where legally required or needed for a specific legal claim.

Technical information and abuse records are kept while necessary for operation, troubleshooting or investigation of specific security incidents. Necessity is assessed during review and cleanup. An ongoing incident may require longer retention than routine operation.

Your rights

Subject to applicable conditions, you may request access, correction, erasure and restriction, and object to processing based on legitimate interests. Data portability may apply where its conditions are met. Contact services@merbac.com; we may request necessary information to verify your identity.

You may complain to the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, Denmark, via datatilsynet.dk. For employee data in the platform, normally contact your employer. We help route requests to the relevant controller.

Danish Data Protection Agency ↗

Cookies and updates

See the cookies page for information about browser storage. We update this policy when website processing changes. The version and date appear above.